Inside the Media Mind of Byron Tau, ProPublica

On this episode of Inside the Media Minds, Christine Blake and Madison Farabaugh sat down with Byron Tau, a Pulitzer Prize-winning investigative journalist who most recently worked with the Washington, D.C. bureau of the Associated Press and is now heading into a new role covering national security for ProPublica.

Byron didn’t set out with a plan to land in Washington journalism, but he caught the reporting bug during his time working on his college newspaper. He moved to D.C. in 2008 with no real plan and a rough job market ahead of him.

As he was waiting tables at the Cheesecake Factory on Wisconsin Avenue, he was earning a journalism degree at night at Georgetown University and hunted for internships that would soon get him into the newsroom. His hard work paid off when POLITICO hired him as an editorial assistant – kickstarting the career that has taken him to The Wall Street Journal, the Associated Press and now ProPublica.

Investigative Reporting vs. “Everyday” Reporting

Byron described investigative journalism as having the luxury of time and resources to take big swings. “Unfortunately, ours is mostly a negative business,” he explained, noting that investigative teams focus on where accountability and transparency are lacking rather than covering routine news.

Sometimes the day a story is published will bring its own unique kind of stress. Byron recalled fact-checking his part of a border patrol story into the final hours before it went out. “I probably read it maybe 50 times that day before it went out,” he said. “There is a tremendous amount of relief, but also the run-up to it is very anxiety-producing… you’re not out of the woods when you get the story out.”

Approaching Companies and PR Teams

Byron broke down the reasons an investigative reporter typically contacts someone in PR, which could involve needing context for a story on a company’s competitor or regulator, or looking for a neutral industry voice to explain how something is supposed to work.

His advice to communication professionals: understand that a serious investigative reporter usually gives companies a long lead time to respond and is more concerned with a proper step-by-step process of fact-checking.

Byron explained that a firsthand perspective from companies is going to be placed “high up” in the story no matter what the reporter may find. Concerns of false details are always taken seriously, and sometimes, the angle of a story may not be agreed upon within both parties.

In terms of collaborating with investigative journalists, “having an open line of communication and not hiding the ball, I think, is really the most important thing and the most important part,” said Byron.

Stories That Need More Attention

Byron highlighted a handful of stories that he believes deserve more attention than they’re getting in the media, including how the U.S. is in a competitive power play with China and Russia and the “tremendous desire to control the most advanced chips and the biggest compute.” He’s also interested in looking more into the amalgamation of government entities and private sector entities, and how they share and obtain data within this era of geopolitical instability.

Heading into a newly formed national security team at ProPublic, he looks forward to bridging the gap in parallel conversations occurring between industry insiders, policy journalists and The Hill, and the broader public conversation.

“I think the role of journalists is to highlight undercover things to serve an education function, to shine a light on things that are a little bit boring and a little bit dry or a little bit esoteric, but are going to have big consequences,” Byron stated.

To hear more from Byron, including the inspiration behind his book, Means of Control, challenges of building relationships with sources, and his new role at ProPublica, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps

2:03 – Byron’s Career Journey 

3:59 – Pulitzer Prize Winning Investigative Story 

6:53 – Investigative Journalism vs. “Everyday” Journalism

17:52 – National Security/Tech Trends That Need More Attention

19:18 – Where AI Can Help Investigations

26:18 – Byron’s Inspiration Behind Means of Control

Transcript

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-hosts, Christine Blake 

Madison Farabaugh (MF): and Madison Fairbaugh. 

This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. From our studio here at W2 Communications, let’s go Inside the Media Minds.

Hello, everyone. Welcome to this episode of Inside the Media Minds. Madison and I are speaking with Byron Tau, a Pulitzer Prize-winning journalist and experienced investigative reporter, most recently for the D.C. Bureau of the Associated Press, and he’s currently transitioning to a new role as a reporter at ProPublica. 

So it was really great to talk to him and hear more about how he approaches investigative journalism. It was really interesting to hear how long the process takes and how collaborative it can be amongst different reporters. Madison, what were, your, some of your takeaways?

MF: Yeah, I really loved hearing Byron’s perspective on how, you know, he and his team have used AI in the past, what that impact on the journalism industry is like in general. I thought he had some unique strategies for how he leverages it, so I think listeners will definitely enjoy hearing that. 

And then I also liked hearing his perspective on just different, different ways that an investigative reporter might reach out to a company or a person when they’re trying to gather information, and what that typically looks like in terms of process.

CB: We also heard about his book and how that was a result of several investigative stories that he was working on as well. So we hope you all enjoy this episode with Byron. 

Hi there, Byron. Welcome to the podcast. We’re excited to have you on today.

Byron Tau (BT): Thanks for having me.

CB: Yeah, absolutely. So Byron, right now we are thrilled to talk to you because you’re kind of in between roles, leaving your position at the Associated Press and then moving into your new role as a reporter at ProPublica. So, we’re excited to hear about that. But let’s go ahead and start with an overview of your career journey. What got you interested in journalism, and where has that led you here today?

BT: Yeah, great questions. And yes, I am in the middle of a little bit of unemployment or an adult summer vacation, and start a new job soon. What led me to journalism? I think in some ways it’s a lack of other alternatives. I know a lot of reporters like to joke about that, but I was always a strong writer. I was always interested in civics and history, particularly American history. And I think, like a lot of people who have that particular set of interests and skills when they’re young, they gravitate towards Washington, D.C. or other big media markets like New York City, and end up as journalists. So that’s kind of what happened to me. I got the bug writing for my college newspaper. 

After graduating, I moved to Washington, D.C. with not much of a plan, and this was 2008, so the job market was not particularly great. So I kind of bided my time. I waited tables at the Cheesecake Factory on Wisconsin Avenue. I started getting a journalism degree at night at Georgetown, and just kept kind of hunting for internships and other opportunities that would get me closer to journalism. And that’s kind of how I got my start. Eventually, Ben Smith, who was then at POLITICO, hired me as his editorial assistant, and that kind of launched my career in journalism.

CB: Cool, that’s excellent. I love that overview and how it all kind of folded out for you. We are Cheesecake Factory fans too.

MF: Oh, absolutely. Yeah, and so I know, as we mentioned, you’re coming from the Associated Press, and we actually saw that your team there had won a Pulitzer Prize this year for a global investigation into state-of-the-art tools of mass surveillance. So we would love to hear about what that reporting process was like and what made this story specifically astonishing to you all.

BT: Yeah, so I was part of a team at the AP that was looking at the U.S. role in spreading essentially surveillance technology around the world, and the story started a few years ago when my colleague Dick Kane and a freelancer named Yael Grauer got essentially a pile of documents about China’s surveillance systems, and, and those documents, in a lot of ways, showed the role that U.S. tech companies had played, and that role was a far bigger one than had been previously understood. So, they embarked on a couple of years of reporting on that. I came into it rather late, but I, my part of it was to look at specifically how the Department of Homeland Security and other U.S. immigration agencies were doing, were using technology that you know sort of pioneered abroad as kind of tools of mass repression in many instances, and how those tools were being used in the United States, not you know always for exactly the same purpose, or and, and not always in in the ways that authoritarian governments are using them, but tools and techniques that were somewhat similar to what we saw abroad. 

And so, I and a colleague did a story on how the border patrol was monitoring the movement of millions of cars in inside the interior of the United States, and on finding ways to single out drivers whose behavior they found suspicious, so there was nothing kind of in, in someone’s personal background, or there was no real reason to pull this person over, other than they exhibited a behavioral pattern that, to the government, was indicative of drug trafficking or human smuggling, and you know we found some some pretty eye opening examples of you know innocent people who were caught up in this kind of thing and did a story on it.

So yeah, it was part of a package that the AP submitted to the Pulitzer board and that we were honored to win for. So really an incredible project that I, I played a small part in, but one that I, I think really showcases the AP’s global reach and ambition, the ability to kind of tap reporters on multiple continents and do a patient, long-form, long-term investigation. I think that’s sort of the strength of the organization, as well as to couple it with great video and photojournalism, and so yeah, it was one of the the best projects I’ve worked on, and, and it was both cheering to see that it, it won a prize, but more importantly that you know readers responded to it and policymakers in some instances reacted to it.

CB: That’s fascinating. I’d love to dig into that a little bit more, specifically your take on investigative journalism. So, at the AP, obviously, you were an investigative journalist. So, what would you say, or how does that differ really from like everyday reporting?

BT: Yeah, I think in so, in some ways, all reporters are investigative reporters, but investigative journalism is a particular subset of it that, where you honestly have the luxury of time and resources to take big swings and to do big projects. You know, unfortunately, ours is mostly a negative business. We don’t generally investigate. You know, all the, all the planes that land, we tend to investigate wrongdoing, and we tend to investigate where there’s areas of you know where more accountability or more light or more transparency is necessary, and often in cases where big institutions, whether public or private, are falling down on the job in some way, and so you know it is, it’s, it’s, it’s a unique sub-discipline of reporting because you know again I think most beat reporters they do get to write you know the basic breaking news stories sometimes when they’re you know they’re covering an institution there’s, there’s good news there’s, there’s opportunities to, to kind of highlight all different facets of that organization’s work, and investigative reporters tend to, to be a little more on the negative side, but, but in the public interest, right? 

Like, there’s generally some reason that we’re doing an investigation, or at least looking into something, and it’s usually because we either have been told or we hypothesize that there’s there, there may be something that the public ought to know at the other end of that. So yeah, it is a unique and special kind of reporting. You know, unfortunately, it takes time and it takes resources. And in today’s media environment, those things are rather scarce. You know, sometimes investigative projects can take years. 

Sometimes they can take weeks, but they’re rarely quick. They’re often difficult, and sometimes they are dry wells. Right. Sometimes you do investigate something, and you decide there is no story there. And you know, in the interests of fairness, you move on without writing something, but you’ve sunk a lot of resources into it. So, at the end of the day, for a lot of organizations, it’s a luxury to have a team that’s just doing that. And for a lot of us, it’s a real honor to be part of that team because there’s just so few of those slots in journalism.

CB: Yeah, and I’m curious too. What is the longest project you were a part of, like time-wise?

BT: Yeah, I mean, so you know, when I was at the Wall Street Journal, I did a lot of what are sometimes called rolling investigations. So that means that you’re focusing on a topic or you’re, you’re tracing some storyline, but it’s over the course of months or years. And so when I was there, I did a surveillance series that began in early 2020, and I kept reporting on that topic for, you know, almost four years, and that culminated in a book I wrote. And so often you can stick with a topic or a storyline for a long time and publish. Interim updates along the way, and, and that, you know, after the, at the end of it, you, you’ll have a pretty good corpus of work. 

So I’d say that was probably the longest kind of storyline I worked on in terms of a single project or a single story. That, that border patrol and surveillance project, you know, I came into it, and my portion of it took about a year, but again, it had been in the works for several years before that, and you know, it involved reporters all over the world, from China to Nepal to Israel and the Palestinian territories to us in the United States traveling around the country, and so that was probably the biggest single story I was involved in.

CB: It must be so rewarding once that finishes and it actually publishes.

BT: It is, you know. It’s also, there’s also a lot of anxiety that, that goes into it because when you’re publishing something big and high stakes and long, especially, you know, these stories tend to be long lengthwise. There’s a lot to get, to get right, and there’s a lot of details. And I remember, you know, just for my part of the border patrol story, we were fact-checking it in the like in the minutes that, that led up to publication. You know, I was I remember I was sitting in front of my fireplace with the fire going, and all night, I was just catching tiny little things. You know, I found a pretty major typo that would have required a correction had we let it go in, in an hour or two before. And I probably read it I don’t know, maybe 50 times that day before it went out. And so, yes, like when you get a story like that out into the world, there is a tremendous amount of relief, but also the run up to it is very anxiety-producing. So it’s, it’s, it’s very tiring. It’s exhausting. You fall asleep. 

Ours published at midnight, in which you know, and then I had to just basically go to sleep, and the world wasn’t probably going to see it really until the next morning. And so you know that wasn’t an easy night of sleep either. So you know, sometimes, sometimes when you’re publishing, the publication is just the beginning, and the reaction will start to roll in over time. And so you’re, you’re not out of the woods when you get the story out. But you know, eventually, yes, it is. It’s very rewarding to get a project like that out. It’s particularly gratifying when there’s you know when there’s a great public reaction to it, and you know there’s the sense of relief when there’s no corrections needed to it.

MF: And just thinking about kind of these, these stories or projects that you’ll be working on for a long time, I’m curious how you build relationships with those companies or individuals who your team might be investigating for one of these stories? You mentioned earlier how sometimes there is a negative connotation because you are looking for certain information. So, have you had any, you know, lessons learned from that experience?

BT: Yeah. So you know, there’s probably three reasons why an investigative reporter might call someone who’s in the PR industry. Two of them are good to neutral, and one of them is very bad. You know, first of all, we might be doing a story on your biggest competitor or your regulator, and want your perspective, you know, on very deep background about where they’re screwing up or doing wrong things. One other reason is we might simply be doing something on the industry and be looking for kind of a neutral voice to explain the norms or the way something is supposed to work, to highlight, you know, the way something might be broken. And the final reason, and frankly the most common reason an investigative reporter might call a company or an organization, is that, that we are preparing a story on you, and we want your comment. And often those are the most fraught and difficult conversations to have. And so, generally in investigative reporting, when we are developing relationships with at least kind of what we reporters refer to as at least through the what we call the front door, so going, going through the normal channels and then explaining what we’re doing and seeking interviews. 

You know, usually that’s, that’s for the first two purposes, right? Either that we’re reporting on some part of your industry, but you’re not the central focus of the story, or we’re looking for a voice to explain kind of how things normally go, or how things ought to go. When we’re doing kind of critical reporting, to be honest, we’re looking for ways around you. We’re looking for ways to talk to people that are not, that, that we’re not going to have a mediated conversation with the PR person sitting there. And those kinds of reporting activities are generally, ee often get a lot of flack. We often get angry phone calls. But you know, the one thing that it’s important to understand is we’re doing it for a reason. And you know, any good investigative reporter, any good reporter worth their salt, ought to be giving you a very long lead time for what they find ought to very seriously take, you know, if you tell me something is wrong. I, I don’t just say okay, I’ll put I’ll note that you say it’s wrong. I’m going to go back to my sources. I’m going to go back to the documents. I’m going to make sure everything I say is, is buttoned up. And so, you know, just having kind of an understanding of that, especially when you’re dealing with an investigative reporter, I think is, is really important for both sides. 

And recently, I was doing some reporting on an organization, and and the you know the, the PR person I could tell was not happy with what I was doing, and and probably had at some point been ordered by his superiors to call me and tell me to stop calling everyone that previously worked at this company, and you know, I think he had the understanding that he couldn’t really do that, and that wouldn’t be productive. But you know, I told him that I don’t, I don’t write, I don’t. There’s no surprises. I don’t, I’m not going to call you and say my story’s going up in an hour, and you have, you know, like there’s gonna, you’re gonna have weeks to respond. 

And I think we came to a good understanding. And frankly, the story never published because nothing we, we, you know, we couldn’t substantiate it. And so you know, just having an understanding of that kind of process and being fairly straightforward with the people you’re communicating with at companies, and assuring them that, at the end of the day, you are going to give them an awful lot of time that their perspective is going to be very high up in the story no matter what you find. That if you tell a reporter that something is wrong that they’re going to take those concerns seriously that we may not ultimately agree on the angle or the thrust of the piece but having kind of an open line of communication and not hiding the ball, I think, is really the most important thing and the most important part in dealing with institutions.

CB: Yeah, makes sense and good to know. I’m curious too. What, tell us a little bit about your, your upcoming role as you start at ProPublica? What are you going to be interested in covering there? What is your role going to be there?

BT: Yeah, so I’m going to join a newly formed national security team at ProPublica. There’s they’re going to announce a spate of a couple of hires, and we’re going to be digging into essentially you know national security agencies and and do journalism in the public interest, trying to understand how the Defense Department, the intelligence agencies, and other national security entities are going about their mission, and trying to inform the public a little bit more about what goes on inside these relatively opaque and secretive institutions.

MF: And as you head into this role, have there been any trends recently, whether it’s been in national security or even surveillance or privacy, that have been very top of mind for you that you’re kind of looking forward to exploring a bit more?

BT: Well, I think that you know I can’t open up an article or a newspaper without seeing the words AI, without seeing the word AI somewhere. So I think, you know, like in many other industries, artificial intelligence is transforming the national security establishment. So that’s, I think one big giant storyline, and that you know, we, our our country conceives of itself in a great power competition with rivals like China and Russia, and there is this tremendous desire to control the most advanced chips and the, the biggest compute. So that’s going to be an ongoing national security story. I also think the amalgamation of data, both by government entities and by private sector entities, and the ways in which those, those entities share and obtain data is going to continue to be a big story, and you know beyond that, I think you know we’re in a, we’re in an era of relative geopolitical instability. There’s a war in the Middle East. There’s, there’s tensions around the world over trade and migration, and so I think it’s just going to continue to be a very interesting time for reporters, and there’s a lot for us to report on in this space.

CB : Yeah, and a lot of reporters and writers that we’ve spoken to recently talk about how even the media landscape is changing as a result of AI. Have you noticed any changes from that perspective?

BT:  Yeah, I mean, from my perspective as an investigative reporter, I consider AI to be a tremendous boon to a lot of my work. It’s made doing research, especially research that involves some sort of data or coding, to be a lot easier and more accessible. So I’m, I’m not, despite me covering a lot of technical topics, I’m not a coder. I don’t understand, you know, Python or R or any of these languages. But you can spin up AI tools and scrapers really, really fast to collect data. Now, of course, this is a double-edged sword because, you know, we insist on accuracy and process and so, so often you need to check that data and you need to manually go through lots of it, but just in terms of making a research process that at least will help generate leads, will help give you a start in, in doing investigative reporting. 

AI has really made that job a lot easier if you know how to use the tools responsibly, and you know using them responsibly is always very, very difficult. But there’s all sorts of things that have made my life a lot easier, from being able to kind of collect large amounts of information from websites and sort it much quicker than I used to be able to do manually, to you know, automating certain very boring and repetitive tasks like checking websites for updates, or digging through the Wayback Machine, or doing some basic research on, on a topic that I’m unfamiliar with. I think AI can very much help. Again, it’s very important to use it responsibly to understand its limits, I don’t generally use it for writing because I, I think I’m a better writer than AI. Although it is very, very good at proofreading and fact-checking in some instances, or you know, and I found some processes like giving a draft story to AI and just asking it to ask me how I know every fact, right? That, that’s not having the machine do your thinking for you. That’s just going through an iterative process with the machine. 

So, I think I’m actually fairly excited about the possibilities in a lot of cases. Again, it’s, it’s a matter of how you use it and what kind of guardrails you put on it. And I, I would never say that I would never, we we, we, we journalists who are trying to use it responsibly do not just take AI output and put it in our stories. Everything’s checked. Everything’s vetted. Often, a data team of very sophisticated programmers and engineers who do know how to code will look over AI’s code or they’ll repeat something that AI did to make sure that it’s, it’s correct. So you know, I don’t, I don’t want anyone to, to get the impression that you know investigative reporters are just pulling, pulling things Claude tells us off, off the, off the screen and pasting it into her stories. That’s, that’s not how we’re using it. But as a starting point, as a tool, as a beginning to do research, as a way to surface leads that will later be checked out with human sources or by, by other people, it’s a really great tool, and, and I’m excited about a lot of the possibilities for journalism.

CB: Yeah, I, I totally agree with you, and I think I love what you said about iterating with it and asking it to fact-check you and like kind of get, get that response with it. I think that’s a really smart way to use it.

MF: Yeah, yeah. 

BT: I think there are tons of uses out there like that that, that aren’t kind of turning your thinking over to the machine, but are doing something in concert with it that, that help, that use it to help look for blind spots and errors and areas that you might your human squishy gray matter brain might have overlooked, but that a computer that’s a little bit more exacting and and doesn’t get tired can really help surface. So yeah, I think there’s tons of different use cases like that.

MF: And speaking of kind of those blank spaces or areas where you know research or more reporting could kind of fill the gaps. There, have you noticed any technology, security, or even surveillance trends that perhaps the media hasn’t been covering as much that you think deserves more attention?

BT: That’s a good question. I think in general, like very technical topics, like you know, what government agencies have access to which datasets is stuff that the, the public doesn’t always pay attention to, but are quite important. You know, I think, you know, a lot of the the geopolitical battles over access to like rare earth minerals and, and advanced computer chips are going to end up shaping a lot of the, the rest of the 21st century and that’s , that’s stuff that’s paid attention to in kind of a a very specific niche but isn’t always breaking through to the ordinary person. I mean that’s, I guess what comes to mind immediately, but you know there’s there’s all sorts of things out there worth investigating, and you know I think sometimes, especially in an era where attention is so fragmented and where it’s, it’s so hard to to maintain public attention on any given topic for any length of time, like some of the, the big longer-term trends in tech and national security are kind of going under the radar, even as they get covered. 

I mean, I don’t think they’re like a tremendous part of our, our public conversation. I think that’s true of a lot of different areas, including you know energy and transportation and technology as well. So you know, often they’re, there’s kind of two parallel conversations. There’s the conversation among industry insiders and policy journalists and the Hill, and then there’s the broader conversation that the public’s having and the stuff they’re paying attention to. And they’re not always the same. And I think the role of journalists is to kind of often, to highlight undercovered things to serve an educational function, to shine a light on things that are a little bit boring and a little bit dry or a little bit esoteric, but are going to have these big consequences. And so that’s what I’ve tried to do in my career, and I’m going to keep doing it no matter where I work in journalism.

MF: I think that’s where the human perspective is so, so valuable. You can only have AI do so much research, but then, as you mentioned, perhaps some of those stories that might not initially have as much human interest, that’s where the investigations or just all of that background research to get the actual experience that people are having with whatever topic it is. I think that’s something that AI can’t, can’t yet replace. So I think that’s where roles like yours are super important.

CB: Yeah, Byron, we have a couple listener questions before we wrap up with you. But you mentioned your book earlier. We’d love to hear more about that, Means of Control. What inspired you to write this book? Do you have any other books in the works?

BT: Yeah. So I mean, that book came out of a series of stories I did for the Wall Street Journal, you know, at the kind of two years into this project, which was essentially about how governments buy up lots of data on the population and are using it for law enforcement or national security most of the time without any sort of a warrant or some sort of oversight or court process, and how that kind of thing was, you know, kind of upending our traditional understanding of limited government and civil liberties. And so, kind of two years into writing these stories for the journal, you know, it just occurred to me that I had a lot of colorful details and characters and people in my notebook that never kind of shined through a daily newspaper story, and so, you know, I thought I had a lot more to say on it. 

So I, you know, I went looking for a book agent and ultimately put together a book proposal and pulled it together, and you know, took a couple months off my job at The Journal to write it. I lived in the woods of upstate New York, and, and just basically got up every morning, brewed my coffee, ate my breakfast, worked on it for you know six or seven hours. I would often, you know, go for an afternoon walk or a hike in the Adirondacks, and then come back and cook dinner and work on it some more. And so I did that for months, and at the end of it, I had a book, and yeah, it came out in February of 2024. Still available anywhere books are sold, and yeah, as you said, it’s called Means of Control.

CB: Yeah, I love that.

MF: That’s every writer’s dream, I’m pretty sure, unless you don’t like the outdoors that much. But to me, that sounds wonderful. It

BT: It was. It was really. It was really wonderful. It was. It was lucky. I, you know, kind of. I didn’t have any real family responsibilities or, you know, other, other reporters and writers who, who try to do things like that often run into the reality of their small children or their families. But at the time, I was. I was, I was just, I was running solo, and it was a great experience.

CB: Yeah, sounds like it. 

MF: That’s awesome. Thank you for sharing. I think our last listener question for today is: What are you looking forward to most as you head into this next chapter of your career?

BT: Yeah, well, I mean, I think what’s exciting about working for ProPublica is that they really do give you the time and the space to go deep on things, and often are looking for kind of human stories, or you know, to go beyond just the fact that something is happening, and to look for the harm and to find a character or a person to illustrate it. 

And at the end of the day, there are just very few outlets that have the time and the inclination and the resources to do journalism like that, and so that’s what I’m the most excited about. But it’s in many ways a continuation of work I’ve done at other great media outlets, including the Wall Street Journal and the Associated Press, and I’m very excited to start.

CB: Yeah, well, we are excited to continue following your journey as well. So, thank you very much for your time today, coming on the podcast. We learned a lot and really enjoyed speaking with you.

BT: Thanks so much for having me.

CB: Thank you for listening to today’s episode of Inside the Media Minds 

To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/.

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Bree Fowler, A Black Hat Special

On this special Black Hat edition of Inside the Media Minds, Christine Blake and Madison Farabaugh spoke with Bree Fowler, an experienced freelance journalist covering cybersecurity and consumer tech. 

With Black Hat USA kicking off next week in Las Vegas, Bree shares how she plans her schedule, what she’s looking forward to on the show floor and what it is really like freelancing in today’s ever-changing media landscape.

Bree’s Career Journey and Shift to Freelancing

After spontaneously covering a major data breach when she was a reporter on the AP’s tech desk, Bree has navigated writing about the cybersecurity industry in some manner ever since. She moved from the AP to Consumer Reports, where she helped build out the publication’s IoT security and privacy testing program, and then spent four years at CNET before shifting into her current role as an independent freelance journalist. 

As a freelancer, most of Bree’s work comes to her rather than the other way around, leveraging relationships that she formed over years of conferences and industry connections. However, she’s seen firsthand how uneven the industry can be.She explains how some publications treat freelancers well, while others seem to take advantage of reporters without full-time jobs, offering little pay under the guise of offering “exposure.”

On a broader scale, Bree highlights how layoffs in the media industry have created a shrinking pool of reporters covering security and what she calls the “SEO apocalypse.” As a result, earned media is drying up, with publications starting to chase clicks and affiliate revenue rather than substantive security reporting. Her response to this shift has been to lean into content that reads like authentic journalism even when it’s created for a company website: Q&As, thought leadership and subject-matter expert commentary that she says audiences can tell apart from thinly veiled marketing.

Bree’s Approach to Black Hat

When it comes to conferences like Black Hat, Bree employs a playbook built around realistic time management. “It’s about balancing content creation and also writing stories,” she adds. “No matter how you look at it, we all have not enough time to get what we need to get done.” 

