Caffeinated Risk is a monthly podcast aimed at information security professionals, hosted by two self-described grumpy security veterans. Each episode digs into how security risk has been handled in practice, drawing on the hosts' past experience managing real-world threats. They also bring in guests from the information security and risk management fields for forward-looking conversations. The tone is candid and practitioner-focused rather than vendor-driven.
Episodes
Human Risk Factor Analysis with Carlamay Sheremata
Security systems protect the resources and mission of an organization, unlike most episodes where the impact is in dollars, this time it's the people behind the decisions. Crisis management doesn't start when the fire alarm rings and an afternoon team building activity wont repair the dynamics that could be the biggest threat to an organization's resilience. Carlamay Sheremata tack
The Summer's Over Show
Doug and Tim wrap up the summer with a look at both regulatory changes for critical infrastructure post Bill C8 and then jump across the ocean to dig into some European regulations. AI is top of mind for most and while the technology may be fascinating for some, the business consequences of bad decisions don't magically disappear. Critical thinking is potentially the best risk mitigation opt
Inherent risk & business strategy with Patrick Hayes
There are few business strategy conversations in 2026 that don't include the term AI, yet like the digital "game changers" before such as mobility, voice over IP, Cloud computing and of course the internet, after the hype fundamentals still matter in business. Patrick Hayes , a cyber security thought leader long before it was fashionable, recently released the second book in a seri
Designing AI Enabled Security Products with Rachelle Loyear
Our inaugural podcast guest and friend of the show Rachelle Loyear has recently released her third book, "Enterprise Security Risk Management (ESRM) in the Real World". We are adding to the Caffeinated Risk summer reading list and marking the occasion with some additional content from the May 2023 episode . Despite being more than two years prior to the recent OpenAI Hugging Face incide
Cybercrime, Intelligence and Impact with Richard LaTulip
Richard LaTulip joins Caffeinated Risk for a candid conversation connecting cybercrime investigations, threat intelligence, and practical business risk. Richard is a Field CISO with Recorded Future, a former United States Secret Service special agent, and both the author and real-life main character behind the true crime story Operation Carder Kaos.The discussion starts with Richard’s experience i
Risk Management - Enabling the pursuit of excellence with Joe Olivarez
Visiting the Jacobs Engineering website you'll undoubtedly encounter the phrase "challenging today", an acknowledgement that the world is much more complex than ever before. While "it ain't like it used to be" can be said of any risk manager's portfolio, Joe Olivarez became the first global security leader in Jacobs history more than a dozen years ago. How muc
Risk conversations; Awkward, Unpopular and Essential - with Joshua Copeland
Joshua Copeland's cyber security moniker is "The Unpopular Opinion Guy", while most of us in security roles have been that person with an unpopular opinion at least a time or two, Copeland turned it into both a book and a bit of a movement through numerous posts on Linkedin about many of the challenges in our industry.That said, this is not a mud slinging episode, Joshua had numer
Cyber Security, the legal perspective with Brent Arnold
"Legal and Regulatory" is a common receptor category in most enterprise risk matrices but with any luck most organizations have limited direct experience with cyber litigation matters. This episode jumps right into the deep end with one of Canada's preeminent cyber lawyers, Brent Arnold. Business law has evolved over hundreds of years, cybersecurity precedents began to appear on
Cyber Resilience, a National Solution with Herbert Fensury
Cyber crime is now a daily fact of life and a significant concern in both the private and public sectors but our response capabilities do not seem to be keeping up. This episode dives deep into one organization that is combatting this problem with a combination of academic research, industry expertise and hands-on training with the founder and CEO, Herbert Fensury. While cyber security is a globa
Integrated Assurance with Patrick Hayes
20 years after their paths first crossed, three Canadian security professionals regroup to discuss a new risk management strategy book based on hard won field experience. Patrick Hayes was a security strategist before organizations knew this was success differentiator. For decades he has been guiding organizations large and small, public, private and government on balancing business objectives wi
The Summer Show - 2025, (pt 2)
Part 2 of this summer break episode takes a bit of a light hearted look at the cyber security industry predictions that become the norm in late December and early January. Eight or nine months later, how accurate where they? Take a listen, there are a couple surprises.The conversation uncovers a few ongoing challenges with the cyber security industry, from the digital divide associated with aging
The Summer Show - 2025, (pt 1)
The summer show started with the light hearted goal of evaluating the top security predictions that fill the internet in late December each year. Forever unscripted, Tim and Doug wind up reflecting on the growing gap between physical and virtual information systems. While it is easy to lament, from a cognitive perspective there is little hope, the BSides movement, alive and well in Western Canada
ESRM roots, revelations & resilience with John Petruzzi
Enterprise Security Risk Management (ESRM) principles appear in almost every episode and this one is a bit more overt because it features two of the three people responsible for promoting ESRM in the early days of it's reintroduction through ASIS. John Petruzzi is now the CEO of Unlimited Technology and leading them toward an expanded influence in the enterprise security industry, sharing ins
Global Risk Management as Strategic Advantage with Dominic Bowen
