Cyber Risk Management Podcast

After a breach, you either pay the fine, or fight the regulator and lose. There's a third path. It comes down to one word: reasonable. A method called DoCRA turns that question into something a court can use. DoCRA is short for Duty of Care Risk Analysis. Our guest Chris Cronin of HALOCK Security Labs helped build it. Now it's in standards and law. And it shaped a real case where a breached company spent its money on cybersecurity, not fines. Your hosts are Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

LinkedIn: https://www.linkedin.com/in/chris-cronin-351416/

"Fire Doesn't Innovate" by Kip Boyle:

https://a.co/d/0bYatohy

Learn more about DoCRA: https://docra.org

There's a popular new playbook for running an "AI-native" company. Record everything, put all your data in one place, and let an AI agent reach all of it. The productivity story is real. New hires ramp up in days, and the whole company can ask questions it never could before. But the same moves that create the speed also switch off safeguards that some businesses are not allowed to switch off. So, which controls are we turning off to get this speed, and are we allowed to? Your hosts are Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

 

Y Combinator's AI native playbook video -- https://youtu.be/B246K_G7mHU

AIR-MAP website -- https://air-map.io/

Your cybersecurity tools were built for people: a login, a single sign-on, an email address. But the AI agents now showing up inside your company don't work that way, and most of them slip right past your controls. So how do you find the "Shadow AI" already running in your business, and get a handle on it? Let's find out with our guest Nancy Wang, Chief Technology Officer at 1Password, who works at the front edge of how machines get access to systems. Your hosts are Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

 

LinkedIn profile profile: https://www.linkedin.com/in/wangnancy/

 

1Password: https://1password.com/

Would you know if the AI tools your team is buying are actually trustworthy to use? Who gets to decide what trustworthy AI even means? Let's find out with our guest Jim Reavis, CEO of the Cloud Security Alliance, the group that helped the world learn to trust the cloud and is now building the standards for trusting AI. Jim explains how AI is changing what attackers, defenders, and governments can do, and walks through the tools his team built so you can adopt AI without guessing. Your hosts are Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

 

Cloud Security Alliance: https://cloudsecurityalliance.org/

Anthropic, the company that built Claude, just accidentally published the full source code of their most important product. And it was their second data exposure in five days. What does this teach every organization buying AI tools right now? Kip Boyle shares the best takeaways from CRO's AI governance training and explains why the risk of AI isn't the AI itself. Your host is Kip Boyle, CISO with Cyber Risk Opportunities.

 

Subscribe to Inflection Point -- https://cr-map.com/inflectionpoint/

SecureWorld AI Security PLUS course -- https://www.secureworld.io/events

"Gears Don’t Guess: The Executive’s Practical Guide to Thriving in the Face of AI Hype and Risk" (forthcoming book, Fall 2026)

AIR-MAP AI Risk Assessment -- https://air-map.io