In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen analyzes the political and regulatory fallout of the recent midterm election results, which saw Democrats claim majorities in both the House and Senate. Steffen explores how this shift in congressional power directly impacts the enterprise cybersecurity, data privacy, and AI governance landscapes heading into 2027.

Key takeaways include a renewed push to modernize the Cybersecurity Information Sharing Act (CISA 2015) to cover AI threat telemetry and non-human identity risks, as well as the demise of federal AI preemption—leaving enterprise GRC teams to navigate a permanent patchwork of strict state-level regulations from jurisdictions like California and Colorado. Additionally, Steffen anticipates a reversal of proposed budget cuts for CISA, the restoration of multi-year state and local cyber grants, and an surge in investigative oversight into commercial AI labs and enterprise tech vendors. Ultimately, he stresses that foundational cybersecurity hygiene remains the most reliable strategy through changing legislative cycles.

In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen shares key takeaways from his recent attendance at the Cloudflare Connect conference in San Francisco, focusing on the critical PHP remote code execution vulnerabilities (CVE-2026-109618 / CVE-2026-109619, dubbed "PHP2Shell").

Steffen highlights a jarring insight directly from Cloudflare leadership: from the moment the vulnerability was publicly announced, it took just 17 to 22 minutes for automated AI bots to begin actively exploiting it in the wild. Walking step-by-step through a best-case human patch cycle—reading the CVE, conducting risk assessments, securing emergency change approvals, and staging code—Steffen demonstrates that even the fastest human response takes at least 20 minutes, during which millions of automated attack attempts have already launched. Because security patching operates at human speed while threats move at AI speed, Steffen urges organizations to rely heavily on defense-in-depth and compensating controls. He outlines four essential stopgaps: WAF edge-layer virtual patching (such as Cloudflare’s automated rule deployments), network segmentation, Runtime Application Self-Protection (RASP), and aggressive attack-surface reduction.

In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen is joined by Justin Beals, CEO and founder of StrikeGraph, for an in-depth conversation on the evolving landscape of Third-Party Risk Management (TPRM) and CISO liability.

Drawing on his background as a CTO and software engineer, Beals highlights three key trends shaping vendor risk: persistent breach rates tied to third-party vectors, heightened regulatory scrutiny (such as CMMC Rev 3 requirements), and the increasing adoption of AI to automate complex compliance workflows. A major focus of the discussion centers on the shift from self-attested security questionnaires toward mandatory, verifiable vendor testing—particularly driven by Department of Justice enforcement under the False Claims Act. Steffen and Beals explore the legal and criminal implications for "affirming officials" who sign off on compliance data, emphasizing that CISOs must go beyond surface-level questionnaires to systematically collect "receipts" and proof of vendor controls.