The Caffeinated Risk hosts navigate time zones and catch up with Dominic Bowen traveling between meetings to discuss risk management with an international expert on the subject. Mr. Bowen is a partner and Head of Strategic Advisory at 2Secure, one of Europe's leading risk management consulting firms, as well as the host of the International Risk Podcast. Political tensions are higher than the
Simplifying risk analysis using FAIR and Wiley Coyote with Jack Freund
A while back we were fortunate enough to spend time with Jack Freund, coauthor and thought leader responsible for bring the FAIR methodology and practice into the main stream. A bonus from that original recording is now an espresso shot discussing how to fast track an assessment when the threat vectors are numerous. While the metaphor Jack used is somewhat unexpected it's both memorable and a
SMB Resilience and lessons for larger organizations with Rochelle Clarke
At 45-50%, depending on your statistical source, there is no denying that small to medium sized businesses are a significant economic engine from both an employment and innovation perspective. In 1978 Microsoft numbered 11 people. Unfortunately small businesses are also the least likely to survive a major disruption, an experience that changed Rochelle Clarke's corporate leadership trajector
Addressing Risk and Cyber Resilience, the Alberta Approach - with Rachel Hayward
A surprising number of digital innovations began in Alberta, be it the world's first public digital cellular network in 1985, the DNP3 industrial controls protocol and becoming the first Google international research lab in 2017. CyberAlberta is another innovative collaboration focused on strengthening the cyber resilience of Alberta organizations. At almost 330 billion annually, protectin
Security Risk Management in an Open Data Environment with Michael Spaling
Ever wondered how top universities protect their cutting-edge research from prying eyes while ensuring seamless access for their scholars? Join us as Michael Spaling, Principal Security Architect at the University of Alberta, takes us behind the scenes of this high-stakes balancing act. Just like any other large organization, research universities have many different stakeholder, operational and r
Engineering, Risk Management for Cyber-Physical Systems with Andrew Ginter
The practice of engineering dates back thousands of years, incorporating science and mathematics to solve problems in the ancient world, and remains a key requirement for developing the complex digital systems controlling the physical systems core to our modern way of life. Unfortunately connectivity and complexity have created a vulnerability we must now engineer our way out of, and just like ris
Deviance Normalization & Risk Management with Marco Ayala
Technological change is inevitable and often one of the aspects that attracts people toward careers in information and operational technology. Although risk management is a part of navigating advancement in any area, the fundamental flaw in any management system is our human tendencies. This episode explores how organizations can make slow, steady migration from first principles to risky undertaki
Managing Supply Chain Risk Management - with Darren Gallop
Whether it's the NIST CSF, 8276 or the new European Cyber Resilience Act there is no denying the expectation that supply chain management (SCM) is a risk management area no organization can ignore. While SolarWinds is recent common reference in many SCM discussions, this episode's guest takes us back to Target's major data breach that resulted in significant changes to the PCI-DSS
Metawar and Fostering Resilience with Winn Schwartau
Long before the Matrix captured peoples imaginations, Winn Schwartau was steadily offering red pills for those reading his many books on information warfare. A scholastic level researcher without the pretense, Mr. Schwartau has been recognized internationally as one of the leading security thinkers of our time and has a special capability for distilling complex security concepts into every day la
Resilience and I.R. Lessons Learned (the hard way) - with Adam McMath
Almost all incident response plans include a "lessons learned" step, and in the post adrenalin phase that follows many breaches, reviewing what worked and what needs improving doesn't excite a lot of people. Adam McMath is clearly the exception, leading incident response activities in both the cyber realm and physical. How do resilience and incident response lessons learned while
ESRM a Transformation Catalyst with Radek Havlis
Amongst the industry verticals classified as critical infrastructure, few would argue that telecommunications belongs in the top that list, placing even more weight on a risk management program due to cascading impacts. Consequently, safe reliable operations are essential for success while continuing to grow in a highly competitive marketplace. A security risk management challenge across many dim
Contingency Planning, Cyber Resilience and Incident Response
Regulatory frameworks from PCI-DSS to NERC-CIP to the newly minted NIST CSF 2.0 each require organizations of all sizes to have cyber incident response plans. Most of us who have spent any time in cubicle filled office towers are familiar with fire drills to clear the building and gather staff at muster points, and that is as close as we get to the real thing. Unfortunately that same lucky str
The Business Context of Cyber Resilience with Steven J Ross
Those running a business today who have not experienced disruption due to cyber issues or attacks know it is only a matter of time. Even if their organization is not directly targeted, the modern marketplace comprised of multiple, interconnected supply chains, means impact is unavoidable but this episode's guest, Steven J Ross contends planning, design and clear priorities can provide mitig
Building a Cyber Risk Management Program with Brian Allen
The U.S. Security Exchange Commission defined new rules for cyber risk matters facing publicly traded corporations in July of 2023. Although the SEC's mandate is limited to publicly traded companies in the United States, where one regulator goes others are apt to follow. Brian Allen is the co-author of a brand new book putting form, structure and traceability around the SEC mandated require