Because sessions are recorded and streamed at Black Hat, Bree will prioritize live attendance for keynote speakers. This gives her a chance to read the room, catch up with sources and maintain the bandwidth she needs to absorb recorded panels later. 

To Bree, logistics matter just as much as the schedule itself. She warned against relying on coffee shops that vendors have likely rented out for private meetings, cautioning that Starbucks lines are “a mile long” and to skip offsite dinners and parties entirely. Her hard-earned advice for surviving Vegas in August: don’t underestimate the heat, always grab a free bottle of water and build in real breaks.

Bree’s Priorities at This Year’s Conference

Over the years, Bree has been fascinated with how far deepfakes and AI-generated videos/images on social media have come – how what was once easily identifiable is now highly convincing. 

“It’ll be interesting to see how this continues to shake up the world of cybersecurity… the ability and the affordability of AI technologies is going to change the industry,” she said.

Bree also looks forward to seeing how people are breaking AI and getting past safeguards, specifically what researchers are finding when looking at agents like Claude Mythos and other frontier models. 

“Social engineering has become a huge deal, and anybody without any kind of technical expertise is capable of pulling off that kind of stuff. This is kind of like a quantum Y2K thing without an end date,” she shared.

To hear more from Bree including advice for vendors and PR professionals attending Black Hat, the shift in AI and social engineering, the link between cyber criminals and mobs, and the new wave of pay-to-play at events like Black Hat, listen to the full episode of Inside the Media Minds below or read the complete transcript.

Timestamps

1:58 – Bree’s Career Timeline and Background

4:22 – How Bree Finds Freelance Work

5:11 – Why Earned Media is Harder to Get

11:01 – Her Approach to Black Hat as a Reporter

22:44 – For Vendors and PR professionals: Cutting Through the Noise at Black Hat

28:36 – Media Landscape Shifts from a Freelancer’s Perspective

Transcript

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-hosts Christine Blake 

Madison Farabaugh (MF): and Madison Farabaugh. 

CB: This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. 

MF: From our studio here at W2 Communications, let’s go Inside the Media Minds. 

CB: Hey everyone! Welcome to Inside the Media Minds, our special Black Hat episode. We’re gearing up for the Black Hat conference in Las Vegas, which will be August 3rd. So we had the pleasure of talking to Bree Fowler. She is an experienced freelancer focused on cybersecurity and consumer tech. Previously, she’s written for CNET, the AP, and Consumer Reports, and has experience as a TV analyst and conference speaker. She had some really great insight about how she approaches the Black Hat conference, from her schedule to interviewing different types of experts at the show, to attending sessions. So it was really useful to hear her take. Madison, what did you think? 

MF: Yeah, I also really enjoyed hearing Bree’s perspective on just the freelance industry right now. So we kind of got a behind-the-scenes look at how she approaches different projects she’s working on. Also, just what it’s like to be a freelancer right now, as the media is changing so much and the landscape, and how AI is even impacting that. I think listeners will learn a lot from Bree in that regard.

CB: Yeah, agreed. And she had some really good advice for vendors to break through the noise at Black Hat as well. So we hope you all enjoy this episode. 

Hey, Bree, thank you so much for joining us on today’s podcast. We’re excited to talk to you.

Bree Fowler (BF): Excited to be with you.

CB: Yeah, thanks for joining. We’re talking about our special, this is our special edition for Black Hat coming up at the beginning of August, and before we dive into talking about Black Hat, we’d love to get to know more about your background and your experience. We’ve worked with you over the years in various capacities, but can you give us a quick overview of your career journey and where you are at now?

BF: Yeah, I have been in journalism for a very long time now, but specifically in tech and cybersecurity. I’ve been covering cybersecurity for probably, I want to say, about 15 years. You know, I got thrown into it kind of unexpectedly when I was a reporter on the tech desk at the AP. There was a major data breach. We didn’t have a cybersecurity reporter, and I happened to be there. I got really interested in it. Ended up writing a lot of stories, and it just kind of snowballed from there. I covered cybersecurity for the AP, then went on to Consumer Reports, where I helped them set up their IoT security and privacy testing program, and eventually to CNET, where I spent four years until about a year ago when I left and started freelancing.

CB: Great, that’s an awesome overview. We appreciate that, and I know as a current freelancer, you probably have a lot of different perspectives and background as well.

BF: Yeah, freelancing has definitely been different. The media landscape has changed a lot. There aren’t so many full-time reporters out there anymore, and there really aren’t a lot of people covering cybersecurity like there used to, used to be. So I’ve kind of tried to balance writing about cybersecurity and tech for a variety of consumer, business, enterprise, trade publications, general news, that kind of thing. With doing content creation for cybersecurity and tech companies, you know, doing more on the other end of that. Companies are starting to focus more on owned media. You know the stuff that they create themselves. It’s really hard to get earned media these days. So I’ve been helping by writing news stories, doing thought leadership interviews, podcasts, videos, social media posting for things like LinkedIn. You know whatever companies need.

MF: Yeah, that makes a lot of sense. And so, as a freelancer, how do you typically, I guess, approach new projects? Is that something that you’ll pitch to these companies that you might be writing for these publications, or do they ever reach out to you and request your services? What’s the kind of ratio and breakdown there?

BF: You know, generally they reach out to me. I haven’t really been soliciting. I mean, when I go to conferences and meet people, and I have connections in the industry that I made over the years. You know, I talk to people at PR agencies, companies, you know, and tried to make connections and find projects that way, but mostly it’s been companies approaching me, and I do a lot of you know consulting with them about what they need to see if maybe there there’s some work that I can do to help them out.

CB: Yeah, as someone who’s been in the industry for a while and writing in different, in different ways, I’m curious what you said about paid and sponsored media being a lot more prevalent now, and how earned media is harder to get. Why do you think that is?

BF: Well, there’s just less media out there. You know, we’ve seen so many layoffs in the industry. You know, especially when it comes to stories that don’t make money. I mean, I was at CNET for four years, and we used to think that you know, security, you were Teflon coded because there was such a learning curve to writing about this stuff, and there was an interest in protecting consumers and protecting enterprises, and writing about those kinds of topics, you know, I’ve done a lot in election security. You know, in 2016, 2020 with the elections, a lot of political, you know, looking at disinformation, misinformation. 

These stories just aren’t getting the same kind of pickup from publications that they used to. I mean, I think a lot of it is due to our political climate, but it’s also due to the SEO apocalypse. You know, tech publications want stories where you people are going to click on them and actually go to the story versus the AI summary, and then buy something because they’re getting kickbacks. And unless you’re writing about VPNs, there just really isn’t that in cybersecurity or even AI, which you know we thought was such a big deal.

CB: Yeah, and it kind of goes into the impact that AI has had on journalism too, and SEO versus GEO and all of that.

BF: Absolutely, and it makes it harder for PR companies and for companies to pitch, there there’s no journalists to pitch to. You know, where do you get your experts placed? Where do you get that your own SEO? And that’s by having content on your site or you know placing things in paid publications. Which I mean, I think a lot of people kind of look at those suspiciously because they’re you know trying to pass themselves off as real journalism when they aren’t necessarily. You know, I think it’s I’ve focused more on creating quality content for company websites that are written like journalism, where you know maybe you’re doing a Q&A with a CEO, or you know, some other kind of thought leadership or expert commentary. I think that’s a lot more genuine, and I think people really do see the difference.

CB: Yeah, I like that approach, and I think yeah, I think that’s a lot more authentic and helpful for people visiting the website and to get the messaging across.

BF: Absolutely.

CB: So, obviously, you’ve written for consumer tech. You mentioned election security, cybersecurity, B2B, B2C. What, what kind of topic interests you the most personally?

BF: You know, I, cybersecurity has always been fascinating to me. It’s one of those things where you’re always learning something new. You think you’ve seen, well, some people will think they’ve seen it all. I know I haven’t seen it all. Hackers are some of the most creative, interesting people out there. Whether they’re you know playing for the good guys or the bad guys, and you know it’s always interesting to see how people can break things and how you know you can get past the best safeguards. There, there’s you know, the nature finds a way. 

People find a way because they’re naturally curious and creative, and now they have AI tools to kind of do the grunt work to help them scale things. You know, people, cyber criminals use AI in the same way that you know people will use it for work. It’s about scaling. It’s about getting things done faster. You know, being able to make things more detailed and more sophisticated, and the applications that we’re seeing, you know, cyber criminals use are, are just absolutely fascinating at a lot of levels.

MF: Yeah, one of the fascinating things that I’ve seen in client research even is how different you know cyber criminal groups are using AI, and it’s almost like a business. Like they are operating the same way that many companies are, and like you mentioned, scaling in terms of how they’re deploying AI, how they’re trying it in new ways. So that’s been an interesting trend to monitor as well.

BF: Yeah, I mean, AI, I mean, cybersecurity has always been a business. It’s always been run top down. It’s organized crime. You know, whether you’re talking about you know the Italian mob back in the day. That was business too. It’s just not legitimate business. Look at drug lords. That’s that’s a Fortune 500 company. It’s just illegal. Cybercrime is no different, and honestly, it can take it to levels that those guys had never even thought of, had even before AI, there’s just so much you can do with computers. So much you can do to remain anonymous. You know, you don’t, you don’t need guns. You don’t need any kind of violence or or whatever. It’s, it’s just amazing, and, and law enforcement knows that too, you know. They, they’ve been fighting these guys for a long time, and you know that they’re looking at it the same way, and they’re looking at how they can protect consumers, how they can protect businesses, because without internet security, everything falls apart on so many levels.

MF: Yep, absolutely. Transitioning a little bit into the main focus of this episode is all things Black Hat. So, Bree, I know you’ve attended in the past. Would love to know how you typically approach reporting at conferences such as Black Hat, and even how you’re thinking of approaching this year’s conference.

BF: You know, it has changed now that I’m a freelancer and doing work for companies and doing work for a handful of different businesses and organizations versus just having you know one publication and one set of marching orders. You know, it’s about balancing content creation and also writing stories, and no matter how you look at it, we all have not enough time to get what we need to get done, and the playbook remains the same. You know, you have to overplan. You need to figure out what you absolutely need to do when you’re there, like if something, if, if you want to watch a panel and you don’t actually need to do it right then you know these things are taped. They’re, they’re streamable. Do it later when you know your brain has a time to just take a take a step back from all that, and I think too that with especially with panels and things like you can have a better idea of what you actually need to sit through, you know, and what you can fast forward or just skip entirely after the conference is over. I like to go to keynotes, if anything, more to talk to people and, and get a feel of the vibe and just the general themes of the conference. I don’t think they’ve announced keynotes yet, but definitely something I’ll be looking for. 

Other than that, it’s mainly meetings, and it’s very tempting to go back to back to back to back and have a dozen a day, but it is exhausting, and especially in the days leading up to the conference, before there’s a press room, the Mondays and Tuesdays, you have to have some kind of location. And I feel like those, you know, it’s a lot of running back and forth through Mandalay Bay to different areas, only to find out that that coffee house, coffee shop that you thought you were going to be able to meet someone that has been rented out by a cybersecurity company, and you can’t get in there and forget about Starb, Starbucks is the worst place to meet anyone. The line is a mile long. Everyone has already drank too much free coffee, and there are no chairs ever. So it’s, it’s always good to kind of have backup plans and to keep things local. 

I don’t do anything offsite. I’ve gotten invited to some really cool parties that are outside of the Mandalay Bay complex. I generally do not go, or to dinners. It’s just just being able to get anywhere in Vegas. I’m a New Yorker. I think I can walk everywhere. I’m a runner. Like I’m in great shape, and I prefer to go places on my own two feet. You cannot walk in this Vegas heat. I remember my first year thinking I could walk to a meeting at a different casino. Oh, it’s, it’s only a mile, and it’s 7 a.m. Like, how bad can it be for a, for a breakfast meeting, and I got halfway there, and I was already a puddle. So, and you know, escalators and things like that. So, leave extra travel time. Don’t overdo it. Drink lots of water. If anyone offers you something to drink during a meeting, if you’re in a suite with like you know the setup of beverages, grab a bottle of water to go, even if you already have one, and make sure that you schedule in mental health breaks to eat, to hydrate, to you know just let your brain relax because you’re going to eventually forget who you’re talking to, what they actually do for a living, and and when things get so jumbled, it really doesn’t do anyone any good, and the meeting is just pointless.

CB: Yeah, great tips, great advice. Totally agree. Definitely not go to Starbucks. But I always wonder that with journalists because you meet some, some, some people like you meet back to back to back, and it’s, who did I talk to about what topic? And it’s, it can get a, very jumbled, like you said. So you mentioned going to keynotes. I get that. That makes sense because those are kind of exciting. It’s the big room, all the excitement around the keynotes. Are there any other topics that you’re interested in exploring this year specifically?

BF: I mean, I definitely am very into the political end of things, we’ve got midterms coming up. The last couple years just haven’t been great for those kinds of panels. I think the Trump administration has kind of put the kibosh to having people go to Black Hat and DEF CON, so you get a lot of just the same people from the last administration showing up and and saying the same things, so that you know, I’m hoping maybe they’ll they’ll be a good keynote in that area. AI is so very tired at this point, but it is important. 

I’m interested in seeing how people are breaking AI and how they’re getting past safeguards, things like Claude Mythos and these frontier models are super interesting to me because security researchers are taking a good look at them, but they are going to get out at some point. And are we prepared for that? This is kind of like a, you know, quantum Y2K thing without a, without an end date. You know that that’s all interesting to me. You know I, I still like the demos of hacking various IoT. Those are a lot of fun. People always find new creative things, and they make for good stories. And I probably will end up doing something about deepfakes and how we’re seeing those in the wild, and and social engineering. You know, we’ve really seen as much as AI has become so high tech and made cybercrime high tech. Social engineering has also become a huge, huge deal, and anybody without any kind of technical expertise is capable of pulling off that kind of stuff.

CB: Yeah, so true 

MF: And as you’re prepping for these different, that was super helpful to hear all of the topics that you’re, that you’re keen to hear more about this year. As you’re kind of prepping your schedule and perhaps reviewing any pitches from PR or even cybersecurity vendors, how far in advance do you typically book briefings? And are there any, is there any interest in booking briefings, you know, pre-Black Hat or post-Black Hat? I know it can be very noisy around that specific week, and so in terms of balancing your schedule, is there interest in pre-briefings, or how do you typically like to balance yourself out?

BF: Post briefings I just generally I am too burnout and tired, and I’ve already talked. The whole point of going to a conference is to meet people face to face and kind of like internally vet them. You know, does this person know who they’re talking, what they’re talking about? Are they, you know, actually, an expert in what they say they are, and can they form a sentence? You know, are they worth using for stories down the road? Without that, there’s really no point. That said, like especially when I was working for CNET and for the AP, you know, I did a setup story. I would do pre-reporting and pre-interviews, so I could have a story out there before it started, and then I could update it as I went along, and just kind of add comments and things because you just don’t have when you’re writing need to write in real time. You just don’t have the the time and the bandwidth to do that, and you want to make things as easy as possible.

Plus, a lot of us are-you know-we’re on the West Coast, but we’re working on an East Coast deadline. So, you know, which is has its benefits and and its, and its drawbacks too. It’s not great waking up to a ton of email in the morning, but and and having to get you know stories done by 2 o’clock potentially, so editors don’t have to stay way past their, their time. And you know, especially with the AP, when we had newspaper deadlines to worry about, with the internet, things are definitely it’s easier to update stuff, and we are in a 24 hour news cycle, but now I mean things are a little less less crazy for me, and it is nice to have people kind of go away at 2 o’clock and and let you you know do the rounds. I hit a lot of parties and receptions and events because that’s where you actually meet people, and in a more low-key environment. So I like to definitely have my evenings free for that kind of stuff.

CB: Yeah, that’s good to know. We were going to ask you about that actually, and I do think there is value in going to those informal events because you can talk to different people in a different kind of vibe setting. You know, so that makes sense.

BF: Definitely.

CB: Something that, that you mentioned, and it’s you know going to conferences to meet people face to face, and I think we’ve seen the media list for this year. We’ve talked to a lot of our friends who are reporters, and it seems like there’s a little bit less media attendance this year, and been that trend. And I’m curious, what’s enticing about going in person versus covering the news that happens there from afar. Is it that face to face, or is there some other kind of component that should entice reporters to go in person?

BF: It is definitely the face to face of being able to meet with people. You know, cybersecurity like pioneered the whole remote work thing way before COVID. They were one of those, you know, industries where I would ask people like, “Where’s your company based, and where are you right now? And it was always something very different and often wacky. You know, you’d have, “Oh, I’m at, you know, in Thailand or my vineyard in Napa, or, you know, they’re they’re all over the place. So when people are spread out like that, even if you are based in San Francisco, which is probably the closest thing we have to a hub, a lot of these companies aren’t, and their people certainly aren’t. And this is the one time that people get together. 

And Vegas, you know, people come because they just want to come to Vegas. You know, a lot of people stay for DEF CON; they do it on their own dime. So you know you have all sorts of people come, and Black Hat is definitely more of a lure, I think, because then RSA, RSA is so expensive to go to. The badges are incredibly pricey. Getting a hotel in San Francisco for especially during RSA is prohibitively expensive for media. I didn’t go for many years, even when I was offered, you know, panels and to speak. I really had to fight for it because it just wasn’t in budgets. You can go to Vegas and stay, you know, pretty close to Mandalay Bay for less than 100 bucks a night, so people will come and they’ll eat the free food and they’ll they’ll convene and see their friends that they haven’t seen for a year, and it’s it’s a great experience. They call it Hacker Summer Camp for a reason.

MF: I love that. Lots of lots of incentives there. It sounds like. What and with I guess all of the noise around Black Hat. How do you recommend, this is a question we love to ask because it’s, it’s very helpful for our audiences. How do you recommend cybersecurity vendors or their PR teams, communications teams, cut through the noise leading up to these events, perhaps onsite at these events, what typically catches your attention there?

BF: It’s it’s really hard. Booths are crazy expensive, and it’s so much marketing noise, and so many salespeople that actually don’t have a lot of expertise that are just talking solutions. Like I hate the word solutions because it means nothing. For, you know, that they don’t actually understand how they work, and it’s a lot of demos and a lot of free T-shirts, and it’s so much money is spent. There’s one you know CEO of a smaller company who told me you know he gets a suite at the Four Seasons and entertains actual clients there, and they have food, and people calm down, and it’s nice and cool, and they have a nice view. And he spends so much less than he would on a booth. You know, smaller companies they’re trying to get their foot in the door. They have that kind of presence. Big ones, they’re always there. 

Others have, I’ve seen big companies, blue chip companies, just not do it anymore because it’s not worth it to them from a money in, money out standpoint. It it is really hard to cut through the noise, especially if you’re going that kind of marketing route. Wacky booths are always fun. I love interactive anything where I can pick locks or crack a safe for a free T-shirt. I’m like a moth to a flame, but I’m not actually buying their products, so I don’t know how much that actually helps them. You know, it’s just really hard. It helps to have good experts on site. 

I mean, if you want to connect with the media, put your smart people out there, bring them to Vegas. There have been cutbacks in cybersecurity too, and their, you know companies have gotten rid of non-essential travel. I’ve talked to you know I’m a part of a run club at DEF CON, and I know a lot of people aren’t coming this year because they their their companies have just canceled non-essential travel, and the because the money isn’t there, or they’re worried about you know gas prices or tariffs or inflation. Like it’s it’s really uncertain in a lot of ways, and you wouldn’t think that would hit cybersecurity like other industries, but it it actually does. So you know you got to get the most, for your buck, and I really think it pays to bring your smart people and leave the salespeople at home.

CB: Yeah, agreed. That’s going to get through that noise and get more more visibility with the right audience. Are you running at, in Vegas this year?

BF: Oh yeah, I am again training for this, will be my fourth New York City Marathon, and I’ve run other marathons too. But yeah, I don’t have a choice. And DEF CON has a great run club. We’re out there at 6 a.m. Thursday, Friday, Saturday, Sunday, doing way too many miles in the Vegas heat. But you know, when it’s all hackers, it just adds like a level of wackiness that gets you through. Well, it’s only 85, and it’s a dry heat. You know.

CB: Dry heat. That’s, that’s the difference. Yep. I love, I’m with you on the wackiness and the,the spectacle that it that is Vegas. I, I find it fascinating and hilarious and weird and all that so. 

BF: Yeah. 

CB: Wanted to ask too something that comes up a lot with cybersecurity vendors that we work with is the, the value of putting out research at the show. To what extent does it have to like really make a splash? A lot of them are talking about doing it maybe the week before, the week after to kind of like get around the craziness. Like, what are, what are your thoughts in terms of research at the show or news at the show in general?

BF: Yeah, I mean, I definitely wouldn’t do it the week after. A lot of people go on vacation, like, or they’re doing mop up from the events. I have a hard enough time writing up the interviews that I actually did do, during the event. I’m not going to do more. Releasing stuff under embargo ahead of time is great. I think you really need to promote it, though, because a lot of people do, do that, and it better be worth the time of the people you’re pitching it to. This is not the time for inside baseball. This is when you want those, you know, things that people are going to write about. 

You know, when we write a story in any kind of journalism, any kind of event, it’s it’s got to answer the question: Why do I care? You know why, why is someone going to read this? And cybersecurity sometimes, like you can have great research that is super in the weeds and absolutely brilliant, but if it doesn’t resonate with people or if people don’t understand it, it’s it it just doesn’t matter. But yeah, I mean, especially if you can peg it to the like broad, overarching themes that people are going to be writing about. Like when I did the previous stories, it’s great to have numbers and research and, and things like that to put in there from the get go. So that’s great. That that said, like people, if you send out stuff too early, people put it off and they forget about it. I’ve done, I’ve done this myself, and then it’s a mad rush. But you know, especially if you can make researchers available for interviews ahead of time, that can be super helpful too. The worst thing is when PR people have offered me interviews with people, and then they’re not available.

MF: Yeah.

BF: And it does happen.

CB: Yeah, no, I’m sure. Yeah, no, thanks. Thanks. This is really helpful, and it’s helpful to hear you kind of walk us through the best approach and how to navigate this type of a situation because it’s always a big high pressure environment with expectations, and it’s good to kind of understand what works best. 

So before we wrap up, we do have a couple listener questions for you, Bree. One of them being: Given your current status as a freelancer, what are the biggest changes you’ve seen in the media? Kind of a different experience to different publications.

BF: You know, one of the biggest changes is that there are so many freelancers now. I was laid off from CNET along with about half of the staff. It took four rounds of layoffs to finally get to me. There are a lot of good people out there that are freelancing, and I would love to have a full time job right now and not have to constantly hustle. But that you know is not in the cards right now, just based on the current media environment. So you know, certain publications that are dependent on freelancers are very nice to freelancers. 

Others just completely abuse the fact that people don’t have a full time job and are offering pennies, literally, for words. And you know, oh, you’re doing this for exposure. Well, you’re not really that big of a publication, so it’s really not exposure, you know. And people, people deserve fair money for their quality work, and also for people to return emails and you know, honor agreements to publish things, stuff like that. You know, you never know when you’re going to need someone, and it’s, it’s good to treat people with respect and decency.

CB: Yeah, agreed. 

MF: And then our last listener question. What was the last conversation that shocked you, Bree? Whether that was an interview with an expert or a new report that you had covered, what conversation really either caught you off guard or had some surprising new finding for you?

BF: You know, honestly, I feel like it’s been a lot of the same lately. You know, it’s interesting not, not so much shocking, but I’m always amazed at what AI can do and how it’s gone from being marketing buzzwords and you know what was really machine learning when you would walk the the floor of Black Hat. You’re, you know, pre-COVID, people were talking about AI, but it wasn’t AI; it was machine learning, or it was just complete marketing buzz. But now AI is real, and it’s a prerequisite. And people are finding ways to use it to break it to do things that we never thought would be possible. 

I mean, you look at deepfakes. A few years ago, I would go to Black Hat or DEF CON, and they would do a demo of a deepfake, and it just, it was fake. It looked like a fake. You could pretty much figure it out. And now there are deep fakes out there that are shocking. That are, you know, they look so good. And even when you look at videos on social media, these AI-generated, you know, not just slop, but videos that people are creating creatively, you know, that are transparent about the fact they’re AI – generated. They are a lot better than anything we would have seen a couple years ago, especially outside of a academic or state-sponsored kind of setting. And it’ll be real interesting to see how this continues to shake up the world of cybersecurity, and how you know those videos, the the just the access and the ability and the affordability of AI technologies is going to change the industry.

CB: It’s accessible to everyone right now, so yeah, definitely. Well, Bree, it’s been great chatting with you and hearing about your background and your approach to Black Hat and all of that. So, thank you for joining Inside the Media Minds, and we’ll look forward to seeing you at Black Hat in early August.

BF: Thanks very much for having me.

CB: Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/. 

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Sasha Ingber, SpyCast

On this episode of Inside the Media Minds, Christine Blake and Madison Farabaugh sat down with Sasha Ingber, host of SpyCast, the International Spy Museum’s flagship podcast on global intelligence, espionage and covert operations. 

Sasha is also the founder of HUMINT, one of Substack’s top international newsletters covering the intelligence community through the people and the emotions behind the headlines. A former national security correspondent for NPR, Smithsonian and Scripps News, Sasha brings a reporter’s instinct and honesty to every conversation. 

Sasha didn’t set out to cover espionage. After a stint at the State Department debunking Russian disinformation in the wake of Crimea’s illegal annexation, she found her way into national security journalism, going on to cover events like January 6th, the fall of Afghanistan, the war in Ukraine and the Israel-Hamas war. After being laid off, she launched HUMINT to keep telling human stories inside the world of intelligence. This led the International Spy Museum to bring her on as SpyCast’s host, though she had never hosted a podcast before.

Impact of Technology and AI on Espionage

Sasha noted there is an increasing prominence of open source intelligence (OSINT) due to geopolitical shifts. Since the Trump administration has fired people in parts of the intelligence community, AI has become more mainstream to help augment the work of humans. 

Technologies like the National Geospatial Intelligence Agency’s Project Maven show how AI is being integrated into intelligence work, in this case, using AI for geospatial tracking to identify military targets. Yet even with these advances, human connection and communication remain central to FBI intelligence.

Sasha explains, “Seeing patterns in analysis, whether that is satellite images or the written word, as well as identifying ways to recruit people and even masking identities. You can use programs to literally change your appearance, change the sound of your voice, change your gender, change your nationality… this is more about augmenting than it is replacing.” 