CyberPHA - OT Risk management With John Cusimano
The ISA 99 standards body is one of the most recognized authorities on cyber physical security covering many aspects of a cyber security management system for industrial control systems including risk management. This episode features John Cusimano, former chairman of the ISA subcommittee responsible for authoring the risk management portion of the standard 62443-3-2:2020 Mr. Cusimano takes us
Science, Crime and Workforce Development with Dr. Martin Gill
Security and crime are often in close proximity but not always studied together. This month's episode features Martin Gill a criminologist who made the study of crime and security his life's work. After a decade as a lecturing professor at the University of Leichester, Mr. Gill started Perpetuity Research in 2002 and continues to provide very high quality research, both qualitiative an
ESRM a Decade In and The Emergent Threat Landscape
Post GSX conference, which included an in-depth review of ESRM and an interview with former U.S. president George W Bush, this episode considers how enterprise security risk management has stood the test of time as well as how risk analysis will need to evolve . Financial receptors can be found in almost every organizational risk matrix but how do those decisions change with modern ransomware att
Business Enablement using Converged Risk Management with Michael Lashlee
The convergence buzzword has come and gone and some organizations have struggled to reap the benefits of physical and cyber security departments working in tandem toward common goals. Michael Lashlee, deputy Chief Security Officer at Mastercard, shares security insights from the US Marines, secret service and financial services tech giant Mastercard, illustrating how principles from very differe
Interpreting Risk within a Regulatory Context with Terry Freestone
Calgary was an ICS cyber hub before most knew such measures were necessary, Terry Freestone was one of the ICT specialists from those early days who now applies his decades of hard-won knowledge in the offices of the Canadian Energy Regulator. Speaking as a private citizen and cyber security expert rather than a government representative, Terry and the Caffeinated Risk team explore risk manage
2023 Summer Show
Keeping up the accidental annual tradition Tim and Doug take a retrospective look at risk management as a mid-year pulse. The 10th annual Cyberthreat Defense report forms the underlying theme but digging under the statistics to analyze how these might pertain to ESRM. Communication also popped up as a topic, and Tim shares some lessons learned from the field as well as a professional development
ESRM and Data Science with Rachelle Loyear
One of the original authors of the ESRM framework, now in it's tenth year, and Caffeinated Risk's first guest returns to discuss how data science is changing security and risk management. While alchemy may be a bit of a stretch, Ms. Loyear ongoing focus of including human behaviour in the risk equation is leading to the development of data science based detection capabilities that woul
Attack Tree Calibration with Terry Ingoldsby
Threat modeling expert and inventor of one of the world's first attack tree modeling products talks about how to integrate subject matter expertise into the risk equation, the answer may be surprising.Bonus content not included in the original interview with Terry which dove deep into the history of attack trees, modern applications and exploring why there is no AI magic when it comes to id
FAIR and ESRM, exploring common ground with Jack Freund
Factor Analysis of Information Risk (FAIR) and Enterprise Security Risk Management (ESRM) took different evolutionary paths yet share a lot more commonality than catchy 4 letter acronyms and mainstream adoption by notable organizations like NIST, The Open Group and ASIS international. Jack Freund personifies the term "risk management thought leader" with professional qualifications and
Cyber-Physical Convergence Revisited
In addition to hybrid work and regular time in the office being the new normal, 2023 marks the year Caffeinated Risk's co-host Tim McCreight serves as the president of ASIS international. ASIS has long been a proponent of both physical and cyber security professionalism and one of the first organizations to explore and embrace Enterprise Security Risk Management (ESRM) as an integral elemen
ESRM Enablement via Location Intelligence with Alex Martonik
Realtors have long advocated "location, location, location" as a path to investment success. Fast forwarding a few generations, location intelligence applied to risk management is paying dividends well beyond real-estate and Esri is a world leader in this fascinating application of geo-spatial information. Esri business solutions leader Alex Martonik shares examples of businesses m
Privacy & Toxic Data with Michelle Finneran Dennedy
A great discussion point that didn't make it to air from the original 2021. Not all data is of equal value to the organization and the viable shelf life is seldom tracked or even discussed. This espresso shot takes a humorous look at a serious question about privacy considerations during the development cycle and check out the original full episode with privacy thought leader Michelle Finnera
Classifying and effectively communicating enterprise security risk with Paul Mercer
Communication isn't effective until the receiver understands the message well enough to take action. That pretty much sums up the challenge facing many risk professionals today, something Paul Mercer resolved, out of necessity, by building risk management software that is proving to be a welcome solution for many notable customers. Mr. Mercer is no stranger to the front lines of risk managem
Redefining the risk management business partnership with Rachelle Loyear
Co-author of the original book on Enterprise Security Risk Management, it only made sense to have Rachelle be the first Caffeinated Risk guest. Like many guests, there was just too much material for a 30 minute episode. This espresso shot encore digs into that nuanced topic of truly partnering with business stakeholders.
Resilience as a Risk Management Strategy
Anyone with a bit of time in the security industry is well acquainted with Murphy's law but crisis management specialists are who you call when things suddenly get very real. While common security guidance advocates protection, readying your organization to weather the inevitable failure in prevention measures starts with resilience.international crisis management thought leader Alexandra
Infrastructure Resilience and Ethical Considerations
Recorded two days after the July 2022 nationwide telecom outage, co-hosts Tim and Doug explore the deeper ramifications of losing access to the very services that are so tightly integrated into our lifestyle. While the complete root cause of the Rogers' outage may never be publicly shared, most organizations face similar constraints, leading to a discussion about ethics and our shared comm
GRC Program Development and Implementation with Josh Sokol
Sooner or later every risk management professional faces the hard reality that comprehensive risk management programs can't be implemented on spreadsheets. A corporate vice president mandate, minus the funding, started Josh Sokol on a journey that turned his initial platform solution into an opensource project that morphed into a commercial venture. While meeting the risk management and comp
Strategies for meeting the cyber skill set challenge with Martin Dinel
Chief Information Security Officer Martin Dinel has all the same technology challenges of every other large organization. Placing Alberta in front of that CISO title brings the additional requirements of protecting government secrets, interfacing with national security, protecting financial and health information of more than 4 million people as well as the infrastructure of a province almost the
Risk management in the cloud with Illena Armstrong
Very few organizations, from three letter agencies to the local brew pub are not using cloud services to some degree and those previously resistant had no choice once Covid 19 hit. In 2022, with global conflict, organized crime, multiple supply chain and service concerns, what is required of a security professional responsible for navigating risk for their enterprise which invariably includes &q
Cyber Crime and Risk Management Strategies with Cara Wolf
Acknowledged by IT World Canada as one of the top 20 women in cyber, Cara Wolf shares insights into the Canadian tech industry , the need for innovation and tactics for drawing senior leadership's attention to cyber security issues during a candid discussion on the changing aspects of cyber crime . Long before cyber crime was a mainstream concept Ms. Wolf was a seasoned fraud investigator w
Continuous Authentication and Risk Management with Ian Paterson
The threat landscape is evolving, if your security controls are not, the outcome is all but assured. In this episode Tim and Doug are joined by Canadian cyber security serial entrepreneur Ian Paterson, CEO of Plurilock. Mr. Paterson shares hard won insights from extensive data science research and development , how this intelligence enables continuous monitoring to be applied to a technology stack
Castles and Network Management with Winn Schwartau
A light hearted espresso shot with renowned information security writer Winn Schwartau and Tim McCreight discussing the serious and all too common problem of uncontrolled ingress and egress.While the first electronic firewalls may have come into vogue in the late 80's, Winn and Tim uncover parallels with perimeter security developed in the middles ages.