Sasha explained that agencies like the CIA are testing agentic AI, but the technology is enhancing human operations rather than working on its own. 

“AI cannot break into Putin’s desk and see what’s on his table. We’re never going to lose that… this is more about augmenting than it is replacing,” she shared.

How Espionage Differs by Country

Sasha explained how different nations approach spycraft based on leadership, capability and goals. She described how Russia’s autocratic system led its own domestic intelligence service to feed Vladimir Putin inaccurate assessments ahead of the full-scale invasion of Ukraine, specifically how mass expulsions of Russian officers under diplomatic cover pushed Moscow to use less experienced proxies. 

“They’ve also started using teenagers that they’ve recruited on Telegram to actually help conduct some of these operations,” she explains. 

By contrast, she pointed to China’s willingness to target an American regardless of status, Israel’s focus on the existential threat posed by Iran and France’s deeper regional access rooted in its colonial legacy in Africa and the Middle East. 

“Everybody is spying on everybody else. Everybody’s trying to manipulate and exploit weakness for their own country, for their own government…the difference comes down to capabilities, goals and tactics, which can be affected by leadership,” she explains.

Storytelling From the Front Lines

Sasha’s reporting instincts honed from time in Ukraine during Russia’s bombardment, inside a raided Chinese police station in Manhattan and investigating a clandestine bio-lab tied to the Chinese Communist Party. These experiences continue to shape how she approaches her guests on Spycast. Some of her favorite stories from the show include the case of Katrina Leung, a onetime top FBI informant on China who was secretly working for Chinese intelligence, and conversations with figures like former CIA chief of disguise Jonah Mende and longtime CIA technical officer Bob Wallace. 

“These are conversations that you’re just not going to get anywhere else… and I mean, some of it is really surprising, the number of people who started off outside of college and were given immense responsibility at such a young age and continue to be humble today,” she explains. 

To hear more from Sasha Ingber, including SpyCast’s origins under founding host Peter Earnest, her favorite exhibits at the International Spy Museum, and what’s coming up next on the show, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps

2:44 – Sasha’s Journey at the International Spy Museum 

6:52 – How Sasha Chooses Guests and Storylines for the SpyCast Podcast 

11:47 – Process of Dividing the Work 

14:23 – How Espionage has Evolved with AI 

20:40 – Sasha’s Favorite Story 

28:26 – Sasha’s Favorite Exhibit at the International Spy Museum

Transcript

Christine Blake (CB):  Welcome to Inside the Media Minds. We are your co-hosts, Christine Blake 

Madison Farabaugh (MF): and Madison Farabaugh. 

CB: This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. From our studio here at W2 Communications, let’s go Inside the Media Minds. 

Hi, everyone. On today’s episode, Madison and I sit down with Sasha Ingber, the host of SpyCast, the International Spy Museum’s flagship podcast on global intelligence, espionage, and covert operations. Sasha is also the founder of HUMINT, where she explores the intelligence community, through its people and the emotions that drive them. This conversation was amazing. We love talking to Sasha and learning about her background, and she’s so passionate about this topic as well. 

She had so many interesting stories to share about espionage and how different countries are approaching it. We asked her about how AI and technology has impacted espionage recently, and she said that it’s really a tool that’s augmenting spies. One anecdote she shared is, you know, they can change their voices or their nationality or anything like that, but an AI tool can’t break into Putin’s office, and I thought that was a good way to look at it. Madison, what did you find interesting about today’s episode?

MF: Yeah, I really enjoyed just hearing how Sasha can bring a story to life. So, I think out of all of the guests that we’ve had on Inside the Media Minds, her background experience with just people who have been on the front lines of espionage campaigns, so she’s gone to, you know, restaurants in New York, and kind of learned about different operations that were taking place there, so it’s kind of that behind the scenes perspective that I think she has done a really excellent job of getting from the different guests that she’s had on the podcast. And even her background in journalism and her experience reporting for major publications like NPR, I think it was great to hear how she transferred so many of those reporting skills into the International Spy Museum’s podcast. So, yeah, her storytelling capabilities are just amazing. I think listeners will really get a kick out of that.

CB: Yeah, we hope everyone enjoys the episode. Go ahead and listen to this one, and then listen to SpyCast right after. 

Hey everyone, we have a very special guest today on Inside the Media Minds. We have Sasha Angber, host of SpyCast, the International Spy Museum’s flagship podcast on global intelligence, espionage, and covert operations. Welcome, Sasha. We’re happy to have you on the show today.

Sasha Ingber (SI): Thanks so much for having me, Christine.

CB: Yeah, we’re excited to get to know more about you and SpyCast, and what brought you to SpyCast. So, let’s start there. I’d love to hear a quick overview of your journey and how you ended up hosting the podcast for the International Spy Museum.

SI: Well, the short story is that I moved to Washington, D.C., where the museum is, to get a Master’s in nonfiction writing. And I really wanted to be a journalist, but I couldn’t make my way in and pay my bills that way, so I ended up taking a job at the State Department, where I was fairly quickly put onto a tiny team tasked with debunking Russian disinformation. This was right after Russia illegally seized Crimea from Ukraine and started occupying the Donbas. It really made me want to be a national security reporter. 

I was able to pivot to Smithsonian, so a little bit of that museum journalism blend, and then I went on to NPR, and then Scripps News, where I was their national security correspondent, covering things like January 6th and the fall of Afghanistan, the war in Ukraine, when the full-scale invasion began, the Israel-Hamas war. And as happens in journalism sometimes, I got laid off, and then I decided to start something of my own, and became an independent journalist. I started a media company called HUMINT, which stands for Human Intelligence, where I started telling stories that intersected the intel community and more of the human side of the experience of working in that world, in the form of articles, short- form videos, more in-depth interviews, and started exposing things that nobody knew about.

Like there’s this apartment building in Washington, D.C., in a residential neighborhood that is actually where many of China’s spies are living, and they’re affiliated with the embassy. How the US government has been testing a device thought to cause anomalous health incidents, or Havana syndrome, which is an affliction that has affected a lot of spies here in the United States, as well as diplomats and military personnel, and some more personal stories about, like, the NSA director who was fired while he was overseas after he had submitted cyber offense plans regarding China. His name was General Tim Haugh and what that did to the NSA. 

So, because of these experiences and how I was kind of forging new ground, I think that the International Spy Museum decided that I would be a potentially good candidate to lead their podcast, and I did not have a podcast background. I came from print, and then digital, moved into radio, and then went into television. So, the podcasting world was really a change for me. 

CB: It sounds like your background really aligned well with joining the Spy Museum podcast. It sounds like right up your alley with that investigative, really interesting journalism style to the podcast.

SI: Yeah, I mean, I think that the subject matter was something that I had experience in, and what I was able to do was to continue the sense of curiosity, the mix of empathy and skepticism, keeping it accurate and educational, bringing in some elements of entertainment, so that people kept wanting to tune in for episode after episode. That’s really kind of how I’ve approached it, and one thing that makes doing this different than say working for a standard media outlet is that there isn’t that frenetic, frenetic go-go-go sort of mentality, which means that you can slow down more, and frankly, that’s really hard for me to do, because it’s been programmed into me to just constantly be producing, and the team has really helped me sort of take a more gentle pace.

MF: Yeah, it sounds like you had a lot of really great transferable skills, and even lessons learned from your prior experience as a journalist that you brought to the table for the International Spy Museum’s podcast, which is very cool, very cool journey to hear about. Can you give us a little bit of background about how the SpyCast podcast kind of came to be, and how your team approaches, you know, selecting guests, selecting which storylines that they might want to focus on?

SI: Of course, this podcast is actually the first podcast on espionage in the country. It is 20 years old. It started in 2006 and this was the work of the museum’s founding executive director, Peter Earnest, who himself came from the CIA, spent 36 years there and retired as its chief spokesperson. He literally started this podcast with a pair of microphones in his office, and it was very DIY situation, where there was apparently a copy of Podcast for Dummies, that book lying around, and we believe that he just took the audio and uploaded it to the website, very, very simple, but he was doing incredibly important work. 

One of the first interviews was actually with former Major General Oleg Kalugin, who led foreign counterintelligence for the KGB. They talked about the spy games between Russia and Georgia, and the Cuban Missile Crisis, and essentially what this shows was that the museum was on the cutting edge before not only most museums but even most media outlets understood the value of podcasting, the concept of podcasting, that term actually was coined just two years earlier, and the team and I, you know, we spend a lot of time, we get a lot of pitches. 

It’s a conversation that’s always ongoing, and we’re trying to represent different parts of the globe. We’re trying to jump into different times and different perspectives, and for me, it’s been really exciting to be able to jump into so many different spy moments in our world, in our history, you know, from narrowing in on an intelligence operation during a war, or talking about how a mole was caught, or how a person navigated their intelligence career. 

It’s really about learning what that person went through, what their knowledge base is, and then catering the questions specifically to them. And you know, before this job, I was – my experiences included walking into a secret Chinese police station in Manhattan, in New York, that had just been raided by the FBI, and I actually was able to walk inside with my videographer, going to a secret dilapidated bio lab that I was later able to tie to the Chinese Communist Party. My time in Ukraine, from being in the midst of Russia’s bombardment, all of those experiences also I think help form the conversation, because I was on the ground.

CB: Yeah, that’s incredible that you have all those experiences, and then you know you’re probably, you probably learned so much going through that, and then you probably learned something every time you speak to another person on the podcast, right, you’re always uncovering new things, always learning new things. I’m sure that’s what keeps you really engaged and wanting to cover these types of stories.

SI: It really is for me. My last day of college, actually, this is a pretty embarrassing confession I’m about to make, but my last class was a screenwriting class. We had a pizza party. I walked out of the building, and I just sat down in the grass and bawled, because I did not want to stop learning. 

And one of the best parts of this job, and being a journalist, is that you get to meet people who you would not normally ever meet. I mean, I got to be at the Pentagon when Ukrainian President Volodymyr Zelensky visited and was appealing to Congress for more military aid. I was standing in the room with President Trump in his first term during his Merry Christmas rally when the House first voted to impeach him. The people that I get to talk to and the moments that I’ve gotten to capture is really, it’s just a privilege to be able to do that.

CB: Yeah, I believe that. Yeah, it seems like such a cool opportunity, and you’re very passionate about it, and it shows that you have that love for learning. So, I’m glad that you found a role that you were able to continue doing that with.

SI: As much as I’ve been laid off, I mean, I definitely have some scar stories, and many therapy sessions under my belt, by the way.

CB: Yes, no, I’m sure. Oh, go ahead, Madison.

MF: I was gonna say the news industry, the PR industry, all of these that center around kind of what’s happening in the world. I feel like that’s such a key skill to have, though, is that adaptability, you know, as things get thrown at you, as we have to kind of be always on our feet, so that’s really, really impressive, though. I think it shows that you have, you have those skills to kind of take what you’ve learned, go into new environments, and succeed there. So very cool. 

I was also just curious, as you’ve mentioned all of the different people who you’ve interviewed, these different journeys that you’ve been on, in terms of how the podcast selects guests, because you also mentioned you get a lot of pitches there. What is the process like for selecting who will be on the podcast? Is it – are you paying attention to current news cycles and perhaps the pitches that are most relevant to what’s going on now? You might lean towards those, or do you ever hear of things happening and you, you go out of your way to kind of research? Oh, that would be a really fun guest. How do you kind of divide the work there?

SI: Yeah, absolutely. Yeah, there’s no one way. I think we have multiple streams where sometimes our producer finds something interesting and presents it to the group. I am speaking to sources all the time, so I might stumble on something that I think is important, and I might get a story that seems really compelling and would work well for a SpyCast. 

There are times where we know, or I anticipate that something is going to be really important. So, let’s get ahead of it. Let’s find the right person, sit down and talk about it, and try to time it to when it will be most powerful for our listeners and viewers to learn about, so it’s really a mix, and it’s also a combination of what makes this story unique, people who are giving us perspectives that nobody else can, and that are at the top of their game in terms of their expertise, those are really important, because this is an experience for people, this is giving you a sense of the museum from more of a storytelling side.

CB: Yeah, no, that makes sense. And I think that museum aspect is something you have to consider, right? People are coming all over the world to visit the museum to learn about this topic area, and you have to take that into consideration when telling these stories and putting life to it.

SI: Exactly.

CB: Yeah, and I’m curious too. You’ve been covering this space for a while. I’d love to hear your perspective on how espionage has evolved since you first started covering it, and now with AI and technology in the forefront, how has that impacted everything?

SI: Well, I really began focusing on the intelligence community in 2020 during Covid, and it was fascinating because my relationships began through a screen, and I used the commonality, the universality of all of us being stuck in the lockdown, not knowing what was going to happen as a way to sort of bond or at least relate to people, and I think that that gave me a leg up in trying to understand how to cover this very mysterious and secret world, and a lot of the people that I met then through the screen I now still talk to, and we see each other, and it was very funny in the beginning when I finally got to see them in the three dimensional world, but I think that the biggest shifts that I’ve seen since covering it are, I guess, number one, that open-source intelligence, what’s called OSINT, has become more prominent now, the world has gotten much more chaotic in terms of geopolitical shifts and alliances and different wars. 

So, intelligence agencies are incredibly busy on many different fronts. The Trump Administration has fired people in parts of the intelligence community, which has brought some insecurity and instability, though some of those changes may be warranted, and as you mentioned, of course, AI has become more mainstream. In terms of AI, you know, the CIA has been testing artificial intelligence, especially agentic projects, meaning autonomous AI, but it’s really more enhancing than it is working on its own. Generally, you know, human is human intelligence. It’s about relationships between people, and AI cannot break into Putin’s desk and see what’s on his table. We’re never going to lose that. 

What I think AI is particularly useful for in the intelligence community is things like identifying military targets to strike, which the National Geospatial Intelligence Agency is doing with its AI, called Project Maven, seeing patterns in analysis, whether that is satellite images or the written word, as well as identifying ways to recruit people, and even masking identities. You can use programs to literally change your appearance, change the sound of your voice, change your gender, change your nationality, and so again, this is more about augmenting than it is replacing.

CB: That’s definitely a trend that we’ve been seeing too, when it comes to every, every use of AI, when it comes to cybersecurity, when it comes to defense against it, when it comes to attacks, like all of it is just that augmenting of what humans can already do, and making it another layer more challenging.

SI: Yeah, absolutely.

MF: And your observations of how different countries might be approaching espionage, have you noticed any major differences between different countries or regions in how they approach this?

SI: Oh, I certainly have. One of the similarities is that everybody is spying on everybody else. Everybody’s trying to manipulate and exploit weakness for their own country, for their own government. I think the difference comes down to capabilities, goals, and tactics, which can be affected by leadership, and I mean, if you take a country like Russia, which has an autocratic leader, a lot of corruption. We saw the FSB, the Domestic Intelligence Service, not providing legitimate, accurate intelligence to Putin when it came to the full-scale invasion of Ukraine. He thought that he was going to be able to take Kyiv in a few days. 

Fast forward to the mass expulsions of spies under diplomatic cover, and they started to lower their tradecraft level to have proxies who were oftentimes very incompetent engaging in some of their sabotage, and they’ve also started using teenagers that they’ve recruited on Telegram to actually help conduct some of these operations in Ukraine, and they have killed them in these operations by detonating bombs remotely, so that is very different than what the United States would be doing when it comes to targets. China is fascinating in this realm, because we have seen for years now that there is no, there’s really no line that they aren’t willing to cross. 

Every American has intrinsic value, and therefore they will prey on anybody, and I don’t think that most people understand that, even now. They also have such a large population. We see that in their intelligence services they can bring so much to bear because of those numbers. There are some countries that are very good in regional ways. Israel sees an existential threat in Iran. One, so that is their priority. 

France has a colonial legacy, so it has the ability to have deeper access in certain countries in Africa and the Middle East. I’d say that every country operates differently, but the alliances are also a part of this conversation, and this is always evolving based on who’s leading a country, who’s leading the intelligence services, and even some of those smaller decisions that get made on the ground in the operations themselves, because a person like Putin doesn’t necessarily know every single thing that’s happening when it comes to his intelligence community.

CB: That’s a great point you make, too, about it’s always changing based on leadership, based on alliances, based on the whole geopolitical climate of the world. So, I think that’s a really interesting way to approach it. When it comes to the way that you convey these stories and really look at the different ways countries approach espionage. What is one of the most intriguing stories that you have heard on the podcast?

SI: Okay, this is where you’re going to get a much longer answer than you wanted, because it’s so hard to choose just one. I mean, I love the counterintelligence stories where you learn the backstory of how they caught the mole. There was this one woman, Katrina Leung, who had been the FBI’s top informant on China, but she was actually working for China’s Ministry of State Security, and there were concerns that popped up about her over the years, and all of it was being swept under the rug by her FBI handler, because she was sleeping with him, and she even ended up marrying this guy. They divorced their spouses, and they got married, and lived happily ever after. 

There was a FBI special agent who’s still in the bureau who told me about how he lured a spy out of China and to eventually the United States, and this was the first time the United States had ever been able to take a Chinese spy out of China to face justice in the United States, but there are also really personal stories that are very, very meaningful in a different way. There was one woman who drove from Michigan to D.C. to describe how she personally came out as a lesbian in the midst of her polygraph to keep her job at the CIA. Oh, wow, this was back in the 80s. 

There was another woman who sat down with me to talk about how she discovered not only that her family had been Nazis in Germany, but then that they had been sent to Hawaii by Joseph Goebbels, and they ended up spying for the Germans and the Japanese, and her grandfather confessed to providing intelligence leading to the Pearl Harbor attack, and the shame and the complication of having that legacy. And the last category are really the insider accounts, people who are leading areas of the intelligence community and making a difference in very humble ways that you, you wouldn’t even know what incredible stories they have until you sit down with them, but these are people who are just so.. actually, let me just say that one section again, if you don’t mind, and the last category are really these insider accounts, people who are leading their own facet of the intelligence space.

Whether it’s the chairman of the house’s intelligence committee, Representative Rick Crawford, who came here and sat down in these very funky socks and talked about what his plans were for the committee to the former director of the CIA’s Covert Action Branch, which is the paramilitary, talking about what it was like to lead this part of the agency through COVID and the fall of Afghanistan, and so many other eras, and really, these are these are conversations that you’re just not going to get anywhere else.

CB: Exactly. Yeah, these are amazing stories that you’re able to talk about, and it’s so you don’t even think about the personal interweaving of different people and family members and countries. It’s fascinating, really. So, what a fun, what a fun podcast. So interesting. 

SI: It’s been a real privilege to be able to have this job, and I mean, some of it is really surprising, the the number of people who started off outside of college and were given immense responsibility at such a young age and continue to be humble today. I mean, there’s Jonna Mendez, she was the CIA’s chief of disguise, and she just took me into this wild world where she was traveling through Asia and Europe. She made two fake Shahs and presented them to Jimmy Carter to try to quell the protests in Iran in the 1970s revolution. And there’s this guy, Bob Wallace, who was the director of CIA’s Office of Technical Service in the 90s and early 2000s and he talked to me about how, you know, he was just hilarious. He talked about how the CIA actually took covert communication practices from the porn industry, and that helped inform their – or let me just say that one bit again. He actually described how the agency took their covert communication practices from the tactics being used by the porn industry when the internet age began.

CB: Wow, that’s fascinating. It’s interesting. It’s interesting too, like we hear so much about spies and the movies and fiction, and it’s amazing to think that these things really do happen, but it’s a kind of a good segue into some of our listener questions here before we wrap. I guess, what is one of your favorite fictional spy characters or movies?

SI: Well, I love foreign films. There’s a German film called The Lives of Others, which was about a Stasi officer in East Germany who’s bugged the home of a playwright. He’s listening in on this man’s life, and he really develops an affinity and a fondness for this man. It was a story that had a lot of moral ambiguity and intimacy in it, in a way that I found to be incredibly memorable. Terms of TV, I thought The Americans was an amazing show to learn about Russian illegals, and if you like sci-fi counterpart, where there are basically two parallel worlds that actually meet underground, and one group of people who look exactly like the other group of people are going and gathering intelligence and conducting operations on the other, so it’s like some kind of sort of magical realism. It was just such a good series, I think. Where I find myself a little bit frustrated is that I don’t think there are that many truly substantive spy films and movies about women that don’t involve someone who’s super hot and sexy. I just like, I don’t care about that. I want there to be something more nuanced and, and deep that show what women who work in the intelligence community go through, and we have movies like Zero Dark Thirty, which was directed by Kathryn Bigelow, but we just need so much more of that.

CB: Yeah, no, exactly. I totally agree with that.

MF: And I bet you’ve spoken to a lot of women in the past who would be great characters for inspiration, for, for something like that.

SI: Yeah, there could, I could create a very cool hybrid character, and yeah, I could make a pretty, pretty awesome badass spy lady.

MF: Love that. Well, we’ll be looking forward to that one day. Perhaps that’s the next project.

SI: Yeah, when I leave the studio, I’ll just start working on that novel.

MF: Awesome. And then one of our final listener questions is, what is your favorite exhibit in the International Spy Museum?

SI: Okay, this is another tough one, because we have so much, it’s so much good stuff, and like, let’s not even talk about the kinds of gadgets that one could spend a lot of money getting, because you know we do have like the rectal tool kits and things like that. There’s the weird, but we also have things that you could never ever get anywhere else, because there’s one of a kind, and I’m thinking of the ice pick that killed Trotsky, which still has his blood on it. We have the bodice of Mata Hari. There’s so much here, you could spend hours and hours and hours, and you probably still couldn’t see it all.

CB: Yeah, I went there a couple years ago. I definitely need to go back and know that listen to your podcast. I need to go back and learn more about everything in there. That’s incredible. So, Sasha, before we wrap up, what’s the future of SpyCast look like? Anything coming up that we should look forward to?

SI: Well, we have had a long stream of amazing guests and stories, people who have given us access to current events in a way that you really can’t get anywhere else. An upcoming story that we have is actually about a special espionage focused unit inside the Naval Criminal Investigative Service about how that unit caught a person who had been sharing intelligence with a foreign government and, kind of like takes us back in time to his different communications with this foreign person, and why this person shared intelligence, how the person copied and pasted information, and like was rather lazy, and the handler is like, can you please give us more. Can you please not have so many typos in that work?

I will be speaking with a person about intelligence and the services in Cuba as it relates to the situation with the United States right after we finish here, and just right now we have a piece about Africa Corps, which is sort of like Russia’s private military, the Wagner Group 2.0 and its efforts in Africa, in Ukraine, the Shadow Fleet, which has, of course, been trying to evade sanctions on the seas, and how it all fits together. So, we have a lot of good content coming out, and we have been at the forefront of the spike podcasting world, where the in the 1%, top 1% of podcasts globally, so really good stuff ahead, thanks.

CB: Yeah, it makes me want to go on like a road trip and listen and binge all the episodes coming up. They sound so good.

SI: Thanks. Well, yeah, go for it. And then you can, you can tell me which one is your favorite. 

CB: We will get back to you on that for sure. Well, Sasha, thank you so much for coming on our podcast today and talking about SpyCast. Clearly you’re a great spy expert, and we’ll be tuned into your podcasts, and we’ll definitely report back to you on our favorites.

SI: Thank you so much for having me, you guys.

CB: Yeah, thank you. 

CB: Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/. 

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Joel Witts, Expert Insights

 

On this episode of Inside the Media Minds, Christine Blake and I spoke with Joel Witts, Content Director and Co-founder at Expert Insights.

With a long-standing interest in writing and the media, Joel began his career in local journalism in the UK. Eventually, he met his co-founder, Craig MacAlpine, who wanted to create a review platform for the cybersecurity market to help CISOs, IT managers, security engineers and analysts cut through industry noise. Eight years later, Expert Insights has evolved from primarily a product-led review site to a platform featuring news, product analysis, interviews, podcasts and newsletters that still serve that same audience.

Prioritizing the Practitioner 

At Expert Insights, Joel and his team are product-oriented and practitioner-focused, not solely driven by hype stories. Their ultimate goal is to help organizations choose the right cybersecurity solutions and inform the day-to-day decisions of security professionals by providing technical reporting on tools/solutions alongside interviews and stories that elevate expert voices and practical, experience-based insights.

“A lot of the time there are some really exciting big picture stories that are happening in cyber,” explained Joel. “But, for an IT manager who needs to get an email security product that works and stops phishing, they want that level of more granular detail. If a story is relevant to an IT manager’s day-to-day job, if it’s going to actually help them to improve their business’s security, that’s what we want to be covering.”

Accelerated Cyber Evolution and AI’s Influence

Although fundamental principles of effective cybersecurity remain the same, Joel shared his view on how cybersecurity has been experiencing an explosive pace of innovation where, as a result, what once were early-stage concepts are now widely adopted and deployed.

“When I first started doing interviews eight years ago, I was chatting to a lot of identity providers, for example, who were working on things like FIDO to passkeys,” explained Joel. “Now, we’re starting to actually see that roll out in all the different kinds of consumer products and into B2B as well. It’s just so interesting to see that shift from the concept stage into actually changing people’s day-to-day experiences of using different services and making people more secure.”

In parallel with more advanced vendor technology is the rise of AI and increasingly sophisticated threats like deepfake phishing, which have become more personalized, realistic and scalable. AI is also reshaping developer and engineer workflows as teams become more concerned with how many vulnerabilities AI can find in their code.

As organizations grapple with constant innovation and new cyber threats, Joel recognizes that it can be tough for vendors to break through industry noise and ongoing competition to leverage AI in new ways. For him, the vendors that stand out are those that go beyond conceptual ideas of AI to actually prove they have tangible impacts for solving challenges, addressing risks and contributing to broader efforts like AI governance. 

“The whole AI governance angle is really important for a lot of businesses as they roll out AI programs into their organizations…You see engineers having 20 different agents that they’ve got running overnight. Those aren’t ‘future ideas.’ They are happening now.”

Flying Under the Radar: Small and Mid-sized Businesses 

One of Joel’s favorite themes to cover in cybersecurity – and a very under-discussed topic in his opinion – is the small and mid-sized business (SMB) perspective. In particular, Joel likes to explore how organizations with limited budgets, cybersecurity expertise or staffing approach the same threats and challenges that larger enterprises face.

“I think the vast majority of businesses don’t have big cybersecurity budgets,” Joel added. “A lot of companies don’t even have one person managing cybersecurity as their job. It’s one of many hats that an IT manager might be wearing…They’re worried about the same things that the bigger businesses are.”