Unpacking the Security Value Chain - Dave Tyson
An espresso shot covering a great idea Dave Tyson originally shared in his book and discussed during our 2021 interview on identifying where security can contribute to the business value chain and some strategies for selling the benefits. With thought leaders like Dave there are many more insights than time in each monthly episode, so in 2022 we'll be combing through older interviews and sh
Innovation and Influence
The year end episode does some comparing and contrasting of risk management in different areas, including things outside of cyber. Ironically, recorded just a couple days before most of the world learned about a module design choice in Java that suddenly makes logging dangerous, it brings home the point that our cyber threat landscape is complex .Complexity and uncertainty are nothing new for cybe
Applying Scientific Principles to Risk Management - With Doug Millward
While many in risk management or cyber security reference standards and leading practices, it can often be based on tacit acceptance, rather than deep research. There is an argument that that research is too slow compared to commercial solutions, especially considering our current threat landscape and resource constraints. This episode explores the possibility of a middle ground and challenges a
Risk and Kinetic Consequences - with Paul Smith
Skilled penetration testers are some of the more specialized people within the information security industry. When it comes to safely testing kinetic systems the pool of talented ethical hackers shrinks again but does include Paul Smith who has written a brand new book on the subject. An ICS security specialist before it was a recognized specialty, Paul Smith has been a field operator, security te
Privacy Engineering, Manifesto & Beyond with Michelle Finneran Dennedy
Formerly vice president and chief privacy office at Cisco, CEO of Drumwave and a licensed attorney, Michelle Finneran Dennedy is recognized as a visionary leader in information systems privacy. Currently the co-founder of Privatus Consulting supporting clients working through the wicked problem of privacy in this digital age.Much to the benefit of Caffeinated Risk listeners she is also a friend o
Following the Money in Cybersecurity with Larry Whiteside Jr.
A business without cash flow isn't a business for long and security solutions are seldom free yet cyber security is a line item that business owners ignore at their peril. Cost management and risk management come together in this lively podcast with special guest Larry Whiteside Jr. a former US Air Force division chief who has held a number of senior cyber security executive positions since
Back to work, just in time for summer
Cohosts Tim and Doug explore the security implications of workers returning to the corporate networks after over a year working remotely. Is there a new art of the possible to be considered based on the changes most organizations needed to make to networks and applications to get through the pandemic lockdown? Is this now more important than ever since the financial impacts of ransomware have reac
A Business First Security Focus with Dave Tyson
Dave Tyson literally wrote the book on Managing Enterprise Security Risk through converged security while serving as the CSO for the City of Vancouver during the winter Olympic games. A practitioner rather than a theorist, Tyson has held senior security leadership positions at multiple major organizations including eBay, Pacific Gas and Electric and SC Johnson.In this episode Dave Tyson discusse
Security risk analysis using attack trees with Terry Ingoldsby
"We need more science in Cyber Security" David Hechler, TAG Cyber Law Journal Threat modeling should be step 0 of any security architecture but often goes completely unconsidered. This episode features Terry Ingoldsby, a veteran cyber risk professional, physicist, computer scientist and inventor of Securitree. Ingoldsby created the attack tree development platform because he felt cyber
Transitions and transformation within the security industry with Scott Klososky
Serial entrepreneur, author and futurist Scott Klososky explores some new approaches to physical and cyber security that are innovative, potentially controversial and necessary as more and more of our daily way of life is affected by these security problems. Ten years before Youtube Mr. Klososky founded a startup that delivered webcasted media for commercial, government, sports and entertainment.
Security through management of time and trust with Winn Schwartau
A security luminary before such a title was even coined, Winn Schwartau's predictions about the internet and global security problems have been scarily spot on for more than 30 years. Named the “Civilian Architect of Information Warfare” by Admiral Patrick Tyrrell of the British Ministry of Defense, Schwartau also testified before Congress in 1991 and showed the world how and why massive ide
Rethinking Security Control Design with Rachelle Loyear
Co-author of Enterprise Security Risk Management: Concepts and Applications , Rachelle Loyear has spent her career managing programs in corporate security organizations. Focusing strongly on security risk management, she has been responsible for ensuring enterprise resilience in the face of many different types of risks, both physical and cyber.She is currently active on a number of projects inc
Preview Trailer: ESRM & Critical Infrastructure
The first full episode is scheduled for release February 18th. The trailer includes a few conversation segments between the cohosts on enterprise security risk management and critical infrastructure. Visit CaffeinatedRisk.com for more articles on the intersection of risk management and technology.
Recommended
Deadline: White House
The Great Detectives of Old Time Radio| Daily Mystery Dramas
TED Business
Ranger Bill | Old Time Radio Adventure & Family Drama
زن بودن
Christmas Old Time Radio
The Adventures of Superman | Old Time Radio
Booked, Blonde & Busy w/ Olivia Ponton
The Human-Animal Connection - Pet Life Radio Original
Medicine with Meaning
Homemaking with Jesus | Weekly Devotionals, Biblical Application, Simple Living, Home Management, Healthy Relationships
Disney+ Hulu Throwbacks Podcast