Joel warns that flashy topics like AI have the potential to “suck all the energy out of the room” to overshadow the SMB sphere and other security-fundamental topics such as user awareness training, phishing protection and core hygiene practices. Yet, these processes are especially critical for those organizations experiencing resource shortages.

To hear more about how to pitch Joel, the most fascinating product he saw recently, and his favorite summer hobbies, tune in to the full episode or read the transcript.

 

Timestamps

0:21 – Guest Introduction and Overview

2:31 – Joel’s Journey to Expert Insights

5:08 – An Editorial Strategy for Product-Led Perspectives

6:50 – Joel’s Roles and Current Initiatives

10:01 – The Evolution of Cybersecurity 

11:37 – Favorite Topics to Cover in Cyber

14:02 – Expert Insights’ Eye on AI

15:47- How Vendors Cut Through Event Noise

18:01 – Fascinating New Products and Innovations

19:37 – Under-Discussed Cyber Trends

21:41 – Tips for PR Professionals

24:21 – Most Memorable Interview

26:49 – Opportunities to Get Involved

28:38 – Summer Hobbies

Transcript

Inside The Media Mind of Joel Witts

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-hosts, Christine Blake

Madison Farabaugh (MF): and Madison Farabaugh.

CB: This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. From our studio here at W2 Communications, let’s go Inside the Media Minds.

Hi, everyone. On today’s episode of Inside the Media Minds, Madison and I are talking to Joel Witts, who is the director of content and a co-founder at Expert Insights. Expert Insights is a rapidly growing media company focused on covering cybersecurity solutions. Joel himself is an experienced journalist and editor with over eight years of experience covering the cybersecurity space, so this was a great podcast interview. We’re able to really dig into some topics he is covering. He went over his background, Expert Insights, and his focus areas.

One part I found particularly interesting was when we asked how companies can separate themselves from other cybersecurity vendors and cut through that noise. When it comes to AI messaging, he really talked about the importance of proving how the AI solutions are working and not just talking about them from a marketing perspective. Madison, what did you find to be the most interesting?

MF: Yeah, I think related to the topic of cutting through the noise, I think Joel gave some great tips for PR professionals who might be pitching him their clients and just really focusing on how the company or the company’s expertise might be helping CISOs and security practitioners with their everyday work, and how whether it’s their solution or their insights, etc., how that is helping them improve their workloads or improve how they approach security. So, the very practical everyday perspective is something that they really look for in their pitches.

CB: Yeah, definitely. Joel mentioned he’ll be at Black Hat this year. He mentioned getting to conferences and finding a big benefit of interviewing different experts at events. So we hope that everyone enjoys this episode. Hey everyone, it is Christine,

MF: and Madison.

CB: Yeah, and thank you so much for joining us on today’s podcast. We have Joel Witts, who is the director of content and co-founder at Expert Insights today. Thanks for joining us, Joel. Happy to talk to you.

Joel Witts (JW): Thanks so much for having me.

CB: Of course. So, we’d love to just start out with a quick overview of your background and how you came to Expert Insights, and kind of your story there. Let us go into that first.

JW: Yeah, of course. Again, thank you very much for having me on the podcast. I was looking back over some previous episodes, and you know, some really incredible journalists and company founders that have been on there, so thank you very much for having me.

My background is in journalism, so studied journalism at a university here in the UK, Cardiff University. I have done a little bit of work in local journalism here in the UK, and I’ve just always enjoyed writing, and I’ve always been kind of fascinated by the media industry in general. So, when I graduated, I met Craig MacAlpine, who’s the CEO here at Expert Insights, and he had previously run an email security business and wanted to set up a new review website for cybersecurity solutions in general. He kind of saw that there was a lot of noise in the cybersecurity space, and wanted to kind of build a platform that could cut through that noise and help, particularly sort of smaller businesses and mid-sized companies, to find the right cybersecurity solutions. So I joined Expert Insights as a co-founder, and over the past eight years, we’ve really built out the Expert Insights platform, and we have sort of taken a very expert-led and kind of product-led approach to that, so yeah, we kind of sit between kind of user review websites like maybe G2 or Capterra, and the kind of big analyst companies like Gartner, we kind of see ourselves as sort of in between that space.

And, over the years, we’ve also really broadened out just from the product side to also into news and product analysis, and we do a lot of interviews and podcasts, and now we’re launching newsletters, so it’s been a really exciting journey, and we’ve been very lucky to build a really engaged audience. So our readers are cybersecurity professionals, CISOs, security engineers, analysts, IT managers. It’s a broad range, but you know, they’re all making cybersecurity decisions, they’re all kind of, you know, in that, in the, that is their day to day, and we, and we try and make sure that everything we do is kind of relevant to that. So I think it’s, we kind of sit in a unique place, but it’s a really exciting company to be part of.

CB: Yeah, great overview. Thank you for sharing that.

JW: Yeah, absolutely. I think we kind of, we started off with a very much a kind of geeky product-led perspective, you know. We wanted to get into the technical details and the niches of the different products, and you know, I think we still do to a large extent, actually, but we’ve also broadened out, so, like I say, we’re now covering industry news and perspectives, and I think the interviews are a really important part of what we do, but that ethos has kind of stuck with us of being product focused. And I think it really comes from the perspective of wanting to focus on what really matters to people day to day.

So, what are the stories that really resonate to CISOs or to IT managers that would be relevant for their day-to-day experience in their role, and a lot of the time there’s some really exciting big picture stories that are happening in cyber. But for an IT manager who needs to get an email security product that works and stops phishing, they want that level of kind of more, more granular detail, and in the reporting we’ve kind of tried to take that ethos as well, and that if a story is relevant to an IT manager’s day-to-day job, if it’s going to actually help to help them to improve their business’s security, or give them an insight, a bit of advice that can help them, that’s kind of what we want to be covering, and that’s what we see are kind of, is it our USP, I suppose, in a very competitive landscape.

MF: Yeah, and you touched on a bit of how Expert Insights kind of differentiates itself from some other cyber tech security publications out there, so can you maybe add a little bit more into how, how the team approaches its editorial strategy, and how it kind of deciphers what it should be focusing on for its key audiences.

CB: Yeah, it certainly is. And we’re curious too, like, what does your particular day to day look like as a director of content, and maybe your other other roles and other initiatives like the podcast and things of that nature.

JW: Yeah, absolutely. It’s yeah, it’s busy. No two days kind of look exactly the same. So I would usually start by chatting with our in-house editorial team to talk through the stories we’re working on that day, kind of looking at the topic of what’s in the news, but also the kind of what other content we’re working on. Because we’re always working on, I wouldn’t call them necessarily features in the traditional sense, but we might be looking at particular products that we’re reviewing, or roundups of different categories, or you know, just looking at the trends over time, or different interviews that we’ve got in the pipeline. So we’ll normally start by looking at that, and then we work with freelancers as well on news stories, so I’ll connect with them and see what sort of the major stories in the news are that we need to be covering for our weekly newsletters, and that kind of thing. And then you know, there’s also the bigger picture, so looking at content strategies, chatting with lots of different vendors to find out what’s going on with them, conducting interviews, working on product reviews.

I do try and stay, maybe, maybe too hands-on in terms of, you know, writing different stories and looking at different products, but I enjoy it, for one, but also I think it helps make sure that the the overall strategy and direction is going in the right way, and that we’re, I think, I think you really have to be immersed in cybersecurity as a journalist, or anyone in the industry, like if you, if you, you know, close your eyes, you’ll miss something that happens. So yeah, I also try to speak to as many people as I can, particularly practitioners and people who are working in the industry day to day, because it really helps to understand what their, you know, what they want to know about, and to get their perspectives on things. So, we’ve been investing a lot in kind of chatting to CISOs and enterprise team managers to understand, you know, their day to day and what matters for them.

CB: Yeah, that’s important, and it seems like you’re very in touch with your readership and what they’re looking for. And it’s interesting too in your role, like people are consuming content and media in so many different ways, so you have to look at all the different variables and all the different mediums of how they’re receiving their content and how to make it most useful for them.

JW: Yeah, 100% and a lot of the times I think, if we’re being honest, people don’t necessarily set out to read more content. I think they’ve got so much that, you know, it’s being broadcast to them that you really have to have a strong value position to make people engage with you. And I think the other unique thing with cyber is the people that we’re writing for tend to be, you know, they’ve got decades of experience, or more POVs, then they really know their stuff, so you’ve got to make sure that you do as well. I think it’s really hard to write for this particular audience if you don’t have a strong kind of understanding of and respect for the audience as well. I think is really important.

MF: Absolutely, and I think that’s a great segue into our next question, which is a bit more industry-focused. But based on your experience covering the cybersecurity industry for, I believe, it’s over eight years, and just with speaking with so many practitioners and vendors, where have you seen this industry envolve the most?

JW: Yeah. I think that’s a really interesting question, and I sort of try and ask that to everyone I speak to, really. And it’s interesting to hear all the different responses. I think the number one sort of answer I get from experts when I ask that seems to be that, you know, as much as there’s a lot of hype in the industry, a lot of things sort of stay the same. Like the security fundamentals are always kind of the same, even though they don’t necessarily get talked about as much, but those kind of the basic things that everyone needs to be aware of.

But I would say, yeah, just in general, the pace of innovation seems to have just gone off the charts, both in terms of like the vendor tech space and the different innovations that we’re seeing from the cybersecurity companies, you know. There are so many different announcements that are happening all the time, and every product, you know, it’s really exciting to see that, but also, you know, the way that the threat actors are moving and the way that technology is moving, you know? I think when I first started doing interviews, kind of eight years ago, I was chatting to a lot of identity providers, for example, who were working on things like FIDO to passkeys, and now we’re starting to actually see that roll out in all the different kind of consumer products, and now into B2B as well. So it’s just so interesting to see that shift from kind of the kind of concept stage into actually is changing people’s like day to day experiences of using different services and making people more secure. I think that’s been really interesting to see.

MF: That’s awesome. And is there a specific aspect of cybersecurity that you enjoy covering the most?

JW: Oh, I think I do really enjoy the SMB side. I think it’s really interesting to look at how businesses that don’t have a lot of budget and a lot of cybersecurity expertise deal with some of these challenges. I think that’s a really interesting and kind of under-discussed aspect of the cybersecurity landscape, but I also really am interested in those kind of areas of security that do intersect with how end users like people use technology every day, so identity is a good example of this, where people interact with those security tools every day, and sometimes it can create friction.

You know, I always laugh when you see those kind of memes about MFA not working, and you know those kind of frustrations that on the security side we know why it’s so important, but how end-users interact with that is important as well, and obviously on that side as well, you’ve got the kind of the high stacks aspect of it, where you kind of talk about how attackers are trying to break into those systems and how they circumvent identity controls. I think that’s always really interesting.

I think in terms of areas we don’t necessarily cover so much, but I do think it’s really interesting, it’s kind of the psychology of the threat actors and cyber criminals, and how ransomware gangs work. For example, had some great conversations at Black Hat last year with people like Cynthia Kaiser, who was talking about the different ransomware gangs and how they interact with each other, and how law enforcement is going after that way. That is so interesting. And actually, the BBC cybersecurity editor wrote a great book last year, I think, called Control Alt Chaos, that kind of digs into the psychology of like teenage cyber criminals and how they kind of get into the hacking world. I thought that’s really, really interesting stuff, and because it has such an impact on the cybersecurity industry in people’s lives, and a lot of the time it’s literally children. It’s so interesting.

CB: Yeah, that is wild, and that is fascinating. No, yeah, I agree. I think that the cyber crime and the people behind the act, the threat actors, I think is so interesting.

JW: Yeah.

CB: We’re always interested in learning more about that too. When it comes to, like, the current topics, we keep hearing about AI from vendors, media covering AI a lot. What type of AI trends stand out to you the most? Are there any topics that are kind of important to you right now in terms of covering and who you’re trying to talk to you about.

JW: Yeah, I mean, for us, I mean, there’s huge, there’s lots of different aspects of AI that we’re writing about. One of the common things that we seem to cover is AI and how it intersects with phishing. Email security has always been one of the sort of big areas, like I mentioned our founder came from an email security background and had an email security company, so how AI has kind of entered the phishing and the social engineering world is so interesting and quite scary, really, because phishing obviously is becoming a lot more personalized, a lot more realistic, and the sort of potential for it to be scaled out with hyper realistic attacks, I think, is quite worrying, and deepfakes.

I was chatting to a few email security and security awareness providers at RSAC this year about deepfake phishing, and particularly things like getting a WhatsApp message from your boss that sounds exactly like them, and you know how you combat that is a really interesting question. I think also a lot of engineers and developers I’m speaking to are definitely concerned about AI and the risks of AI finding vulnerabilities in their work, and how they need to update their workflows, and that’s a very interesting question, as well. That’s definitely something that you know, definitely matters day to day to developers and engineers. It has a real impact on their jobs, not, not like sort of this is a potential risk, but it’s happening right now.

CB: And I’m curious, too, like there’s so many vendors that you mentioned, RSA, you mentioned Black Hat at these big events, everyone’s talking about AI. How are vendors kind of cutting through that noise? From your perspective.

JW: I think it’s really, yeah, a really tough. It must, must be really tough for a vendor to, you know, cut through that and deal with, deal with all the noise in the industry. I think the ones that really interested me, like I say, is sort of where it has that that impact in terms of the day to day, and how it’s not just a sort of conceptual, conceptual idea of AI that they’re talking about, but they can prove that, you know, this is, this is how it’s either helping organizations or how it’s addressing these risks.

I think the research side is very important as well, so you know those kind of analysis of different models is definitely really interesting, but in terms of if you know the specific product side cutting through, I think it’s showing how it’s having an impact on teams, how it can either improve outcomes or solve challenges. That’s definitely something that we’re really interested in seeing, you know, putting, putting the ideas into practice, I suppose.

And the governance piece is really, you know, that’s been very competitive, the whole AI governance angle, but it is really important for a lot of businesses as they roll out AI programs into their organizations, and the whole agenda side was obviously huge at RSA, see this year, but it really is, it’s happening, you know. You see engineers having, you know, 20 different agents that they’ve got running overnight. You know, those aren’t kind of future ideas are happening now.

CB: Yeah, exactly. And I think that’s a really good point. It’s being able to prove that the solution is working and making a difference, and not just adding AI into marketing messages and things like that at these events, so definitely good advice from a media perspective.

MF: Yeah, and with all of the vendors, practitioners that you’re speaking to, and I’m sure you’re getting lots of hands-on insight there. Have there been any, whether it’s AI related or another type of security, have there been any innovations that you’ve come across that are particularly either surprising, like, “Wow, they came up with this new solution, I’ve never seen anything like it before,” or perhaps a new solution where you’re like, “This is so timely for what the industry is dealing with right now,”? Has there been anything like that that’s caught your eye over the past few years,

JW: Oh, 100% I mean, the last few kind of months, let alone years, as we’re always seeing new core new technologies from the vendors we’ve covered. I just, this, the last couple of weeks, I’ve had demos from a few email security companies, one that’s just released a module that kind of monitors all of your organization’s teams meetings, and kind of flags suspected deepfakes to kind of alert people to, you know, if they’re chatting to someone that’s not real. I mean, it’s kind of crazy that that’s something that you’ve got to worry about, but it’s the case. So, I thought that was a really cool bit of tech.

We’ve seen some kind of interesting changes happening in areas like secret management and PAM, so things like zero standing privileges, where identity privileges aren’t persistent, they’re granted just in time, and then automatically revoked when they’re no longer needed. I think that’s a really meaningful shift for security teams. I mean, these types of products don’t necessarily always make the headlines, but you know these products are really interesting, and they do matter for security teams day to day. They have a real impact on, you know, the level of security that organizations can have in place. So those kind of features, you know, like I say, we kind of geek out about them here.

CB: Yeah, definitely. And you know it’s interesting, you bring that up too, because one thing we were wondering, outside of AI and outside of some of the other, like, you know, top of mind things and headlines that you guys are are covering, are there any other topics that are more under the radar that maybe aren’t getting as much attention that you’re noticing?

JW: Yeah, I think there is a bit of a danger that with AI it kind of sucks all the energy out of the room in cybersecurity, for sure. And I think there’s a few things that I personally like to learn more about, like quantum encryption. I think that’s going to be, you know, it’s already a huge story, but I think that’s going to be even bigger.

I think the main thing for me is that that sort of cyber SMB angle for cybersecurity, and that fund, security fundamental piece. I think that is something that isn’t talked about enough. I think most, the vast majority of businesses don’t have big cybersecurity budgets. They don’t, you know, a lot of companies don’t even have one person managing cybersecurity as their job. It’s, you know, one of many hats that that IT manager might be wearing, so they’re having to learn these things, and, and kind of get to grips with the challenges of AI, for example, and apply some of these best practices to to their business, and I think that’s really interesting. And it’s not talked about enough, how you know things like user awareness training and phishing, and how these apply to small businesses and how we can help those companies deal with those challenges.

CB: Yeah, no, I agree. I think that the angle needs to be covered a lot more, because people focus on those big, flashy things and the big companies and the big budgets, but it’s important to know what small businesses are doing.

JW: Yeah, absolutely, and you know they’re worried about the same things that the bigger businesses are, but they just don’t have the resources to throw them.

MF: Awesome, and kind of our last main industry and events focus question before we move on to some listener questions. What are some tips or advice that you have for PR professionals who are trying to get in front of you or your team at Expert Insights, when they might have, whether it’s news from a company, whether it is some rapid response on major news cycles, for example, we know the World Cup is coming up, we know the anniversary of Colonial Pipeline is around here. So, what are some tips that you have for any PR professionals?

JW: Yeah, we work with a lot of PR companies, and you know they’re really invaluable, actually, for us to be able to, you know, to let us know about the new vendor news, and we’ve got a lot of longer-term relationships as well, because we cover, you know, a lot of the same kind of markets for, you know, for many years, and track the changes there.

I think we, you know, we are Expert Insights, we always want to bring that expert perspective, so we may, we maybe track less the topical things of like the typical news organization, but where pitches can lead with what the problem is and how their tech helps to solve it, or how their specific expert can provide some advice and some expertise for teams to help them solve their day to day problems, that’s always something that we’re, that’s always a conversation as well worth having for us, and we always really like to share customer perspectives as well. So, someone that’s been a CISO, for example, and can provide that advice for for our readers who are CISOs and share that expertise, that’s always really interesting.

I think the, you know, some of the best vendor interviews that I’ve had have been with people who have come from the CISO world, and then, you know, gone to a company that they’ve used while they’ve been at CISO, and they can talk about, really, you know, this is what was really exciting for us as a customer, and here’s why, you know, this kind of matters to the people reading the story. I think, you know, I always do feel bad, because we get a lot of, a lot of pitches, and I don’t get round to responding to all of them, and you know, there’s, there’s probably a lot of great things out there that do get missed.

But yeah, I think that was, there was one, there was one pitch, I think the point that I will get round eventually, there was one pitch I had before RSA, and there was a company that I specifically wanted to talk to, so I went back, I found the pitch, replied to them, and they said that’s great, happy to set up a conversation, but this pitch was actually from last year’s RSA, so you know it was like a year later I did get round to responding, so there we go.

CB: Made that person’s day.

JW: They’re probably quite confused, but yeah.

CB: That’s funny. Well, hey, yeah, you knew if you want to talk to him, you were able to search that inbox, go through all the different pitches. So,

JW: Yeah, so sorry that I think one, one, you know, the one real piece of, I guess, advice I could, I could say is that, you know, if it make it relevant to our readers’ day-to-day experience, for experience size, that’s the main thing. If you can relate it to, hey, this is something that your readers are struggling with, and you know, this is how we help solve that challenge, or this is a bit of advice that we can provide a bit of expertise, that will definitely catch our attention.

CB: That’s great advice. Great. And transitioning to listener questions, our first one for you here is, who has been your most memorable interview?

JW: Yeah, that’s a, that’s a good question, and it, yeah, I think there’s, there’s a lot to choose from. I think the best interviews are the ones that sort of spark a debate. I think, so we had a great interview with a CISO, and they kind of made that, that point, that CISOs have to be right 100% of the time, and the attackers only have to be right once, and we put that story out, and it sparked a real debate, actually, between, you know, around whether that framing was helpful or if it was right, and I think it was really interesting to sort of spark that conversation.

I think we had some great interviews at RSAC this year, a lot about agentic AI and security risks around that, and kind of that debate around how humans can oversee agentic AI loops, and where security can fit into that without blocking innovation, and without stopping AI from being able to scale out. I thought that was really interesting. Some of my most memorable ones, though, I think, would be with the real techy people, who they’re not polished, they’re not kind of PR professionals, they kind of tell, tell you exactly how they think it is, and it can be very refreshing, but it could also be kind of hard to keep the interview on track. Those are definitely the most memorable ones.

MF: That’s awesome. Those conversations, conversations are especially fun to sit in on, because you get to hear just all of the in-the-weeds types of scenarios that they’re dealing with daily. So, yeah, I’ve sat in on some SME calls before, and I’m just like, what, what am I doing hearing about all of these like super interesting operations that are going on right now. It is just fascinating, the stuff that you don’t even think about, that some of these practitioners have to deal with.

JW: Yeah, 100% And it’s so interesting to kind of get the real on-the-ground perspective, and you know, there’s a lot of sort of big claims that vendors can make, but the reality of how kind of tech used in the business can sometimes be quite different. I always find that really interesting.

MF: Absolutely, and you had mentioned earlier that one of the interesting insights that you love to gather is, you know, specifically from CISOs, and perhaps their experiences, you know, their direct hands-on experiences. Are there any other, you know, opportunities at Expert Insights that you particularly look for or offer to security leaders who might be looking to share some of their expertise or insights with your audience?

JW: Yeah, absolutely. So, we have an ongoing CISO interview series where we interview different CISOs and security leaders. We’re always keen to promote those voices and share kind of expertise and insights from people that are working in the security space. We’ve had a series like our Women in Cyber series that Caitlin Harris did for us last year, which was a fantastic series, kind of lifting up voices across the cybersecurity industry. We are always kind of keen to share learnings and help promote, you know, security, better security outcomes, and speak to as many different experts as we can to share that the vendors are kind of, as I’ve mentioned, are invaluable sources for us, so we’re always looking for insights and expertise to help, you know, round out our news coverage, and and bring those insights to our readers.

We’re also, you know, we’re launching a new newsletter later this year, actually, which we’re going to call CISO Voice, and we’re going to bring, you know, that’s going to be specifically for CISOs, and we want to bring as many perspectives as we can from the CISO world and the vendor world to help CISOs to be able to do their jobs more effectively and to give them that kind of expertise and resource that they need, so absolutely, there’s a lot of opportunity, actually, for people to share their expertise for Expert Insights. We really encourage it and support that.

CB: Yeah, that’s excellent to know. I know this episode is coming out in early June, but do you have plans to be at Black Hat this year?

JW: Yes, I will be at Black Hat. Yeah, I’m looking forward to it. Really looking forward to it, actually.

CB: Love that. We’ll have to see you there.

JW: Yeah, absolutely.

CB: Listener question: since we are here in the beginning of summer, any go-to spring/summer hobbies that you’re looking forward to this summer, other than Black Hat?

JW: Yeah, I do love the summer, actually. And in the UK, we’re just starting to get some, like, warmer summer weather after quite a wet and miserable winter. So I’m really looking forward to some sunshine. I really enjoy surfing, love the beach, even just walking along the beach, or just chilling out for the beach in the afternoons. Yeah, can’t be beat in the on the beach with a book in the summer, you just can’t beat it.

CB: You can’t beat it, and that’s a great way to balance out all the cybersecurity talk, right?

JW: Yeah, yeah, absolutely. You definitely need it in this industry.

CB: That’s for sure. Well, Joel, it’s been a pleasure chatting with you today. Thanks for coming on the podcast and sharing all of your expert insight from experts. Loved hearing that from you.

JW: Oh, thank you so much for having me. Really appreciate the opportunity.

CB: Awesome, thank you everyone for listening. Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/.

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Shaun Waterman, Freelance

On this episode of Inside the Media Minds, Christine Blake and Madison Farabaugh sat down with award-winning freelance journalist Shaun Waterman. With nearly 30 years of experience covering cybersecurity and defense at outlets like BBC, United Press International (UPI) and POLITICO, Shaun is now a freelance writer, seen in publications like Air & Space Forces Magazine, Via Satellite and ISMG’s OT.Today, focusing on some of today’s most complex and high-stakes technology issues.

Like many of our guests, Shaun didn’t set out to become a cybersecurity reporter, it came to him. After covering mostly national security and the war on terror at UPI, Shaun began gravitating toward cyber coverage at the Washington Times as a way to focus on less ideologically-charged stories. “I wrote a lot about cyber so that I didn’t have to write so many stories about Benghazi or about the Chechen terrorists flooding across the southern border,” he shared. 

Adapting Coverage Across Highly Specialized Audiences

According to Shaun, being a freelancer and writing for multiple publications isn’t just about changing tone, it’s about knowing your audiences and what they care about. This translates into intentional messaging and story angles for different readers. 

At OT.Today, his focus is clear: they need “news you can use.” An audience of primarily security practitioners needs actionable insights they can apply directly to their day-to-day work. That means cutting through theory and getting straight to practical implications.

By contrast, Air & Space Forces Magazine serves a deeply loyal, long-standing audience with personal connections to the publication. “People talk about how their dad used to read the magazine, or their uncle. People have a lifelong relationship with it.” 

For Via Satellite, Shaun shared his appreciation for the publication’s legacy as the “OG publication in the space market.” Because of this, his work there is less about reactive pitching and more about fitting into an already established editorial calendar and industry storytelling.

A Skeptical View of the AI Boom

Shaun shared that he has a nuanced view of the current “AI wave.” While much of the industry is leaning into hype and encouraging, at times almost forcing, the use of AI, Shaun is focused on what’s happening beneath the surface. His recent reporting dives into restricted-access frontier AI models from companies like Anthropic and OpenAI, particularly how they’re being selectively shared with cybersecurity vendors. 

The reason: these AI models are becoming dangerously capable. 

“These models are so good at finding flaws and bugs in software code. And not only that, they then can write exploits to take over edge devices or take over servers,” he shared. “You can’t afford to have this capability out there in the wild because it would basically make hackers unstoppable.” 

This then creates a paradox. The same tools that can strengthen cybersecurity defenses could also supercharge attackers if widely released. As a result, Shaun continues to monitor how organizations are reacting internally to their AI investments, and questioning whether adoption is being forced rather than earned as companies continue pushing AI use on their employees. 

The (Un)Scary Truths about Cybersecurity in Space 

Another area Shaun is watching closely is the intersection of space and cybersecurity, a rapidly evolving sector with both promising progress and real vulnerabilities.

On the encouraging side, he pointed to the growing maturity of collaboration across the industry, particularly through organizations like the Space Information Sharing and Analysis Center (ISAC). Compared to other critical infrastructure sectors, the space industry is beginning to take information sharing and communication more seriously, making early detection and prevention more feasible. 

“On the downside, you know, I think the most cyber-vulnerable segment of the space industry is here on the ground.” While much of the attention goes toward launch and orbit, the ground infrastructure, the terminals, networks and supporting systems, remains an easier target, Shaun explained. As these systems become increasingly software-driven and cloud-based, new risks emerge, from misconfigurations to expanded attack surfaces.

The result is a complicated reality where the industry makes meaningful strides in collaboration and awareness while racing to keep up with the risks created by its own rapid innovation. 

To hear more from Shaun, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps

0:21 – Guest Introduction and Overview

2:31 – Shaun’s Career Journey to Washington, D.C.

6:28 – Making the Shift to Freelance 

11:56 – The Art of Tailoring to Different Audiences

14:11 – The AI Boom and Other Hot Topics 

20:56 – Space & Cybersecurity: Encouraging vs. Discouraging

25:51 – Public to Private Sector Collaboration on Security

30:24 – Shaun’s Favorite Story

33:42 – Pitching Advice: Know Thy Journalist

Transcript

Inside The Media Mind of Shaun Waterman

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co host, Christine Blake 

Madison Farabaugh (MF): and Madison Farribaugh. 

CB: This show features in depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories.

MF: From our studio here at W2 Communications let’s go inside the media minds. 

CB: Hello everyone, and welcome to Inside the Media Minds. Today, Madison and I are welcoming Shaun Waterman, who is an award winning journalist and content strategist based in Washington, DC. He specializes in cybersecurity, space and federal contracting. He’s worked for the BBC, The United Press International Newsweek, Politico, and also helped launch CyberScoop. He’s currently freelancing. So on this episode, we hear a lot from him about that. I particularly loved how he spoke about how he separates his coverage areas and how he kind of tailors his content for each of the audience that he freelances for. That was kind of an interesting perspective. Madison, what did you find the most interesting?

MF: Yeah, I thought Shaun had lots of great insights to share on the whole Anthropic and Mythos news cycle. He’s been paying very close attention to this, especially the organizations who have kick started the whole initiative, and even where that might be headed in terms of who else will be included in the project, who else will be sharing their insights and or incorporating this technology into what they’re working on internally at their organizations? So I think our audience will really enjoy those insights. He also had a lot of great things to share, just in terms of encouraging or concerning aspects about the satellite security industry. So feel like we covered a lot of different topics on this episode. I’m very excited for listeners to hear it.

CB: Yeah, we sure did, and there’s some fun little tidbits in there that he shared as well that I think everyone will enjoy. So yeah, enjoy the episode. Hello, everyone. We are very excited for today’s guest. We have Shaun Waterman on the podcast today. He is currently a freelancing and writes regularly for Air and Space Forces Magazine, Via Satellite Magazine and OT Today, the operational technology vertical of Information Security Media Group. So welcome Sean. We’re excited to have you on the podcast today.

Shaun Waterman (SW): Thanks for inviting me.

CB: Of course, we’d love to start just with a quick overview of your background and your journey as a freelancer and how you ended up here today.

SW: Well, yeah, so I came to Washington with the BBC originally in May 1999 for what was supposed to be a six month posting as the radio news producer in the bureau here. And it was a very prestigious assignment, but also very, sort of, internal, small-p political. So I had to scheme for a couple of years to get it. And although it was only a six month posting, in theory, everyone always got extended at least once. And my predecessor had been there a couple of years, I think, all the way through the Lewinsky, you know, scandal in the Clinton impeachment. So, but after the program I worked on, you know, after six months, they decided they couldn’t do without me, and they told me to come back to London now. And by that time I’d, I’d fallen in love with a young lady, which unfortunately didn’t last, but I’d also fallen in love with the city, you know, which turned out to be a lifelong affair. And so, I quit the BBC, and I got a job at UPI, where I spent almost a decade covering, you know, GHS and the War on Terror, mainly. I won an award for my coverage of the post 9/11 Intelligence Reform bill. And, you know, in my heart, I’ll always be a Uni-Presser. I have incredible fond memories of of UPI. It was, you know, one of my colleagues described us as the one legged man in the ass kicking contest, yet we still managed to kick ass occasionally. And, you know, just, just incredible, you know, lifelong friends, and it really was the kind of organization, I mean, you know, it was, it was, it was not in a good place, sort of as a business, but the journalism, you know, the the reporters, the other people I worked with there, they were just, they were wonderful. And we, we kept doing it every day. And then I got later, got laid off from there in 2009, first of three layoffs, eventually went to work for the Washington Times where I was, I was writing about national security. It was a very ideological newsroom, and it wasn’t a very good fit. But one of the ways that I sort of address that or tried to get round it was I wrote a lot about this cyber stuff, you know, because that way I didn’t have to write so many stories about Benghazi or about the Chechen terrorists flooding across the southern border. So, I got laid off by the Times, got recruited by Politico in 2014 to launch their pro cybersecurity news service. Got head hunted from there by ScoopNews to launch CyberScoop. And after I did that, I sort of, you know, I took a step back. I had two, you know, baby boys. They were sort of one and one and a half or, sorry, six months and one, one and a half years. And my wife was trying to get her salad dressing business off the ground, which she succeeded. It’s now available in area Whole Foods. 

CB: What is it called?

SW: Mondiel. Okay, they have two, they have two flavors, you know, Provence and Istanbul. Provence is like a vinaigrette, lemon vinaigrette. And the Istanbul is a sort of more Asian, flavored with, like sesame, ground sesame seeds and stuff. Delicious, really delicious. Anyway, so she was doing that and and we had the babies, and I just, you know, I have an older child, and when he was that age, I I sort of, you know, it’s when I was filing, you know, multiple stories a day for UPI so, so I felt like I’d missed some of that. So, you know, I stepped back from full-time employment, and for a couple of years, as I thought, and just as I was getting ready to, just as I was getting ready to, you know, get back into the labor market full time. You know, that was March 2020, when, as you may recall, the world sort of ended so, so freelancing, which I’d been doing for a year or so, really, just to keep my hand in and to and to, sort of, you know, earn a little bit of money, but it became a full time thing. And I’ve, you know, I’ve grown to love it. Really, I’ve been, you know, news is a team sport, and I missed the hell out of a newsroom-the camaraderie. You know, miss that very badly, but you know, the autonomy is extremely valuable to me, especially, you know, as a parent, and you know, on the other hand, you have to admit that being a freelance doesn’t really mean you don’t have a boss. It means that you have multiple bosses. But I’ve been very, very fortunate in the multiple bosses, you know, that I’ve had Via Satellite and especially Air and Space Forces Magazine and now ISMG. I mean just, you know, real solid professionals. And, you know, Tobias and the team at Air and Space Forces Magazine have been incredibly supportive to me over the years as well. So, you know, just been very lucky. So that’s, you know, here we are.

MF: That’s awesome. Yeah. Thank you so much for sharing just that background. It’s great to hear and just cool to see, I guess, that transition into freelancing and hear a little bit about that experience, and even to dive into that a bit deeper, could you give us kind of a view of your day to day right now, between, you know, crafting stories, speaking with experts, coordinating new writing opportunities. How do you divide up your time, usually, throughout a given week?

SW: Yeah, I mean, it’s so I try and spend as much time as possible attending real life events, because I think, you know, you can attend stuff online, and it’s nice not to have to have to put on pants, but it’s, it’s, you know, when you’re out there and you mix with the crowd, and you, you know, it’s a chance to meet new people. I’m always looking for new sources, new people who can educate me about about new stuff. And so I try and attend as many events as possible. And, I mean, honestly, like, the biggest problem I have with time is social media. You know, I really wrestle with it. It’s such a time suck and and yet, you know, you’ve got to keep in touch with what people are thinking, especially, you know, people in your network. I mean, you know, I spend way too much time on LinkedIn and Twitter, and I do, you know, I try to be intentional about it. I try to be discriminating and use my time wisely and avoid going down big rabbit holes. But, I mean, I often, I don’t succeed in that as often as I as I need to. But yeah, so that’s, you know, and then, and then, and also, I try and, you know, touch base with people over the phone or in real life. You know, even if I don’t have a story that I’m working on, just to catch up with them, see what they’re doing, see what they’re thinking about stuff. You know, it’s try and keep myself educated that way.

MF: Of course. Yeah, that that makes total sense, especially you know, given you are writing for multiple different publications, I’m sure that’s helpful hearing what the experts have to say in these different industries that you write about. And then, as well as keeping, keeping on top of what your audiences might be interested in or what they most want to learn about at any given point in time. Could you perhaps give us a little bit more detail about the different audiences that you currently write for, whether that’s Air and Space Forces Magazine, Via Satellite, or even OT Today for ISMG, how do you kind of tailor your messaging across these different outlets?

SW: Well, so OT Today is a very practitioner, you know that’s the audience, is practitioners, security, professionals. So, you know you’re, I always think of that as “News You Can Use.” You know that they, they need, they need the answers to the questions that they’re, you know, confronting in their, in their professional lives every day. I mean, Air and Space Forces Magazine is very different. I mean, honestly, it is great to work for an organization, for a publication, I should say that is so beloved of its of its readers. I mean, people love that magazine. And, you know, not very different experience one gets, you know, from when I used to work at Politico, when I think, you know, people might have been afraid of you a little bit, but they they weren’t necessarily loving your output. Whereas, you know, people talk about, oh, they their dad used to read the magazine, you know, or their uncle or and, you know, how they, I mean, people have a lifelong relationship with it. So it’s a, it’s a really, you know, that’s very special, that’s very special. And Via Satellite, magazine is the sort of, you know, it’s the sort of OG publication in the space market, really, you know, lovely people there that run it, and, and, you know, very comprehensive so that, I mean, my one regret there is that they, they only commission. You can’t pitch them, you know? They just, and they have a sort of editorial calendar, and, and they know when they, when they need freelance input, and, and it’s always fun to write. I mean, I love writing about space. It’s, you know, what’s not to love?

CB: Yeah, it’s always something interesting happening. No understanding you have some of these different focused areas, what are some of the hottest topics that you’re currently interested that you’re currently covering maybe the next three to six months or so?

SW: Oh, well, what I’m working on right now, in fact, I just filed the story before getting on with you, was, this is my, my latest piece of reporting about Anthropic project Glasswing, although, you know, it’s actually also about OpenAI, trusted access for cyber program, because both of these big frontier labs have this, a mechanism for cybersecurity vendors and big infrastructure providers, you know, the hyper scalers and other and others to, to get access to these extremely capable latest generation of gen-AI models that they haven’t released to the public because they’re, frankly, they’re worried that that it would create risks and dangers, because these models are so good at finding flaws and bugs in software code, and not only that, they then can write exploits that that use them to, you know, to take over edge devices or or take over servers. So, so really quite, you know, there’s a, I mean, you know, we haven’t, we’ve seen some independent testing of these models, and it’s clear that they are increasingly capable. They’re getting better and better. And you know, so they restrict the access for perfectly understandable reasons, but both of them have completely excluded operational technology from those, you know, from those access parts and and that’s really a big problem, firstly, because OT is like, you know, that’s what our critical infrastructure relies on, the water and wastewater facilities, the power generation plants, you know, the factories, they’re even, even healthcare, you know, with the medical devices, so, so, so it’s absolutely critical for critical infrastructure, and it’s very different In terms of, you know, how you prioritize vulnerabilities, how you manage them, how you mitigate them, you know, how you sort of, you know, it’s just a very different world where vulnerabilities are concerned, because of the, you know, these refresh, these things are meant to last decades often, this stuff, you know, this operational technology. So, so anyway, so I’ve been writing about the exclusion of OT from from Project Glasswing and from OpenAI’s trusted access for cyber program. And I think that, you know, increasingly, sort of access to these models is going to be a resource which is sort of limited, not just financially, but also, you know, in this way they’re going to mean, doesn’t matter how much money you gave them, they wouldn’t just let anyone in, because, you know, the point is, you can’t afford to have this capability out there in the wild, because it would basically would make, you know, make hackers unstoppable, is the thinking.

MF: Yeah, that’s super interesting, and thank you for diving into that a little bit more, especially with with consideration of where the industry is headed and how different organizations can be using “Frontier LLMs,” I think in these new AI models, I think that’s definitely important to keep in mind for how, you know, on the flip side, how they can be used by cyber criminals and how they can be used offensively. Are there any other trends that stand out to you when, when you’re evaluating how different industries are adopting AI or other emerging technologies. Is there anything else that, in your opinion, is flying under the radar?

SW: Well, I think you know one thing that’s going to crop up increasingly now is, you know, big companies, large enterprises, have trying to sort of retroactively justify these huge investments that they’ve made. I mean, you know, I’ve seen, I’ve heard a little bit of chatter about staff in some of these large companies being sort of graded or rated on how much they use AI and, and that seems to me to be a bit the wrong way round. Like, you know, people should want to use it if it was, if it was useful, and if it was helpful, and if it, you know, was this sort of super tool, people use it without being sort of, you wouldn’t have to, you know, that’s basically a sort of a mechanism to incentivize its use. But, I mean, shouldn’t it? Shouldn’t how good it is be incentivizing its use, if, if it’s as good as, you know, we’re all expected to. So I think, you know, I think there is, there are elements of bubble in all of this, and there are elements of a hype cycle. And, you know, I mean, obviously, it is an incredible, you know, generative AI is an extraordinary capability in these frontier models, like I say, they’re improving very rapidly, but, but also, you know, the the economics of it are, are, look a bit wonky to me. I mean, I’m not an expert, but it just, you know, something doesn’t quite add up, it seems to me. So, you know, I mean, we’ll see how it all shakes out. But I do, yeah, I’m a little bit of a skeptic, actually, on the AI thing, but, but we’ll see. We’ll see how it all works out.

CB: Yeah, we sure will. We know another big focus area for you is security in the space and satellite industry. We saw one of your recent articles, I think, early April and Via Satellite, about how cybersecurity in space is really hard and kind of what some of the strategies defenders are trying to do to handle that. From your perspective, what is either encouraging or concerning about that landscape currently, and what are some of your focus areas here?

SW: Well, so let’s start the encouraging stuff. You know, the space ISAC, the space Information Sharing and Analysis Center in Colorado Springs, is, you know, one of the most mature cyber threat information sharing organizations in any of the 16 sectors of critical infrastructure and space. Isn’t even a designated, formally designated as critical infrastructure, but, but, you know, the honestly they’ve got, you know, they’ve got a, it’s not quite 24/7 yet, but, but they’ve got a watch center, they have, like, daily briefings and conference calls and things and and, you know, it’s just really there. I would say they’re up there with the banks in terms of the maturity of their information sharing apparatus, which is great, you know, because, you know, the great thing about cyber is, you know, if, if if I, if I’m attacked, I can warn everyone else in the sector. You know, I can provide IOCs, Indicators of Compromise. You know, I can provide other clues that will help defenders in other organizations spot these attacks before they can get a foothold. So, you know, that sort of information sharing that’s very encouraging. And, you know, I mean, not everyone’s a member of space ISAC, it is quite expensive to join, but, but they are, meaning, in my view, that that’s a that’s a boom to the to the industry.

CB: That is very encouraging, yeah,

SW: On the downside, you know, I think the most cyber vulnerable segment of space industry is here on the ground. You know, it’s the ground segment. If you look at, you know, what the Russians did on just as they were invading Ukraine, and they tried to shut down Viasat. They attacked the terminals. You know, they got into the network of the ground of the ground station in Italy, and they attacked the terminals. They used the terminals, so and, you know, in general, the ground is the most vulnerable part cyber, vulnerable part of space, and you know, it’s also the one that’s now undergoing this process of like commoditization, you know, and virtualization, all of these incredibly complicated, hard piece of hardware, the switches and the modems, and the signal amplifiers, and all of that, not all of it, but a lot of it is going away and being and being virtualized and being replaced by software and that, you know, that does make it vulnerable because, you know, it’s in the cloud. Misconfigurations can happen. Security problems can happen, and, you know, so that, so that’s an issue. I would say that’s the thing that is most worrying. I would think, because the, you know, also, the ground isn’t getting the big investments necessarily that, you know, people are spending money on launch. They’re spending money on getting stuff into orbit. They’re not necessarily spending money on the ground. And you know, so there’s a legacy technology issue there, as well as the flip side of that, which is, when you modernize, you go virtual, you go software based, and, and, you know, possibly expand, expand your tax surface, like that. So, yeah, it is. It’s very, but it’s fascinating watching this, this relatively new, or, I mean, parts of it are very new industry, you know, sort of wrestle with these, wrestle with these problems. Especially, you know, when you’ve got all these startups and small companies that probably aren’t necessarily thinking about security in the way that they might be, and are more focused on, you know, getting their product to market.

MF: Yeah. And based on, based on what you just described, how have, how are we seeing, perhaps the private sector and the public sector collaborate right now to kind of improve national security, especially as you mentioned, you know, there are threats from other countries coming into our networks. How are you seeing collaboration there perhaps improve? Or are there any areas where you’re noticing there might be gaps?

SW: I mean, I think there’s always gaps. Always seams anyway. And I mean, I, you know, we’re seeing quite a lot of regulatory activity, you know, new sort of new NIST guidance for the space sector, you know, executive orders out of the White House. This one and the previous one. New standards for national security satellite systems. And I think all that kind of policy and regulatory activity is, I mean, it’s certainly good, certainly good for us journalists, because, you know, we have lots to cover, lots to write about. But also I think it’s good for industry because it does set a baseline. It makes it an issue. It, you know, makes it a priority, puts it on, you know, on everyone’s to do list. So I think that’s, yeah, I mean, there is more of a, you know, the latest executive order called, I’m sorry, the the recent National Cyber Security Strategy did call for a more more use of the private sector, even in offensive cyber operations, which you know, and there’s a couple of bills floating around in Congress suggesting that the President should issue letters of marque and reprisal. You know, this very 18th century where you would basically charter people to be sort of Buccaneers. And, I mean, it’s completely bonkers, in my view. I mean, it’s, you know, it’s the existence of these bills is, unfortunately, proof that being a really stupid idea isn’t disqualifying in the Washington policy conversation. So, I mean, there are, there are much more sensible, sort of grown up ways you can think about doing this, like, you know, the Merchant Marine that used to organize all these convoys across the Atlantic in World War 2, or indeed the the Civil Reserve air fleet, which is basically, you know, a sort of standing arrangement by which the military can can reach in and lease civil, civil aircraft to provide lift during a war, when they might need to move large numbers of men and material across the country and indeed across the world. So, you know, there is a, it is an incredible resource that private sector in, you know, for the U.S., for U.S., national power. But I think that the idea that you would charter some, you know, over ambitious startup to go wandering around attacking Russian system. I mean, it’s just, it’s just bonkers, you know. I mean, cyber operations are extremely complicated things. They’ve got to be coordinated. They’ve got to be de-conflicted. You know, if you’re launching a DDOS or some kind of low level attack against one, some adversary target, you know, and they suddenly start to pay attention to their security they might notice, you know, look, there’s this NSA implant in there that’s been in there for five years, waiting for the moment when it needs to be used, and now you’ve just blown that capability. So, you know, got to be really careful with this stuff, and, but I but it’s an interesting conversation, and, you know, and it’s one I think that will go forward, because there are, you know, there are people on Capitol Hill, there are people you know, in Silicon Valley who, you know, want to make sure that resource doesn’t go unused as an element of now.

CB: Yeah, definitely an interesting conversation. I think we’ll continue seeing play out a bit. As you said. Before we wrap up, Shaun wanted to ask a couple of our listener questions that we have for you. First one, what has been your favorite story or most compelling interview that you’ve written recently? Or not recently, it could be any time in your career really.

SW: Well, yeah. I mean, I was thinking about this is over the last year, yeah, and it’s sort of cheating, because it was actually March last year, but I wrote this big story about big changes at the Air Force’s iconic software factory, Kessel Run. And, you know, Kessel Run is one of those institutions where a lot of people have passed through it. A lot of people, you know, care about it. Know about it. You know, know something of its inner workings. Have a view. Have views quite strong, in some cases, views about how it should be organized, and so forth. And when you I mean, that’s a delight to to report, because, you know, there’s so many people out there who care about it and know about it and will talk to you about it. It’s slightly alarming to sort of write about, because, you know, if you get anything wrong, you’re liable to be strung up from a lamppost, sort of internet style, anyway. And, you know, when you, when you get into those debates, you know, often these are people who’ve been who’ve been talking to each other for years about these issues. So, you know, it’s just, it’s you have to tread carefully, but it was, but it is, again, it’s always great to engage with things that people care about. And you know, it’s a real, it’s a real pleasure to get all that, mostly, it’s a real pleasure to get all that feedback and, and, you know, I mean, to have people like the commander of Kessel Run sort of complaining about one story on a panel. You know, I’m sorry, wasn’t fond of it, but, I mean, I think this good story, and it certainly gave him a fair crack of the whip. But yeah, so that was, that was fun, just because of the community, you know, because community of people that’s involved and and the sort of chance to try and report out some of those issues and disputes. You know, it’s a really important question: How can the Air Force and the U.S. Military writ large, you know, take advantage of the power of software to, you know, to advance war fighting capabilities? And you know, Kessel Run’s tried to answer that question in a number of different ways over the years, and you know, it’s going to continue to evolve.

CB: Yeah, that is fascinating, and that’s a great pick as one of the most compelling stories of the last year.

SW: Thank you.

MF: Yeah, and you mentioned just how in writing, in writing that story and kind of the feedback that you would get on it, that kind of touches on what our final listener question is, which is, what makes a cybersecurity story or textbook story in general worth covering to you, and what do PR professionals get wrong when trying to pitch you stories?

SW: Well, I’ll answer that second piece first. You know, I don’t do product stories, so, so that’s generally a waste of time. I do sometimes write about trends. And you know, if you can, if you so, you know, if you think you you’ve got a trend then, then I’ll read about that. I think. I mean, one thing I that’s always useful, I think, is, you know, interesting takes on the news of the day, but it actually has to be the news of the day, right? You know, no one cares what your client thinks about last week’s news, and unless it’s, you know, unless it’s an ongoing story, like, you know, like the war in Iran, for example. But you know, I might want to meet your client for reasons that have got very little to do with you know what the pitch is, right? I mean, you know, I’m always interested in meeting people with interesting backgrounds, especially those you know worked at three letter agencies or or in the national securityn apparatus, and, you know. So, I guess one mistake that people make is thinking that, you know, because I want to meet their person, that they’re, you know, the person they pitch to me. It’s to, I mean, I try and be transparent and say, you know, I’m actually not interested in this story, but I am interested in this person, and, you know, possibly having a relationship with them and using them as an expert source or whatever. But, yeah, that’s that. Yeah, I think that’s all I’ve got to say on that,

MF: No definitely valuable feedback, for sure, and something our listeners can take away and apply, especially those of our listeners who are PR Professionals and always want to be working with the media in the most effective way. So thank you so much, Shaun for your time today and sharing all these great insights and your background, we’ve really appreciated your time and just getting to chat with you a little bit more and getting to know your coverage areas. So really appreciate it. Thank you for your time. 

CB: Yeah, thanks, Shaun,

SW: Thank you for inviting me. It was a real pleasure. It was fun to you know witter on about this job that I you know, I mean, it’s my life, you know, it’s, I’ve been doing it all my professional life. So, it’s always good to, good to chat about it.

CB: Yeah, we love following your coverage, and now we know a little bit more. So very valuable insight. So thank you, and we appreciate your time today.

MF: And thank you to all of our listeners.

CB: Thank you for listening to today’s episode of Inside the Media Minds to learn more about our podcast and to hear from some of our past guests, please visit us at w2comm calm.com

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Jessica Lyons, The Register

On this special live episode of Inside the Media Minds recorded at the RSAC Conference 2026, co-hosts Christine Blake and Madison Farabaugh sat down with Jessica Lyons, Cybersecurity Editor at The Register. With more than 20 years of experience in journalism and over a decade covering cybersecurity, Jessica offered a candid look into how she approaches reporting in one of the industry’s most fast-moving and noisy moments of the year.

Jessica’s path into cybersecurity wasn’t exactly planned, in fact, she fell into the beat when no one else wanted it. But what started as a chance quickly became a long-term passion as she discovered the “natural narrative” of cybersecurity. “You have the bad guys who are trying to break into the networks, and you have the defenders who are trying to keep them out,” Jessica explained. “There’s espionage, there’s intrigue, there’s heist. So it seemed like a pretty exciting field to me.”

Breaking Through AI-Dominated Narratives at RSA

For the RSAC Conference, Jessica made one thing clear: the industry is all-in on agentic AI. From large-scale panels to hallway conversations, agentic AI dominated the narrative. However, Jessica remains equally focused on what’s underneath all the AI noise. She explained that real-world developments like high-profile breaches and geopolitical tensions that play out in cyberspace ultimately shape her coverage more than any single buzzword.

When preparing for RSAC, Jessica’s process starts months in advance. Beginning as early as January, she builds out a detailed plan, mapping keynotes, identifying must-meet sources and piecing together a schedule that balances reporting with relationship-building. That reality makes pitching during or leading up to RSAC particularly challenging. With a flood of announcements hitting at once, even strong stories risk getting buried.

Cutting through the noise for Jessica isn’t about louder messaging, it’s about relevance and timing. “I like it when people reach out to me and say, ‘What type of people are you looking to speak with?’ Because it’s not always going to be the same every year,” she explained.

While many companies cluster announcements around RSA, Jessica pointed to the days following the conference as a more strategic window when reporters have time to step back and engage more thoughtfully. In a week defined by noise, the most effective outreach isn’t reactive. It’s intentional, well-timed and rooted in what reporters actually need.

The Rise of the CISO and CIO

Over the course of her career, Jessica has seen cybersecurity evolve from a niche technical function into a core business priority, and nowhere is that shift more visible to her than in the increased responsibilities facing today’s Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs). 

What were once behind-the-scenes roles are now firmly embedded in executive leadership. This reflects a broader understanding that cybersecurity is no longer just an IT issue– it’s a business, operational and even geopolitical concern. As threats become more complex and far-reaching, and as AI becomes embedded in business models, organizations are relying on CISOs and CIOs not just to protect systems, but to help guide overall strategy.

“I think it’s great to see the elevation of the CISO and CIO role,” Jessica added. “That’s a really positive turn for the industry. It should be a C-suite position.”

For Jessica, this shift influences how she approaches sourcing and storytelling. She actively seeks out voices in these roles, along with other deeply technical experts, because they offer a more grounded, firsthand perspective on the challenges organizations are facing. At the same time, she noted that the industry itself has matured alongside these roles. There is greater collaboration between public and private sectors, more openness in sharing information and a growing recognition that cybersecurity requires collective effort.

To hear more from Jessica about her RSA experience, industry trends, and what she predicts for next year, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps

0:20 – Christine and Madison’s Podcast Preview 

2:40 – How Jessica got into Cyber Reporting

4:08 – First Impressions of RSA 2026

5:44 – Jessica’s Focus at This Year’s Conference

8:10 – Offensive Cybersecurity & The U.S. 

9:07 – Assembling the RSA Schedule Puzzle 

10:07 – Tips for Conference Pitching

13:40 – Cutting Through the Noise 

16:43 – Under-the-Radar RSA Themes

18:53 – Predictions for Next Year’s Conference 

20:10 – Industry Changes 

21:37 – The Evolution of Industry Professionalism 

24:27 – Dealing with AI Slop

25:37 – Keeping Cybersecurity News Fresh

27:43 – Proactive vs. Reactive Coverage

Transcript

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-hosts, Christine Blake 

Madison Farabaugh (MF): and Madison Farabaugh.

CB: This show features in-depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories.

MF: From our studio here at W2 Communications, let’s go inside the media minds.

CB: Hey everyone. We have a very special episode today. Madison and I had the privilege of podcasting live from our CYBERTACOS event at RSA in San Francisco. We actually had Jessica Lyons, who is The Register’s cybersecurity editor, as our guest. She leads coverage of topics ranging from government to best practices for defenders. She has more than 20 years of experience in publishing with roles ranging from news editor to managing editor. It was really great to chat with her in real life, in front of a live audience, and hear more about what she’s covering at the RSA Conference. We got really good first hand insight from her. Madison, what did you find most valuable from this conversation?

MF: Yeah, well, first of all, the energy with having a live audience was definitely unmatched. And we had lots of great listener questions for people who were actually there in front of Jessica. So that was very exciting. And then, like you said, I think there are a lot of great insights in this episode. I particularly enjoyed hearing Jessica’s perspective on the evolution of the CISO and the CIO role and how they should be included in the C suite. And then she also had a lot of great insights when it comes to dialogue between the public and private sectors. She even mentioned a little bit about how she navigates, you know, AI slop when dealing with so many pitches coming in from the cybersecurity community. So lots of great stuff in this episode.

CB: Oh, yes. So we hope everyone enjoys this episode that we recorded live. 

Hello. We’re gonna start our next podcast of the evening, the Inside the Media Minds podcast on the CyberWire Network. My name is Christine Blake. I’m one of the co-hosts.

MF: And then I’m Madison Farabaugh, the other co-host.

CB: Yeah. And on our podcast, we interview cybersecurity reporters who are covering the cybersecurity industry. So we are thrilled to have Jessica Lyons here, The Register’s cybersecurity editor. So we’re excited to hear from you, Jessica. We’re going to learn about your journey to The Register and your experience at RSA this week. 

Jessica Lyons (JL): Thank you. Good to be here.

CB: Yeah. So to get started, Jessica, we’d love to hear about your background. How did you get to be the cybersecurity editor at The Register?

JL: Well, it’s kind of funny. I literally fell into the job. I mean, not the job at The Register, but I fell into covering cybersecurity. The publication I was at before The Register, we were dividing up beats, and nobody wanted cyber. And I was the newbie, and it sounded really fun to me. And I thought, “Well, why wouldn’t you want cyber?” It’s this natural narrative to a lot of the stories. You have the bad guys who are trying to break into the networks, and you have the defenders who are trying to keep them out. There’s espionage, there’s intrigue, there’s heist. 

So it seemed like a pretty exciting field to me, and since nobody else wanted it, I got stuck with it, and I fell in love with it and really enjoyed covering cyber that, you know, that’s been my beat for, gosh, I guess, about a dozen years now. So I’ve been with The Register going on, it’s been four years, actually. Just recently had my four year anniversary and am incredibly happy now to be covering cyber full time at The Register. It’s a great spot.

CB: Yeah. That’s great. And we love reading your coverage of the cybersecurity industry. And here at the RSA Conference, I know we’re just kicking off here, but tell us about your experience. What are some of the vibes you’re getting this, this conference so far?

JL: I think this probably isn’t going to be a surprise to anybody, but it’s all agentic AI all the time. Groundbreaking, but it’s, you know, I haven’t been to the expo floor yet, but I’m assuming that is going to hold true there as well. It’s come up in all the conversations. Gosh, I forget it was something I believe, like 72 of the panels, it’s either agentic AI or AI agents are being discussed. 

So it’s, it’s all the discussions happening, even just walking along all the buildings and all of the windows now that have been transformed into signs and advertisements, it’s all about ‘don’t let your AI agents run wild. Just let them run,’ so I feel like it’s just everybody’s talking about it, everybody’s talking about the security risks, how to secure it, and where we go from here. So that’s kind of been my, my biggest thing. Also, I’m noticing this year, it’s not really RSA related, but it seems like there’s a lot more Waymos on the street this year. So I’m not sure-

CB: We took one here.

MF: Christine and I have taken some thrilling Waymos this week.

JL: It is kind of fun. Yeah. So those are, those are my two big takeaways so far. I’m sure is that we that there will be a lot more still early on, but that’s what I’m seeing right now. 

MF: So whether it’s AI related or based on another topic, is there anything that you specifically are looking to dive into this week, or any type of experts that you’re looking to speak to? 

JL: Oh yeah, there’s a lot, both. I mean, I think as far as topical news, the Trivy compromise is super interesting, and that’s going to be, see how that plays out as the week and even beyond progresses, and hear what people have to say about that. I think that the ramifications of that are going to continue, and as we hear about the full scope of that compromise and everyone affected. I today, I one of the my pilots from today actually was hearing Rob Joyce, the former NSA cyber boss. It was interesting because, when I interviewed him last year, he said AI is soon going to be able to develop exploit code. And then his talk today was about how we’re there already, and that’s happening right now. 

I think with everybody at RSA, it’s really fun, because I get to see all these people in person that I just normally talk to on the phone or over email. And even just a difference in person versus on the phone, people tend to let their guard down a little bit more. You have this more, more personable conversation. You don’t quite have the guards up the walls up that you do even over the phone. So it’s nice to have that face time with people. I spoke with Jenny Easterly today. That was a big highlight for me, to be able to interview her about her new role. 

And then I think also, another topic that is interesting to talk to people about this week is how the conflict is playing out in the Middle East. The cyber aspect of that is, I don’t know if unique is the right word, but just watching how cyber is taking center stage as a battlefield, along with the more traditional battlefields that we see in a conflict. So that’s something too that I’ve been discussing with people. And curious to hear what people see is as new or interesting or unique or little bit looking into a crystal ball, but how they expect things to play out.

MF: And we’ve been seeing a lot of coverage lately, too, about the topic of offensive cybersecurity as well. Has there been anything surprising on that front, whether it’s related to the current conflict or other aspects of cybersecurity?

JL: Not yet. I think that one thing everybody has been really quick to point out is that this isn’t saying that we’re going to start seeing companies hack back, but at the same time, the U.S. is going to take a much more proactive position. So and I, and from what I’ve heard, most people, not most people, everybody I’ve spoken to is is pretty on board with that, and sees that as what we should be doing when we are finding spies from China, from Russia, from Iran in our networks, that has a good deterrent effect if we’re going to take a more proactive approach.

CB: So you mentioned that you went to a panel, you’ve met with some people already. As a reporter, do you get a lot from sessions, keynotes, or do you find you get more from those one-on-one conversations and briefings that you set up?

JL: It’s, it’s kind of a mixed bag. I’d say for the most part, the one-on-one conversations are where I find the most value, and even just making that connection with someone, even if it’s not something that I’m necessarily going to write about this week at RSA, just having that connection, having that face time, knowing what this person is passionate about, and knowing somebody that I can reach out to for future stories. That’s always really beneficial. At the same time with the keynotes and the panels, it’s, it’s a good opportunity to hear from people who I don’t just talk to every week on a, you know, on a regular basis, and hear what’s top of mind for them. So it’s, it’s both.

CB: And our audience is a lot of PR, marketing folks, a lot of you in the room here. A lot of us wonder, how do you prepare, like, how many weeks out from the show? I know you get a lot of pitches, how do you prepare for that and handle all that?

JL: I mean, it feels like it starts pretty much as soon as the new year starts, really in January, and just kind of slowly figuring out, okay, what does the agenda look like? What are the keynotes and the panels that I absolutely need to cover, who is going to be there as a speaker? So maybe in addition to their session, I can get some one-on-one time with that person who will have a presence there, and just slowly trying to build it out. And it’s such a puzzle trying to fit all of this together and be able to attend all the talks and be able to talk with all the people, and there’s never enough time. And every single year I tell myself, ‘Okay, I’m going to leave more time because I need to actually write stories too.’ I can’t just spend all day talking with people, and then it always ends up being incredibly booked and incredibly busy, but, but it’s worth it. It’s good. 

MF: So to gather a bit more valuable insights for our audience, what do you think vendors or PR professionals, what do they get wrong when they pitch you ahead of conferences like this? Or what would you appreciate more of?

JL: I like seeing, I like it when people reach out to me and say, “What type of people are you looking to speak with?” Because that’s not, it’s not always going to be the same every year. So depending on what’s happening in the world, what’s happening news wise, I might be looking to speak with different people than I would next year or the year before, the year after. So I like that just, “Hey, who, who would you like to talk to? What types of people? What roles would you like to talk to?” It’s nice also just to see a list after that point. “Okay, here’s who I have who fits that bill. Here’s what they can talk to. Any of these people fit what you’re looking for.” 

And then, and I feel bad, because I know that there’s a lot of people who still do that, and then I still don’t, I’m not able to talk with all of their sources that they have. So I also think it’s, it’s not, it’s not you, it’s me. I’m very kind. Yeah, it’s, it’s not. I mean, I wish, I wish there was more time, because I’m sure that any of the people that you’re pitching me have fascinating stories and really good insights to tell me. I think one thing it’s that actually, as far as one thing that people do get wrong, I like to talk to the CISOs. I like to talk to more technical folks, the threat intelligence in general. I’m not interested in talking to your product manager, that’s not what I tend to cover. I like to in general, again, this is, you know, really, really broad scripts, but people who have a background in military or FBI, I like having that kind of perspective come in as well.

CB: Yeah, that makes sense. Yeah. I think another thing we often wonder, how can vendors cut through all the noise? There’s so many announcements going out this week. Some are product related, some are research related. It’s such a noisy time. How can vendors either cut through that noise or time their announcements appropriately around the conference to make to make it through? 

JL: Right, that’s a tough one, because there is just so much. And it makes sense, if you’re a vendor, this is a great time to announce a new product. So it makes sense that you would do that. I think it, that’s more tailored to the organization and the reporter that you’re pitching. I think then just a blanket ‘here’s how you can do it’ and cut through the noise. I think that that really varies based on what publication you’re pitching, what the person’s interests and what they typically cover. Because when it comes down to it, there’s, yeah, there’s so much being announced here, and really in the whole couple weeks leading up to RSA. And sometimes, if it is a little bit like, you know, the week last week, is a really slow flow news week, because everybody’s holding everything until RSA and so this also tends to be a week when things can fall through the cracks, if it’s not something that’s incredibly new or incredibly innovative that we haven’t seen before,

MF: Something else we’ve been discussing with clients as well as fellow reporters as well, is the idea of kind of a quiet period following RSA. Do you typically find that as a reporter? Because I know there’s always a flood of research reports announcements ahead of time, during the conference, but is that something you find valuable is when people try to set up, whether it’s post conference conversations or briefings or giving you that preview of research, you know, the week after RSA? When’s a good time to reach out to you for that?

JL: That is a good time to reach out. But I take a couple of days off. I think a lot of people take a couple of days off just because you need to slow down a bit after just all the, all the hustle of RSA, but definitely that week, and then even just the week after, I think, as opposed to the week before, you do have more time just to focus specifically on this person and this particular issue now, versus ‘okay, I have an interview with the source. I also am still scrambling to figure out my schedule at RSA, and all the embargoes that are coming out, and which one I’m going to cover which one I’m not.’ So it is, it is kind of a nice chance, you typically, I typically, have had a chance to take a breath and go into these with a little bit more broad focus. I’m not just so tailored on RSA anymore, so I think that is a good point.

CB: And then we talked about AI being a hot topic, of course, talked about geopolitical conflicts. What else do you think is going to be like another big thing coming on? Is anything surprising under the radar, maybe?

JL: I think that one issue that I’ve had some interesting discussions about is voice phishing and not I don’t know if it’s too under the radar, but I think it just is, still continues to surprise me that it is so effective when you see things like the newer AI focused attacks, that just picking up the phone and pretending to be an employee that gets you through a lot of times when you’re–

CB: Crazy.

JL: Yeah. And of course, AI does help with that too because it helps make learning about the company, that reconnaissance, a lot quicker. It also can, in some cases, provide scripts on the fly. So if the help desk says this, I can say this as an attacker. So that’s not to say it’s completely void of AI or any newer technologies, but I think that just how some of these seemingly old school types of attacks are still really effective, I think that’s something that continues to be a topic of RSA, and then I mean the boring, just the not boring, but just the basic security hygiene, I mean, that’s always an issue. It’s always going to be an issue, and it’s it’s really hard to avoid that, even though maybe it’s not as fun and exciting to talk about as some of the more AI tinted stories that we tell and hear about.

CB: I mean, you said you’ve been covering cybersecurity for 12 years, right? Like, so is cybersecurity hygiene, you’ve still been covering that like you, right? It’s still been such a huge theme throughout your career. 

JL: Right, right, right, definitely. I mean, it’s not if, if that was all taken care of, we wouldn’t have anything to write about. So I think that’s not going away anytime soon, which is unfortunate, but, yeah, yeah. Something, something to keep in mind.

MF: Do you have any predictions? Obviously, AI, very big theme this year. Do you have any predictions for what, you know, next year’s RSA might cover?

JL: I mean, I think it will probably be more AI. I’m curious to see how that evolves, because the models are becoming so much better and so much faster, just exponentially in the last three to six months. So looking out a year from now, it’s kind of mind boggling and really curious to see where we are and how much that technology has advanced. So I think that will continue to be a topic, but I’m not sure what it’ll look like. It’ll be it’ll be fun to watch.

CB: Yeah. So one of my favorite parts of our podcast is our listener question segment, and we’re excited to have so many listeners here today. So does anyone have any questions for Jessica?  Anybody? Yes, Dave Bittner has a question.

Audience Member 1 (AM 1): In the 12 years you’ve been at The Register, what are some of the things that you’ve seen really change over those years in terms of types of things that you’re covering and the things people are talking about?

JL: You know, it’s interesting. I don’t know if it’s, if it’s things have changed, but it’s almost a new slant on an existing problem. I think a lot of looking at the, the threat techniques are still the same. It’s still, we’re still talking about phishing, we’re still talking about things like that, but now it’ll have an AI angle to it, or, you know, SaaS, it’ll have here now. Instead of just breaking into into your on prem environments, now we’re breaking into the cloud environments. That’s obviously a big one that we’ve seen. And so I think it’s, it’s interesting to see how the attackers are able to change their business models as the technology industry also is is changing, and whatever the buzzy new technology is. Right now, it’s obviously AI how they like to focus on that too, like, like all the rest of us, and play around with that. Does that answer your question?

AM1: To follow up just in terms of the industry itself.

JL: Yeah.

AM 1: What are your insights on the evolution of the level of professionalism in the industry itself?

JL: Yeah, I think, I think that’s a big one. I think that it really has grown up over the last 12 years in a good way, I think, I mean. I think that it’s not, I think there’s a lot more professionalism. It still tends to be largely male-dominated, but we’ve seen a lot more women, which is good and needed, and so that’s been something that I’ve been happy to see over my time. 

I think that also it’s it’s more recognized as this is something that affects all of the company. It’s not just like, ‘here’s the security people in their little room doing their thing, we’re not exactly sure what,’ but it’s, it affects everything. I think it’s great to see the elevation of the CISO and CIO role. That’s, that’s a really positive for the industry, as it should be. It should be a C suite position. 

And just this, and even with the with the dialogue, I know one, one thing that actually, I think we’re missing this this year at RSA is the lack of the federal government speakers who were supposed to speak, and then everybody decided not to in January, but in general, I think it’s also been really encouraging to see over the years the increased dialogue between the public and private and that’s something that’s obviously needed. The private sector has access to a ton of great information, and and there doesn’t seem to be as much as of the proprietary ownership, and “I’m not going to talk to you, I’m not going to try to help you.” Even within the, you know, the private sector itself, just seeing companies working together more. So I think, yeah, there’s, there has been a level of maturity which is really positive.

CB: Yeah, go ahead, I’m gonna repeat the question to the mic, okay.

Audience Member 2: When you are getting sources in the industry, how do you hedge against, to be honest, like kind of an AI slop responses? I find, you know, I participate in these, and I see my peers also quoted in these articles, and it’s like and ‘so and so from this vendor reinforced what like this person’s’ and you know that’s happening because they’re all kind of prompting the same question. How do you deal with that now? Because that used to be like, a rich source of information. 

CB: I’m going to repeat into the mic because we’re recording. So how do you deal with the difference between the AI responses versus the human responses? And kind of get through to what that is? 

JL: Right. I mean, I like to think that I’m able to tell the difference. Maybe I’m not. I think that’s also why it’s nice to jump on a phone call with somebody, because you can tell a difference between a conversational response to your question versus something that has been heavily edited and sent through legal and sent through marketing and approved and anything off the bat, anything with certain jargony terms I try to just not use, on principle, but again, I think one way is just to talk to people. 

CB: Yeah, go ahead. 

Audience Member 3: So from a reporting aspect, how do you keep the context of cybersecurity fresh if we know that even the technology shift, a lot of methodology and with threat access, work tends to be kind of the same old hat?

CB: Yeah, how do you keep the cybersecurity perspective fresh when the attacks seem to be the same old thing that has been happening for a while?

JL: Yeah, that’s a really good question. I think that there’s, there’s always the timeliness element that’s important to any type of news story. But I feel like in cybersecurity, there’s always something new. There’s always someone who is being attacked, and I think getting into the details of that, even if it is, it was through a phishing email. I think the getting really into the specifics, you know, what was the lure? How did they do this? Who did they talk to? I think those individual details make it, make the story stand out a bit more than just it’s same old hack that we’ve been seeing for years. 

If you can show, show the details, and then I think also it’s important to show the human effect. And it’s not just this threat actor stole how many gigabytes of data, but these were people’s, these were cancer victims’ photos that they were using chemotherapy. I mean showing because I think we do have a tendency to kind of get numb, because we do see attacks every single day. And everybody, at this point, knows what ransomware is. Everybody knows that people are being extorted for a lot of money after their data is stolen. But showing the human element, I think, is one way to make make this more pressing and and just give it more impact.

CB: Great question. Any other question? Oh, yeah, in the back. 

Audience Member 4: How many or how much of the stories that you’re covering are based on planned research topics of interest, versus things that are reactive to events? 

CB : That’s a great question. How much of your coverage is planned and proactive versus the reactive coverage.

JL: I think that a lot of it starts with the reactive coverage, and these are the quick hit daily news stories that we write every day. But then, taking a step back from that and letting that show some patterns or some trends that are coming up a lot and that I would like to dive into a little bit more and figure out, “Why are these things, what’s going on with this?” I’d say, so, those are, those are the, you know, the more planned versus a reactive. Those are the ones that, personally, I like doing. I think those are more fun. Those the more analytical, the more feature-y stories. 

And as far as the balance of those two, it kind of depends on what is going on in the news cycle. If there’s a ton of news happening, then those are going to get pushed to the back burner, and they’re likely to take me quite a while longer to finally write. I’ll be slowly doing interviews for quite a while, and then I’ll finally have time to write it when, when the news cycle slows down. But at the same time, it’s good to always have a couple of those on the back burner. So if there is a slow news cycle, then I can go back to those. And sometimes it’s even just a matter of knowing someone who’s a great interview, and I know if I talk to them, they’re going to spark off a lot of different ideas and give me a ton of potential future stories to look into. So, but I mean, as far as a balance, it’s probably, you know, 25 are the more, 25% probably the longer, the more planned, the more analytical feature stories, and then 75% breaking news, daily stories. 

CB: Yeah, great question. All right, guys. Well, thank you so much for listening. Thank you Jessica for coming on and talking to us. We are the Inside the Media Minds podcast, and we are monthly on the CyberWire Network. Madison.

MF: Thank you all for listening. Hope everybody has a great rest of RSA.

CB: Yeah, and enjoy CYBERTACOS. 

Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/. 

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Matt Kapko, CyberScoop

On our special annual RSA episode of Inside the Media Minds, Christine Blake and I sat down with Matt Kapko, Reporter at CyberScoop, to chat about his plans for the upcoming RSA Conference from March 23-26, 2026.

Inspired initially by the book “The Rum Diary” by Hunter Thompson, Matt found an interest in writing at an early age and has now been in tech journalism for about 20 years. What started as covering the wireless industry in Hollywood, eventually led to his current role covering the ever-evolving cybersecurity landscape from all angles of cybercrime, ransomware, software defects and vulnerability management.

When it comes to journalism, “it’s a volatile industry,” Matt said. “I think with the thrill that I get just from chasing the type of stories that humanize how technology impacts all of us, I’m determined not to get complacent and keep challenging myself.”

The Day-to-Day at RSA

Matt summarized that his plans for RSA Conference this year will consist of keynotes, some panels, off-site events, threat intelligence briefings, along with one-on-one meetings with executives, analysts and cyber crime experts. He has a handful of themes he’ll want to talk about with these experts that will build the foundation for features in the coming weeks or months, including the latest cyber crime trends, activities from threat groups sponsored by China and North Korea, in particular, how defenders and government agencies are responding.

“It’s difficult to plan exactly what the coverage will be, but I have a hunch the war in Iran will dominate conversations during RSA,” he said. “I’m specifically interested in the cyber components of the conflict, and what the United States and Israel have done in the cyber realm to limit Iran’s capabilities or damage infrastructure.”

According to Matt, there is no replacement for meeting the people who are confronting and fighting these battles every day. Out of the hundreds of conferences he has attended throughout his career, his best coverage results come from what he hears off stage, in the halls, in meetings or after hours. Sometimes, it may be the shortest comment that inspires an entire series of stories.

Standing Out from Conference Noise

Matt does not plan to spend much time on the Moscone show floor except for meeting at his sources’ booths or snapping a few photos for his stories. For companies to truly stand out from the noise, he shared a few tips on pitching and the timing of research or company news.

Insight on what occurs behind the scenes or in live responses to attacks or emerging vulnerabilities is most important to Matt, as well as access to the sources who are willing to share direct knowledge of attacks that are timely or still having a serious impact. “So much of what happens in this industry is hidden or kept under wraps,” he said. “So, revealing those details, even if it’s on background or off the record, that’s always my goal.”

In terms of when to release company research or announcements, Matt warns against trying too hard to fit everything in during or right before the conference. “I just think too many companies make the mistake of trying to announce news or research during RSA, at least from a media perspective,” he explained. “I think that’s a mistake if you’re not a top player or announcing something that’s truly groundbreaking, that you can demonstrate and prove out at the show. It just gets lost or just ignored.”

As an alternative, one recommendation was to take advantage of the quiet period following RSA when most of the industry takes a breather. Matt even added that he is open to these kinds of post-conference conversations.

To hear more from Matt about the most memorable story from last year’s RSA, the topics he anticipates will loom over the conference this year and his “wish list” for keynote lineups in the future, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps:

0:22 – Christine and Madison’s Podcast Preview

2:16 – Matt’s Background and Role at CyberScoop

8:339- Prior RSA Experience

10:02 – Schedule Planning & Topics of Interest

16:56 – Tips for Pitching Prior to RSA

19:57 – Matt’s Opinion of the Show Floor 

21:20 – Timing News Around the Conference: What Works?

24:24 – Qualities of a Valuable Briefing

27:32 – Predictions for Top RSA Themes

28:48 – Most Memorable Story

30:28 – What’s Ahead for RSA 

Transcript:

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-hosts, Christine Blake

Madison Farabaugh (MF): and Madison Farabaugh.

CB: This show features in depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories.

MF: From our studio here at W2 Communications. Let’s go inside the media minds.

CB: On today’s episode, we are talking to Matt Kapko, a reporter at CyberScoop. Matt covers cyber crime, ransomware, software defects and vulnerability management. We talked to him a lot about his role at CyberScoop, but then we really dig into his perspectives on the RSA conference coming up in a couple of weeks. A couple of things I found really interesting, Madison, during this conversation was his perspective on timing for news around the show. He kind of reiterated what we already know, that news during the show can get really lost in the noise, and he recommends putting news out before, but mainly after the show, in that little quiet period that follows RSA. What were some of your favorite takeaways, Madison?

MF: Yeah, related to RSA. I loved hearing his perspective on how the conference might evolve in the future, and kind of his wish list for how it might evolve, whether that’s bringing in new faces, new speakers, and kind of diversifying who is promoted at the conference, and then I think readers will also benefit from hearing some of his interests outside of the conference, when it comes to scheduling meetings with experts. So, there doesn’t always need to be a, you know, time bound research report. Matt is very interested in getting to know new sources and really understanding their background, their expertise. So if that’s something an organization can offer, they should certainly reach out to Matt and definitely make that clear. And yeah, he’s definitely interested in that outside of the conference.

CB: Yeah, definitely. It was a great conversation with Matt Kapko, so we hope you all enjoy it. Thanks for listening.

CB: Hey Matt. Welcome to Inside the Media Minds. We’re happy to have you on today’s podcast.

Matt Kapko (MK): Thank you so much for having me on. I appreciate it.

CB: Yeah, we’re excited to hear more about you and your background and your journey to CyberScoop. So let’s start there. Can you give us a quick overview of your background and your role at CyberScoop right now?

MK: Yes, I’ll try to be quick. So I’ve been doing this a long time. I mean, I always enjoyed writing, starting at a young age, but never really considered it a career until I read The Rum Diary by Hunter Thompson. This was just as I was getting ready to move to Humboldt State University, now called Cal Poly Humboldt. It was his first book from his time as a young reporter, mostly in Puerto Rico. He just made it sound so fun and meaningful to me.  Journalism combines so many of my passions, my love for writing and learning, a curious mindset. I really enjoy just digging in deep into topics or themes, searching for unique stories, and just that ultimate goal of speaking truth with conviction as a bonus. It just feeds my punk rock spirit, enabling me to question authority, hold the powerful accountable, and I think it’s important too, just to demonstrate how so many systems are in place that keep people down. It’s their, it’s their purpose.

I’ve been doing this a long time. As I said, 25 years, starting at local newspapers, a news wire in the Bay Area, I got into tech journalism about 20 years ago. I was covering the intersection of the wireless industry in Hollywood. This was right when the first iPhone was announced, which is, it was a watershed, once in a generation moment I still believe that. Went on to cover wireless network infrastructure and the proliferation of software in these networks. Still a total geek for all things mobile, I find it fascinating. I’ve covered technology from many different angles now, including stints where I covered social media, enterprise, technology, networking, media, advertising and marketing. So, yeah, I’ve changed jobs, often, sometimes by choice, not always. But that’s, that’s something I’ve grown comfortable with. It’s, it’s a volatile industry. It’s, it’s brutal out there for most reporters because of that. And I think the thrill that I get just from chasing the type of stories that humanize how technology impacts all of us, I’m determined not to get complacent and keep challenging myself.

CB: Yeah, I love that. And now at CyberScoop, right? You’re covering cyber crime, ransomware, vulnerabilities, cyber security, in and out. What do you find is, you know, the most interesting part of that, that part of industry?

MK: Yeah, I’m I’m never bored. There is so much going on. I started covering cybersecurity about four years ago, almost by accident, and with a lot of luck. I was ready for a change at that point, a fresh start, just new challenges again in what is proven to be a hugely consequential industry. After almost three years at Cybersecurity Dive, I pursued a job here at CyberScoop. I’ve been here for a little over a year now.

My favorite part of the job is that I spend all of my time reporting and writing. It’s a privilege I don’t take for granted. More broadly, I think the best part of being a journalist, for me personally, is that I never stopped learning. Every day is different, and I’m often drawn to new opportunities. There’s so much to cover on my beat. Cyber crime is an epidemic, the motivations of technology are pretty out of whack, I think, and the foundations of technology that we all rely on are weak and proven to be pretty unstable. I think we all suffer some, in pretty shockingly heinous ways because of that.

MF: Now that makes perfect sense. This industry is just, it’s changing day by day. So I’m sure that is also something, when you were talking about, you know, your passion for the industry and speaking conviction and truth to your audiences. I guess that that’s probably something else that keeps you coming back to it. Can you dive a bit more into what your day to day looks like at CyberScoop, just with all of the different, you know, lenses of cybersecurity that you might be reporting on? Can you give us kind of a deep dive into how you split up your day, maybe how you, how you go through all of the pitches that you receive, and how you plan out what you’re going to cover throughout a week?

MK: Yeah, I think this is one of those cases. What’s the saying? Life happens while you’re making plans? It’s, I’m surprised often. So I’m in California, but generally work on a East Coast schedule, so I’m up early, catching up on whatever I missed overnight, checking my traps for new research, new attacks or new software defects that pose massive problems or appear to be. There isn’t a typical work day for me, and I enjoy that. Sometimes I don’t know what I’ll be working on until news breaks or I’ve got a tip to follow up on. But generally, my days are filled. You know, I’m talking and messaging with my sources constantly on signal, interviewing threat researchers and executives, and publish around four to five stories a week.

CB: Yeah, that’s amazing. And how do you, you know, go about finding some of your sources? I know you probably get a ton of pitches, right? You probably have people that you go back to time and time again, is there any kind of method to that madness?

MK: I’m not sure if there is a good method for it. I mean, I’ll talk to anybody, but I have to be selective, like you said. I get a lot of, a lot of incoming, so I think it’s just finding people that are that have something unique to share, or really specific to the beats I cover. So I, I’m grateful for the tremendous sources that I’ve developed over my career, and I’m always looking to expand on that. I’m not sure if there’s, yeah, a method to that madness, so to speak, it comes from surprisingly, surprising places pretty often.

CB: Yeah, I’m sure. I know, so when this episode comes out, we’ll be just, just about two weeks out from the RSA Conference, which huge cybersecurity conference. I know it’s top of mind for a lot of people right now, so we’d love to talk to you a little bit about that and your focus there. Yeah, how many years have you been attending?

MK: Yeah. It’s top of mind right now. So I first attended RSA in 2020, this was just weeks, maybe a week, before the world shut down due to the COVID 19 pandemic. It was just a weird experience. There was a bad feeling everywhere. Things were just off. Information was unreliable, let’s say. We had no idea what was coming. It was clear that things were going downhill pretty fast. I still remember the awkwardness of meeting people for interviews and having this like awkward pause. Should we shake hands then lather up with hand sanitizer? It was surreal. Anyway, that was, that was my first RSA. I’ve attended and covered the event every year since 2023.

MF: Wow, that’s amazing. Yeah, I can only imagine what that must have been like, definitely in navigating all of the different, I guess, social circumstances.

CB: I was at that one actually, I remember seeing the first person with a mask on, like the first time, and I was like, ‘Oh my gosh, what’s happening?’ And then, of course, a month later, everyone’s wearing masks, and that was the norm. Crazy.

MK: So fast.

MF: Kind of looking ahead to this year’s conference. What are your plans for RSA? And are there any specific topics you’re looking to cover, or maybe types of experts that you’re looking to meet with in person?

MK: Yeah, there’s a lot there. I think, first and foremost: stay hydrated, have regular meals, pace myself. It can be pretty grueling. My plans for the week include keynotes, some panels, off site events, threat intel briefings, and then one-on-one meetings with executives, analysts and cyber crime experts. I go into the event usually with like, a handful of themes and trends that I want to dig into when I’m talking with sources. I won’t give those away now. I’d rather save that for my reporting, but those typically build a foundation for features that I’ll write in the weeks or sometime months after the event, but more immediately at the event, I’m looking to cover the latest cyber crime trends, activities from threat groups sponsored by China and North Korea, in particular, how defenders and government agencies are responding to all that and much more.

Things happen, and we’re often surprised. It’s difficult to plan exactly what the coverage will be, but I have a hunch the war in Iran will dominate conversations during RSA. I don’t think it will be over by then, and a lot of awful things are going to occur before the show. So I’m specifically interested in the cyber components of the conflict, what the United States and Israel have done in the cyber realm to limit Iran’s capabilities or damage infrastructure. I also expect and hope to learn more about how Iran’s response to the bombing has materialized in cyberspace.

So my coverage is it’s it’s always a mixture of event coverage, insights from interviews on the ground. We go to these events, I think, to see the people who will be there, and there’s, there’s really no replacement for meeting the people who are confronting and fighting these battles every day. I’ve attended hundreds of conferences throughout my career. I think the best coverage and the real action happens off stage, in the halls, meetings, after hours, gatherings, and I try my best to capture all of that.

MF: Yeah, that makes perfect sense. It’ll definitely, I’m sure, ahead of the conference, in terms of reporter planning for meetings and on site briefings, how the war might impact a lot of, a lot of, I guess, planning and different topics for sure, and just kind of thinking about how you do go about planning your schedule. Is there anything that you’ve, I guess, learned from previous conferences, or maybe experiences that you’ve had where, you know, looking ahead to this conference, that it’s one of your favorite parts about showing up at RSA, versus, are there any parts where, ‘man, I hope I can avoid that type of experience again’, or maybe avoid that type of you know, event, or, you know, what are some of the lessons learned for you there?

MK: I think mostly just to stay flexible and willing to shift or pivot based on things that are happening or conversations that I have at the show. I try to be pretty open minded and not rigid about what I, you know, planned on going into the day that may change soon after the morning gets going. So yeah, with RSA in particular. I mean, I love San Francisco. It’s one of my favorite cities. I visit often. I have good friends and family there. So that’s a bonus to me. I know that town I used to live and work there, I just, I get a rush of energy and joy just, just being there. So that’s, that’s fun for me personally, but there’s, there’s a lot that I look forward to, meeting friends and colleagues in the industry, connecting with sources on a more personal level, perhaps for the first time, and then just, you know, getting that opportunity to further develop those relationships.

And then, of course, I think it’s just about taking it all in, right? Like learning as much as I can. The shortest comment I hear in an interview or on stage could be that little nugget for an entire story or series of stories. So, yeah, I try to stay limber, allow myself to be surprised, and cover those things quickly if I can, or at least make note of those ideas as they come up for follow up coverage. I often feel that the things that I learn at RSA will guide or reinforce the topics that I want to focus on for the next six months, if not longer. What I look forward to least is just lack of sleep. I think, you know, adrenaline kicks in, but recovery after can take a while. It’s a lot of work packed into three to four days.

MF: Yeah, you had mentioned before about making sure to stay hydrated. I remember at my first RSA Conference. I think the shoe choices that you make as well, at least, least for us ladies, the the first pair I guess, that I wore in the first day of RSA, when I went they, I thought these were broken in shoes. I thought they were comfortable. And then I was wearing them all day long, and I was like, Oh no, this is going to be, this is going to be a blister in the making, for sure. So, yeah, definitely.

CB: Yeah. I like your approach of staying flexible, open-minded and interesting to hear that that kind of informs the next six months of coverage or so. I think that’s an interesting takeaway.

MK: Yeah, I appreciate it.

CB: Yeah, when preparing for RSA, I’m curious how far in advance do you prepare your schedule and again, and we talked about you getting a lot of email pitches and stuff like that. How far in advance do you book these meetings?

MK: Yeah, so I have a like never-ending list of potential sources, people that I want to meet or speak with, and I’m always curating that, so I reached out to some of those a couple months before the show, especially high level people I know they’re very busy and tough to land an interview with, so I try to see if I can schedule time with them. I would say I began planning in earnest about six weeks out. I’m not sure if it’s the best strategy, because plans always change, the event organizers add major keynotes or reschedule things that I plan to cover, which makes me, you know, have to move around other meetings that I had already scheduled. So, there’s a lot of moving parts, and I know everyone is doing their best, so I think, I think most people are pretty receptive to those changes as they happen.

CB: Yeah, I feel like six weeks is a good healthy amount of time. A little bit of flexibility built in there, but being prepared in advance.

MK: Yeah, I try.

CB: I’m curious too, yeah, what do you think vendors, PR teams get wrong when pitching you for RSA, even outside of RSA, any kind of tips or things that people get wrong when pitching you?

MK: Yeah, I’m not, I think at the top PR professionals have to do their homework. This isn’t news to you, but just making sure that the pitches are relevant to some of my areas of interest. I don’t expect everyone to read or browse through my back catalog of work, but my beat is spelled out right there on the site. If it doesn’t have anything to do with cyber crime, nation state threats, software defects or vulnerability mismanagement, I’m going to ignore it in either archive or send that email to the trash.

So this goes beyond RSA, but I also don’t cover products, feature announcements or surveys. I just I want the real scoop, details about what’s actually going on in the wild. I respect the hustle that you all muster for this event. It’s tough. The best pitches are those that offer to connect me with top executives in the industry, threat researchers or analysts that have direct knowledge of attacks that are timely or still having a serious impact. I think that direct knowledge is key. If your client isn’t directly involved or doesn’t have firsthand knowledge of what went down, it’s, it’s not as valuable to me. In my reporting, there are a lot of experts in this industry, and I I’m confident everyone has their specialty, but some just try to cover too many lanes for that media coverage. If that makes sense.

MF: Yes, that definitely makes sense. And when reviewing pitches ahead of RSA, do you have a preference on, I guess, format for how to receive those? We’ve heard from some reporters before where they would prefer, you know, if it’s a PR person from a certain agency, maybe that person handles sending all of the researchers or executives who they represent, and kind of putting them in a menu type of pitch. We’ve also heard sometimes from other reporters, where they know that that PR person handles a specific client, so they prefer to handle kind of like a case by case basis. Do you have any thoughts there?

MK: Yeah. I mean, I think this is one of those cases where relationships matter. If I receive a pitch from either of you or somebody I’ve worked with in the past, I’m going to open it no matter what. So I think that’s just first and foremost, building that relationship. Just you know that history, it’s hard to put a price on that. I don’t have a strong preference, either way, on like individual outreach or a list of clients, but I think just one tip or piece of advice is on the pitches that include the list of vendors attending. It’s super helpful to me to know which specific people from that company are available for an interview.

CB: Yeah, that makes sense too, definitely. Do you spend much time on the show floor when you go to RSA?

MK: I. I don’t. Sometimes I’ll walk around the show floor, but it’s usually it’s, it’s for a meeting at one of my source’s booths. But what happens there, it’s, it’s not of interest to me for my coverage. I might take a walk around and take some photos of major vendors booths, just to have those on file for my stories down the line. But that’s about it. I think most companies, this is separate from the show floor, but I just think too many companies make the mistake of trying to announce news or research during RSA, at least from a media perspective. I think that’s a mistake if you’re not a top player or announcing something that’s, you know, truly groundbreaking, that you can demonstrate and prove out at the show, it just gets lost or just ignored. And I think that’s part of the challenge on the show floor too. It’s just too much, too much.

CB: We definitely agree with that. I know when there was, like goats, I was like I need to go look at the goats. But outside of that.

MK: Right.

CB: If there’s farm animals were there.

MF: Goats and puppies. Goats and puppies.

CB: That’s a really great point, Matt about not like, unless you’re a huge player, not announcing news at the show. Do you recommend before? How much? How far before? Or do you recommend after? What is your take on that?

MK: I guess either or just like, unless it’s, you know, right in the middle of the show, that’s just, that’s where it gets lost and unless it’s from a really big player. But I feel like we’re like, in research report season right now. There is so many reports coming out right now, and there may be that may be bunched too together as well. It’s, it’s really just tough sometimes to pick which to focus on, but, yeah, finding a way to spread it out so that reporters have time to absorb it, and of course, getting any of that information ahead of time or exclusives that, that makes it much more likely to lead to coverage.

MF: Yeah, and have you, have you found that typically, in terms of all of the reports that you’re receiving, do you are they usually front loaded ahead of RSA, or is there ever kind of a time period of, I guess, not that it’s ever quiet, but less pitching or less reports that you get post RSA. Like if a company was looking to stand out for, you know, as we were talking about, whether it’s announcements or reports and things like that during the conference, is definitely tricky. So getting that ahead of time. Is there any advantage to post-RSA catch ups, post-RSA research previews or announcement previews and things like that, or is it typically, you know, pre and post-RSA, is it an equal amount of noise?

MK: No, totally. I think there’s an opportunity after the event. I think most research firms are putting out research now leading up to the event, trying to get as close to RSA as they can to get that research out. But it gets pretty quiet immediately after the show. I think it’s just because most of the industry was there and they’re pretty beat and their plans have been executed, and it’s like, alright, let’s, let’s, let’s take a pause before we kind of gear up again. But yeah, that’s a great point. I do think that there’s an open opportunity there for really interesting research or pitches to come out after RSA.

MF: Wonderful. Yeah, that’s a super helpful tip for our listeners. And that’s definitely the kind of insight that they’re that they’re looking for, especially us as PR professionals, but also our clients. We always want to be working with the reporters who we pitch as efficiently as possible, and kind of what works best for them too. We always want to keep that in mind so that’s super helpful.

MK: Nice, very kind.

MF: And then kind of lastly, on just RSA planning front, I guess, in the briefings that you might schedule on site, or any quick coffee meetups and things like that. Outside of you know, the good scoop that you might get, the behind the scenes information, is there anything else that might come up during a meeting that for you, you go away from it and you’re like, okay, great, that was not a waste of time. And that could be something like you had mentioned before. Oh, you might get a sound bite that might inform your reporting for the next six months. So that’s definitely, definitely a point to this question too. So is there anything, I guess, outside of the immediate topic that they’re discussing on the interview that is really beneficial for you?

MK: Yeah, I think more broadly, just anything that helps me understand what occurs behind the scenes or in live responses to attacks or emerging vulnerabilities. It’s, it’s useful. So much of what happens in this industry is hidden or kept under wraps. So revealing those details, even if it’s on background or off the record, that that’s always my goal.

I appreciate people that can be candid in interviews. It’s on me, I think, to encourage or convince people to open up. But ultimately, it, it takes both of us to get there, right? So I usually get the sense early on in a briefing if it will be valuable, but still leaving open that possibility, like I was saying before, just like some little nugget, could lead to something much bigger. But, sometimes I meet new people and can tell right away that they’re just dying to share something interesting with me. So I love that, of course, and I understand this is a business, and I appreciate everyone has their opportunities, but I’m just less interested in learning about products or seeing demos unless it’s something truly special.

MF: Of course. Yep, yeah, that makes sense. And one quick follow up to that outside of, I guess, RSA, and outside of when, you know, companies will be pitching you research reports, do you have an interest in kind of those, you know, quick catch up coffee chats, outside of, outside of when something is, you know going to be published in two weeks, but just kind of hearing somebody’s background, or hearing what they’re looking into currently? Are you interested in those kind of meetups, you know, outside of events and outside of, you know, time bound projects that someone might be working on?

MK: Absolutely. Yeah. I mean, there are so many fascinating people that I have yet to meet, and I want to stay open to all of that. It makes no sense to try to cram this all into a, you know, three to four day event at RSA. So, yeah, always open to chatting with anybody, anytime, if it’s not at RSA, that could be a benefit. Gives us a little space and, you know, we can think about some, some broader issues and not be, perhaps so tired. But, yeah, totally, totally open to that.

I think it’s a, there’s a big opportunity to, when these pitches come to me, I really try to, you know, at a certain point I just know that I’m maxed out and can’t do any more bookings. But I try to schedule a lot of calls after the event. If someone’s reached out to me, and I really do want to chat with them, it’s, I think just it may not be this month, but let’s try next month that sort of thing.

CB: Yeah, you get more quality time that way too. It can be more beneficial than the craziness.

MK: Totally.

CB: Jumping into a couple listener questions before we wrap up. I know you’re not going to dive into any of the trends that your themes that you’re covering. We’re saving that for your reporting, but would love to hear of what some of the big themes that you think are going to be talked about at RSA. Obviously we have AI, probably a big one, agentic, AI, all of that, any other key themes that we should be tuned into?

MK: Yeah, I think one trend in particular is just that there’s a lot that we don’t know about malicious activity originating from China’s sponsored threat groups. I think I and others have sensed a hesitancy from US officials in some incident response firms to attribute attacks or widespread campaigns to China recently.

It’s important to call that out, especially in the case of some of these campaigns involved zero days that were exploited for over a year before they were even discovered. So, I think that might be glossed over a bit. I hope that I’m pleasantly surprised, and that’s not the case, but I do think it deserves more attention. I recognize there’s a lot of factors and considerations at play there. I’m being a bit selfish as a reporter, but I think we all lose sight of the bigger picture when we can’t authoritatively place blame where it belongs.

CB: Yeah, that’d be interesting to see. Another question you know, outside of RSA too, in your years of reporting, what has been one of the most memorable or interesting stories that you’ve covered could be a topic or an interview or a story.

MK: Yeah, one thing that just really stands out to me from the last RSA in particular was just learning more about the North Korean government’s expansive scheme to get operatives hired as remote tech workers. This is happening in the US.

CB: Thats wild.

MK: Its crazy. Its fascinating, its alarming, precisely because of how successful it’s been. I mean, jobs aren’t easy to come by. I’ve been there. I think most people have yet these operators, they’ve they’ve been hired en masse, on mass. One detail that still sticks with me from the last RSA, it came from researchers at Google Threat Intelligence Group and Mandiant. They’d said that North Korean IT workers had been hired, or almost hired, by the majority of Fortune 500 companies. I think that just puts the scale of the threat into clear view, right? They’re everywhere, including companies that you would think are best equipped to keep it from happening.

CB: Yeah. That was pretty shocking. I remember that too. Crazy.

MK: Yeah, it’s wild.

MF: And then I think our last listener question was, where do you see the RSA conference going in the future? So we’ve had conversations with reporters before, where they might be, talking about, you know, how the show floor might evolve, knowing that there is so much noise there, how they anticipate some vendors, you know, might move their events off site, or they might, you know, take a different approach to their booths. So do you have any kind of predictions on how the conference might evolve in the coming years?

MK: Yeah, I think part of this is my wish too, but I’m hopeful that RSA will undergo a shake up with Jen Easterly in charge now. I’d like to see more fresh faces on stage. There’s a lot of people that seem to get keynotes or major sessions year after year. I just, I want to see and hear new ideas from people that haven’t received the same recognition as others. And I think it’s time for RSA just to reflect the diverse community that it represents. So I’m hopeful on that.

CB: I like that. I like the idea of a nice refresh, some new perspective shared.

MK: Yeah, things get stale, right?

CB: Yeah, definitely. Well, Matt, this has been a great conversation. We appreciate all of your insights about your role at CyberScoop and your perspective on RSA. So thank you so much for coming on Inside the Media Minds. We really appreciate it.

MK: Thank you so much for having me on. I had a good time. Appreciate it.

CB: And we’ll see we’ll see you there in San Francisco. Madison and I will be there.

MK: Yeah, definitely.

CB: Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/.

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Kelly Jackson Higgins, Dark Reading

On this episode of Inside the Media Minds, our co-hosts Christine Blake and Madison Farabaugh get together with Kelly Jackson Higgins, Editor-in-Chief of Dark Reading and Vice President of Cybersecurity Editorial at Informa TechTarget, to learn about the Informa TechTarget merger, the 20th anniversary of Dark Reading and the future of the cybersecurity media landscape.

A veteran technology and business journalist with more than three decades of experience, Kelly currently leads editorial strategy across three major cybersecurity publications: Dark Reading, SearchSecurity and Cybersecurity Dive. Since the Informa Tech and TechTarget merger, her role has expanded, placing her at the center of a newly united media powerhouse. 

Building a 360 degree Cybersecurity Media Ecosystem

Kelly offered her perspective on how the merger reshaped not just internal workflows, but the editorial philosophy behind each publication. Rather than collapsing brands into one voice, Kelly’s focus has been on clarity, distinction and collaboration.

“We’ve been working together this past year as a group, the three brands, to make sure we’re distinct and not cannibalizing one another,” she said. 

Each of Informa TechTarget’s cybersecurity publications play a decisive role in this new ecosystem. Cybersecurity Dive is highly news- and newsletter-driven, designed for CISOs and executive leaders who need quick, actionable insights. SearchSecurity leans into deep technical analysis and long-form reporting for readers who want to fully understand emerging technologies. Dark Reading spans both worlds: covering breaking news, threat analysis and industry trends for everyone.

“What I like about the three brands working together is, even if it’s rare that we cover the same exact story, they are different stories. You’re going to learn something from both those articles, which is, I think, really cool,” Kelly said.

The Future of Cybersecurity Media

Kelly further shared how cybersecurity journalism is evolving under pressure from industry consolidation, artificial intelligence (AI) and changing audience behaviors.

“The media industry is tough right now,” Kelly explained. “But if you’re doing something unique, if you have a loyal audience, that still matters. People want to read what you have because you’re giving them something they can’t just get from an AI summary.”

Rather than chasing every headline, Kelly emphasized the importance of context, originality and being open to change, both for journalists and for the vendors trying to break into the news cycle.

“I think that’s part of what makes the media industry so fun and interesting, is that it is always adapting to what’s new,” Kelly stated.

Looking ahead, she is focused on growth: the growth of audiences, formats and collaboration across brands. Kelly sees the next phase of Informa TechTarget as both a challenge and an opportunity – one rooted in staying close to the cybersecurity community and honoring the publication’s legacy while pushing it forward.

“It’s an exciting and challenging role,” she said. “And I’m really excited to do more with it this year.”

To hear more from Kelly about the Informa TechTarget merger and what she’s watching closely in 2026, listen to the full episode of Inside the Media Minds or read the complete transcript.

Timestamps

0:22 – Christine and Madison’s Podcast Preview

2:03 – Kelly’s Role at Informa TechTarget

5:57 – Differentiating Dark Reading, SearchSecurity & Cybersecurity Dive

10:36 – Lessons Learned from a Complex Merger 

12:36 – Happy 20th Anniversary Dark Reading!

14:24 – Cybersecurity’s Evolution 

17:41 – The Evolving Cybersecurity News Cycle 

19:31 – Generative AI, the Cloud, and Other 2026 Security Priorities 

23:44 – Covering RSA vs. Black Hat as a Unified Team 

27:19 – What Reporters Need for Rapid Response

28:51 – Kelly’s “Publicly Hacked” Black Hat Story 

31:26 – The Future of Cyber Media at Informa TechTarget

34:15 –  Kelly’s Goals for 2026

Ready to listen to more from Inside the Media Minds? Find all of our past episodes here!

Transcript

Christine Blake (CB): Welcome to Inside the Media Minds. We are your co-host, Christine Blake, 

Madison Farabaugh (MF): and Madison Farabaugh. 

CB: This show features in-depth interviews with tech reporters who share everything from their biggest pet-peeves to their favorite stories. 

MF: From our studio here at W2 Communications, let’s go inside the media minds.

CB: All right. So, on today’s podcast, we have Kelly Jackson Higgins, who is the Editor-in-Chief of Dark Reading and VP of cybersecurity editorial at Informa TechTarget. She leads editorial strategy for the company’s three cybersecurity media brands: Dark Reading, SearchSecurity and Cybersecurity Dive. She’s an award winning veteran technology and business journalist, with three decades of experience, and reporting and editing for various technology and business publications and major media properties. 

This is a fantastic episode. We really loved chatting with Kelly. She had so much to share. I mean, we really dug into what the past year has looked like since the Informa TechTarget merger, and how each of the publications she oversees approaches their coverage in a different way. A really fun conversation. Madison, what was your favorite part? 

MF: Yeah, I loved hearing Kelly’s perspective on just how the industry and covering security has changed in the almost 20 years since Dark Reading first published its first piece. And I also liked hearing her perspective on how the CISO recognition and acknowledgement has changed. You know, back then, the CISO term, it wasn’t even really widely talked about. That position didn’t exist as much. But now today, of course, those are some of the most sought after perspectives that they’re looking for at these security publications. So, I think our listeners will definitely love to hear more about that. 

CB: Yeah, we also heard about their approach for RSA this year, so tune in for that. And then Kelly also shared a really funny, embarrassing story of her first couple years at Dark Reading back in 2007, so we hope you all enjoy this episode. 

Hey there, Kelly, welcome to the podcast. We’re so happy to have you on Inside the Media Minds today.

Kelly Jackson Higgins (KJH): Hi there. Thank you so much for having me. Christine, it’s great to be here. 

CB: Yeah, thanks for joining us. So we’ve had you on the podcast before, back in 2018. A while ago, and gosh, back then we talked so much about Black Hat, back in that August 2018, and it goes without saying, so much has changed since then. This year, 2026 marks 20 years of Dark Reading, and it’s been just over a year since the Informa TechTarget merger. So, I’d love to start the conversation there. Tell us a bit about the decision to merge these entities and what the past year has looked like for you. There’s been so much going on.

KJH: Yeah, thank you so much. Yeah, it has been a very big year. So, the what happened was year and a half ago now, every year ago now, our company, Informa Tech, which Dark Reading was part of, merged with Tech Target. So interestingly, Informa Tech also owned Industry Dive, but they were very separate from us. They operated a separate entity. So we never really met them. Didn’t work with them. But when the merger happened, we merged, basically merged, in my case especially, three different media companies into one group. 

So we brought over, we basically broke a lot of the silos, right? And suddenly you had TechTarget, the Informa Tech brands, you know, Dark Reading, InformationWeek, AI Business, all those folks, Light Reading, and then the Dive publications. So in January of last year, the Informa TechTarget executives created what we kind of called, like, different industry groups. So my job changed dramatically. I became the VP of the cybersecurity editorial team, which encompasses Dark Reading, SearchSecurity and Cybersecurity Dive, so I oversee the strategy for all three publications. I’m still Editor-in-Chief at Dark Reading, I’m also default Editor-in-Chief at Cybersecurity Dive, because in the merger, they kind of reorganized and lost their editor. So I also work with them on a daily basis. So I have, I wear probably a few hats. 

CB: That is a lot, that is a lot.

KJH: But bottom line, we, we now have this really, I want to say, like a powerhouse, especially, I mean, across the company. But of course, in my area, the cybersecurity side of things, we have the sort of powerhouse of the hottest brands, and I would say, are the rock star, journalists and editors, and we’ve been working together the past year as a group, the three brands to make sure we’re distinct and we’re not cannibalizing one another. 

Number one, number two, to also amplify one another’s content. We do projects together. I can talk a little about that if you want to hear about it. But really, I look at this group as sort of the 360 of cyber media. You know, you have three brands who approach things differently. We have very little overlap in our audiences, which I think is really interesting, even though we’re all kind of, you know, we want to target those CISOs and all the big folks, but also we do talk to different people, and we do it in different ways and different types of content. So, I think it’s a pretty complimentary approach, and it’s been really exciting to sort of evolve this group. We call ourselves the cyber media team. 

CB: Okay. And we love it.

KJH: We meet once a week, and we actually really, we have a really good, I would say, really good chemistry with the three brands among the three groups. I think we look at ourselves as a team. You know, obviously doing our own things, but also trying to support one another as well.

MF: Love that. And as you said, these three brands are definitely a powerhouse, and our team thoroughly enjoys working with each one of the individual brands, for sure. Yeah, we would love to hear a bit more about, kind of, how these brands are each different, how the maybe editorial approach is different for them and even the audiences that you all are specifically targeting. Could you elaborate a bit more on that?

KJH: Absolutely, thank you for that’s a really good question, Madison. That’s something we’ve been really working on refining over the past year. So, I’ll start with Dive, since they’re the smaller team of two. But Dive, you know, traditionally, has always been aimed at the CISO, C-level folks. They’re, you know, the very news newsletter forward, obviously. The newsletter comes out at noon et every day, so that’s 9am for Pacific Time executives and lunchtime, if they take a lunch break, for the East Coast, the idea being, you know, getting them the really important news that they need to know about and what they can do about it. So, I would say Dive, does not dive as deeply into the technology side of things, and is really talking to the higher level folks and cyber risk, CISO, C-level people. So every morning you know you’re basically triaging, you know, what those key news stories are that those folks need to know about in their jobs.

So that’s Cybersecurity Dive. SearchSecurity has had an amazing heritage of this deep look into technologies, long form content about trends, you know, looking at someone who really wants to do their homework about the industry, right? They really want to know, I have to know a lot about this agentic AI thing. I’m going to just really study this thing, right? They’ve always done a great job of that kind of that kind of content, and that’s something, you know, we’re still emphasizing. They’re also starting to do some news of their own, like in their own form of news analysis that’s a little bit different than the way Dive does things and the way Dark Reading does things. So they are expanding a little bit in that direction. They recently launched a newsletter called The Cybersecurity Insider that goes out twice a week. And then there’s a third issue on Saturdays that encompasses all three of our brands, which is kind of exciting. So we can, and we all do, share in our newsletters each other stories and things like that. And  that group, SearchSecurity is headed up by Sharon Shea, and she’s, she’s incredible.

Dark Reading. Let’s see. It’s been a long journey. Been around there since 2006, and in some ways, our mission has not changed. I would say it’s evolved a bit. So we’ve always been about sort of providing all cybersecurity professionals with breaking news, news analysis, technology trends, feature pieces. We’re really expanding into different types of content now, led by Tara Seals and Fahmida Rashid, are doing more more video content, which we were able to do as well on our website until recently, when it was able to support it better. So we’re experimenting with that a lot. 

And we’re doing, I think, Dark Reading, the difference with Dark Reading is we’re talking to all levels of the industry, right? We’re not just talking we’re talking to executives, absolutely, but we’re also talking to the security operations team. You know, these are the folks who are in the trenches. We do get more technical. We do help them, like, understand, you know, what the latest threat is, what they can do about it. I think the difference with Dark Reading we’ve always strived for is to have the sort of secret sauce we call it, or we try to provide context and analysis that nobody else is providing, right? We want to really lean into that and not just be writing about everything else, writing about everybody else is writing about. We really do try to, you know, add that extra to it, and also, every piece of content that Dark Reading writes is written for the audience and the audience in mind. We don’t write something just because this sounds cool. We want to sounds cool. We want to be like, what does this matter to the security operations team or to the CISO? Would they care about this? 

So that kind of, I would say, that’s the difference and the three what I like about the three brands working together is we all, even if it’s rare that we cover the same exact story, but when we do, there are different stories. So Cybersecurity Dive does a story and we do a story on the same topic. You’re going to learn something from both those articles and different things, which is, I think, really cool about it. We do keep each other apprised what we’re working on, so that there’s no, like, we’re not, like, reinventing the wheel, but we don’t say, ‘oh, you can’t cover that because, you know, dive is covering that, or dark reading is covering that’. We want to look at it from different lenses, and that’s what’s so great about our reporters. They’re able to do that, and the stories come out very differently, which I think is really interesting. And that’s a testament to this group of reporters and editors we have on all three brands. 

CB: Yeah, that’s amazing. And how you describe that really encapsulates the 360 view of cyber media, how you described it in the beginning. I think that’s a really cool approach. I’m sure it’s been there was a lot of adjusting when you first kind of merged together. Did anything surprise you over the past year? Kind of when you got used to the three different publications, these different approaches, what was the most surprising thing?

KJH: Yeah, I think what I really liked about this, it was, I’m not gonna say was easy, because no change is easy. A merger is really hard, and this was an especially hard one. I think most people would agree to that. But what I think I would surprise me in a good way, and it wasn’t always easy, was how the three media companies are learning from each other on how they approach things, and how we’re all having to evolve in this new world, and what we can learn from each other and how we can get better because of how the other, the other group, operates, right? We’re taking sort of the best of the, I guess, the greatest hits of all the three brands, right? And and using that in the business strategy. So I really appreciate that. 

I’m not going to say that was easy to do, friend, it was really hard on people, right? They were, you know, like, ‘Oh, no. What does this mean? You know, our way is wrong,’ you know. And I don’t think it was that. I think it’s more like, Okay, we you know, one thing I’ve always felt with, you know, over the years with Dark Reading, was we never should sit still. We should always be looking ahead. You know, the industry moves fast. Media has definitely gone through a lot. The media industry has gone through a lot. So, I’ve always tried to like, let’s look at the next thing. What’s the next thing we can be doing? Let’s not just sit here and be like, ‘Oh, we’re doing it great.’ This has been good for all of us to kind of sort of examine, you know, the ways we were working, the ways we were writing content, the way we were approaching things. 

And I think what surprised me was that as painful as that was, in some ways, it’s also been fun for people. In the end, yeah, everyone was a lot of people were hesitant about it, but I think the more we get to know each other, and the more we work together, then we realize this is actually really great for all three brands.

CB: Exactly. And it sounds like sometimes a challenge like that, can it really pays off. And from our perspective, it seems like it’s been going really well, and makes a lot of sense.

MF: You had, yeah, you had mentioned, you know, Dark Reading, starting in 2006 so just curious, we are coming up on about 20 years now of dark reading. Is there anything significant that your team might be doing to celebrate that, or anything, you know, the team is planning ahead for? 

KJH: This has been something I’ve been thinking about for two years, because I was like ‘we’re coming up on the 20th!’ So yes, we are. I’m actually getting ready to hopefully present to my team in the next week or so, we’re going to have a special content package that will roll out over the months. We did that at our 10 year. We did like 10. We use the number 10 as like strategic, but I think 20 is a little too much. So I’m not going to do these the 20 number, but we are going to do some special content, you know, between writing, video, podcast, and maybe bringing in some folks who used to work with Dark Reading. 

CB: Oh, cool.

KJH: The old industry pioneers who helped us get launched, like, get their take on things. We’re pretty excited about it. I’d like to have it culminate, hopefully at Black Hat with some sort of a celebration white industry folks to celebrate with us. We did that for our 10 year, and it was really it was really neat just sort of hearing from people, you know about their thoughts about us. We don’t know what people think about us, right? Are we doing this right? 

And then thinking hearing about how, you know, they saw us over the years and, you know, our early days. And I actually was just looking at our first issue on May 1, 2006 is on Wayback Machine. It’s hilarious. It’s actually great in some ways, but it’s also like, wow, this was a busy homepage. Hopefully some fun graphics and art to sort of look at where we were then and where we are now. So I’m really excited about it’s really nice to get to to look back at all the things we did, and the things we’re doing differently we learned, and all the people that sort of were part of that. So it’s pretty special time. 

CB: Yeah, I love that. That’s so cool that you have that and can look back at it. So, you know, looking at that 20 years you mentioned, like, the evolution of the industry, what are your thoughts on it? Like, back then? Like, how have things changed now? Everything’s AI. I mean, just what are your thoughts on the past 20 years of the industry? 

KJH: Yeah, I’ve been thinking a lot about that because it’s just an I’m in awe. Sometimes, some things, I think, gosh, I’ve been talking about this for 20 plus years. We’re still talking about the same tissues. But then I look back and, you know, back then it was really, you know, the CISO term was not well known. There were maybe, maybe a handful of CISOs in the world, and nobody really talked about it. It was all you it was all, you know, people. The industry was still really new, and so much of the the news was about researchers breaking things and exposing them, because there was no, you know, vulnerability disclosure programs back then. So it was like all these cool things that were happening, like HD Moore doing his month of browser bugs. 

And, you know, getting to see, like, you know, the things that he found in browsers that were broken and publishing them. And we were writing stories on that, Dan Kaminsky figuring out how DNS had a big, huge hole in it, and how that, like, break the whole internet and, and so those kind of things were exciting. There weren’t a lot of vendors back then. So, the products were, you know, very focused on firewalls, on premise, right? That was, was not a thing yet, right, really, right? It was more on prem, you know, you had your routers, you had your firewalls, and you were looking at, you know, PC security. You know, there were no BYOD back then, you know, it was, it was a different world. They were, you have your smartphones. It’s scary to say all this.

CB: That’s crazy. 

KJH: Yeah, yeah, I feel very old talking about this, but so the things you’re protecting were, you know, a little more close to home, but there were still a lot of the software wasn’t secure back then Microsoft kicked off its secure development lifecycle back then, so it was still new to like, you know, have secure software written at all. But in some ways, I laugh, because I’m talking about, oh, we talked about oh, we talked about browsers, but now we’re talking about browsers again, right? We’re talking as something we’re not necessarily always securing well, even though they’re more well built than they were back then. So I feel like we come full circle a lot. 

I mean, I wrote about AI 20, more than 20 years ago, and I thought, ‘That’s not new,’ but we really were using it like we are now. So it’s interesting, some things stay the same, but the themes, but I really feel like the industry is obviously massively bigger than it was back then. We were able to, what was nice in our role, was we were able to kind of pioneer a lot of things. Because we were the we were one of the first pubs, one of the first. And we were able to, kind of like, you know, we met all the pioneers in the industry. We profiled them. We, you know, learn from them. You know, just dug into it. We had, it was like a greenfield for us to write about stuff, whereas now, it’s a fire hose, yeah. 

And we are rarely are able to cover everything. Like, well, we don’t cover everything. We are rarely able to keep on top of most of it, I would say, to be honest, even with the, you know, Dark Reading’s, a little obviously bigger stuff than than Cybersecurity Dive, for example. But it’s still not enough people to cover all the things that are happening. So that’s really different. Those are probably the main things to me. But looking at that homepage, I was like, ‘something seems similar.’ 

CB: Yeah, full circle.

KJH: Yeah, yeah.

MF: Yeah. And that’s such an interesting perspective you brought up about just the number of vendors and the vendor landscape expanding so much. So I’m just curious, after you know, your experience of covering the security industry for so long, how has that shifted? Or maybe, where are there still challenges with organizations, vendors who are trying to break into that cybersecurity news cycle? Is there anything that, overall, this time, you know, people still need to keep in mind, maybe things that still need to be improved there?

KJH: I think it kind of all comes back to, you know, most vendors, if you look at their descriptions of what they do today, kind of send a little alike in security, right? They all want to be AI forward, which I totally get, and that makes total sense, you know, they want to be, you know, seeing the cloud, they want to give you visibility, they want to protect all these things. So I think it’s hard for them, I do feel for them, like, that’s hard to stand out. But I think what it comes boils down to is it’s always telling a good story. What is it that you do that’s unique? Or, what is it about your your company that’s unique? You know, do you have a founder who was, you know, had some, you know, pioneering role in the industry, or why this idea that you had, that started your company actually got you here? I think those kind of stories are important to tell, because it’s hard as journalists, I’m not as much in the day to day anymore, but I still get all the emails, and I know how, like it can be overwhelming. Everything starts to sound the same. 

If you’re getting pitches and you’re like, ‘I think we wrote about this already,’ you know? And how do you you know? How do you get past the noise, right? So I think it’s hard. I feel like it’s always all about show, and this is true for the media like, for us to show what we’re unique. What do we do uniquely, how we write stories, uniquely, that what we bring to the table that nobody else does. I think that’s probably true for vendors too, and I’m no marketer, but you know, I do know that I think that’s the hard part. You know, from the journalist perspective, sometimes weeding through what’s just marketing speak, and what’s real. And everyone kind of wants to know what’s real, right? They really do are interested in that. What’s the new thing? What’s the thing driving this trend or this, you know, this, this vulnerability, or this threat.

CB: And similarly, with so many companies coming out with various AI solutions. Like you said, AI forward. What do you think is the most interesting thing about AI right now, and how are the informant tech target brands approaching that coverage? 

KJH: Yeah, so you know when, when generative AI first popped, boy that hit hard, right? It was like we’re talking about then we were talking about every day. I think now we’re getting to that settling in point a little bit about what it can and can’t do, right? Talking about from the news side of things, I think there’s a lot of interesting aspects from, you know, for developers, how they can use it. And everybody wants to use it to make their job easier, right? But I think we keep coming back to the same thing that we’re not surprised by: You still have to be a human in the middle. 

And, I mean, we’re even, even as journalists, like, how do we use AI, right? You know, research, you know, we’re, we’re thinking about this all the time. You know, our company is very, is very AI forward. They want to, they want to be innovative there. And we’re figuring out ways where it makes sense for us to use AI. I think for in the security industry, there’s a lot of really good options for it in terms of, like, same for any job, just, you know, easing the manual labor part of your job, like, get, you know, making it more efficient. But I think you always still have to keep in mind it’s not a person, even though some people have come to name their Chat. GPT, oh, yeah, I have a friend who does that. So, you know, calls him Chad. If you do that, that’s great, but there’s still, there’s, it’s still not a person like, the person has to be in there. And you do see things when you mess around with, when you do, when you do your own like, searches, like ‘that’s not right, or this doesn’t look right.’ 

So, but I do think there’s a lot of capabilities there that this, that security vendors are starting to put out there, and security teams need like, there’s always been the same problem in the sock. There’s too many alerts, there’s too many things coming at them. What’s the real thing? What’s the real needle in the haystack that they have to focus on? And I think that’s where AI is going to be the biggest game changer for them, is to getting them to that point where they’re not missing the one thing that they need to catch. 

MF: Yeah so, that makes perfect sense. And kind of switching gears a little bit. But beyond AI, what, what other topics are really top of mind for you this year, going into 2026. Is there anything you know that’s new or emerging that you think we need to be paying more attention to?

KJH: I mean, obviously AI is going to be part of everything. I think every discussion you know, we can get annoyed by it, but it’s going to be there. But I feel like, for me, just watching the cloud evolution, and I say that, I mean, in terms of, like, people’s dependency on cloud applications, cloud infrastructure, it’s becoming more secure, but there is still becoming more of a target as well. So I think that’s going to be a really interesting space to see how that shakes out. We’re seeing some interesting you know, some of the cloud providers are getting more proactive and providing secure built-in security, which is great, but I think that’s going to be more of an area where organizations are gonna have to kind of remember, just because you know your provider is doing it doesn’t mean you don’t have to worry about anything. You still have to pay attention, right? So I think that’s going to get more from what I’m seeing. That’s going to be more of an issue this year. 

And, of course, just where folks can use AI to, both how to defend, and also how the attackers are using it as well too. So I don’t lean too much in AI, but that one I can’t get away from. I don’t know. I think those two things. I mean, you know, we’re sort of talking about quantum, but it’s still far enough away that I don’t think it’s, you know, really on front burner for people right now. But, yeah, that’s definitely something. And then, like I mentioned, browser security is becoming more of a conversation again, which I thought, ‘didn’t we already resolve that?’ And then identity security is the other one. I’m sorry, that one. That’s an important one. It’s funny, because that’s been sort of part of a lot of things, but it’s been pulled out a lot lately because of the cloud, I think too.

CB: Okay.

KJH: Identities floating around, they have machine identities floating around. You know, managing that seems like it shouldn’t be so hard, but it really is. So I think that’s going to be a place where people need to pay attention. I think we’ll, you know, we’re covering it. We’re keeping an eye on it.

MF: We’ve definitely been seeing a lot more clients and other vendors putting out more research around identity security too. So we’ll definitely be keeping an eye on that. 

CB: Yeah, one thing I’m curious about is when it comes to events, I know we’re, gosh, when this comes out less than two months out from RSA, what are you and your team looking to get out of major industry conferences like that this year, and how does the merger of these three entities impact that? 

KJH: That’s a really good question. We, so what we did last year, and we’re doing again at RSA and probably at Black Hat, we try to maximize our resources there, among the three brands, so we’re gonna have a crack team there and RSA. I think the shows are different. So RSA, because it’s so big, as you know, it’s like, everyone’s there, right? It’s more about getting behind the scenes of the market forces and threat trends that are sort of driving the industry. It’s really, I think there is a great place to get sort of a reality check of, you know, what’s really, what are the trends around the industry? What does that really mean for the cybersecurity professionals and folks who are, you know, tasked with selecting this technology and products, because that’s a big product show, right? So what’s, what’s, what are the things that they’re getting, you know, put in front of them, and what makes sense? 

So I think for our reporters that are going, they’re going to be digging into some of that, like, this is a chance to meet with everybody, almost everybody’s there, right? So you want to be able to get all your chances, face-time with everybody, and also to just really step back and go, ‘Okay, what’s the theme right now,’ this year, and every year, RSA has a theme. So whether it’s real or, you know, a theme, marketing theme, you know, figure it out like how that applies to what you’re seeing. And again, we try to do for Dark Reading and for SearchSecurity and Dive is we try to think about, okay, our readers, what is it they need to Know. So not just like, oh, this is exciting, because this is all over the show floor, but why would they care about this? Or is this something that they’re thinking about? 

So I think at RSA, there’s less news than a Black Hat, because Black Hat’s all the new stuff that’s, you know, coming out from the researchers. So this was our chance to, like, really innovate and dig into some of the trends in the industry and things that our readers need to know about in terms of, you know, product direction, strategy, that kind of thing, yeah. And then Black Hat, of course, you know, you’ve got all the latest policy folks there, the threats, attacks, technologies. There’s too much to write about there, so we’ll be, we’ll be covering all that. 

And I think I what I like about Black Hat. I like both shows. Black Hat, you’re like, This is the community of the industry, right? It’s smaller, a little bit smaller, still huge. Now it’s the community of the industry. It’s the people who help build this thing that are all there, you know, and they’re and they’re, you know, successors, all doing the same thing, trying to, you know, stay ahead of the cyber criminals and nation states as best they can. So, I think that’s always more exciting for people, just because there’s a lot of cool new things that come out. But I think all the reporters will be, you know, we do a really good job like divvying up who’s going to follow what, so we’re not like running into the same things. And if we do, we’re taking it from a different lens, but we’ll be strategizing and about that too. So both really hard shows, obviously.

CB: Yeah, and I think at the end of the day, it’s important to remember it’s your focus on what your readers want to know, regardless of trends, or, you know, anything that crazy that happens at these shows, that’s the, that’s the goal at the end of the day. 

KJH: Yep, absolutely. That’s what we have to keep in mind. I think that’s how we sort of our North Star, right? You don’t want to get sucked into, like, it’s easy to get caught up in all the, yeah, there’s just so much going on. You could easily lose your way if you weren’t keeping that in mind.

MF: Wonderful. Well, this has all been super helpful to know. Kelly, we do have a few final listener questions for you before we wrap up the episode today. So the first question kind of relates to the idea of rapid response. And as you went through towards the beginning of this episode, the difference between now, SearchSecurity, Cybersecurity Dive, Dark Reading, when it comes to things like rapid response for the security and tech industry. How can vendors, PR professionals, how can we best serve you and your journalists? Are there any misconceptions? Are there any challenges that you typically face where you just like to clear the air on that?

KJH: That’s a really good question. I feel like you should probably be asking my reporters, not me, this question. I’ll give you my experience with it. I think you know, having if you’re talking about a big news event happens, right? Yeah, absolutely. So one of the things we always appreciate is when we can get the right people to talk to quickly, right? I know that’s not easy to do in this industry. Everyone’s busy, but if we can get the right voices in the story, you know, we and we’re one thing that I know all three brands want to be able to talk to practitioners more. 

So, even customers of the vendors are super helpful to get that reality check for our audience, right? So as many of those folks that we can talk to, I think, you know, sometimes Dark Reading, we try not to use, like, canned quotes, you know, when I know that’s it’s nice to have that when you want to get perspective, we kind of use it for background, but we really want to talk to the person. You know, that’s kind of what we shoot for doing. And I think that’s true with with Dive as well and SearchSecurity is trying to really get on the phone with somebody, if you can. On the phone sounded very ancient; on teams or whatever, on Zoom, but you know what I mean. And sometimes it is a focus on people, but basically being able to talk to them, because I think it is more like trying to get that extra insight into what this really means. 

Because again, with this industry, there’s so much happening at once, and sometimes things can get, the important stuff can get lost in the noise. You might be excited by the fact that this is a this threat groups doing this again, but there might be some subtle difference on there that they’re doing that we need to raise for our readers to watch out for. So I think having the right people to available to talk to in short order is, I know that’s not an easy task, but that is helpful. Everybody’s on deadline, so.

CB: Yeah, that’s good insight. Another listener question: What is one of the funniest of moments that you’ve experienced at Dark Reading in the last 20 years. 

KJH: Okay, well, this is an embarrassing one. It happened my first year at Dark Reading. So this is 2007 mind you, before smartphones, WiFi was the Wild West. I had written a story. I had a scoop on this new WiFi sniffer that Robert Graham and David Maynor, who are two old contacts of mine, who had been in the industry forever, had built and they were going to demo it at Black Hat. So I got the scoop on it. This was actually at Black Hat DC, which is no longer but there was a DC Black Hat that I went to and they were going to demo, and I’d already written about the story. So I’m like, I’ll do another section. I’m like, I’ll go another session. I’ll just, you know, I’ve already written about it. 

So I was in the session, next door to where they were, and I you know, back then you should never get on the WiFi at a show. And I knew this, and I was writing about it, but I have, like, I need to check my email. So I quickly jumped on, and I quickly jumped off, and then about two minutes later, he was laughing next door. I’m like, Oh, they’re having a good time over there. Must be the session. Must be going well. And then I got back to the press room when I had this frantic text message from Dave Maynard saying, ‘Kelly, we need to talk.’ They had sniffed me on the WiFi and blasted my name and password onto the screen with all the other ones they found on on the WiFi. So back then, I had to call the IT department on my, I had a flip phone, and call them to, like, fix my to change my password, because I just blasted out. It just got blasted on the screen. 

This was back in the day, as the wall of sheep, you know, one, and I knew better, but I was like, ‘Oh, one second is not gonna matter.’ Well, I was so embarrassed. And then I realized that people were laughing because they saw my name on there, and those guys had to come tell me. So to this day, they still joke about it, which I think is funny, and actually wrote a column about it in our 10 anniversary because I was like, ‘the time I got publicly hacked,’ and it sounds so dumb now, because now you can do that, you can be on WiFi at a show back then, you could not do that. So I learned a lesson. I was also humbled, as I thought, ‘so cool’ writing the story and then got owned by the same tool that I wrote about. 

CB: It’s crazy how fast that happened too. You’re like, ‘Oh, just a couple seconds.’ Nope. 

KJH: You got it. You got it. They were like, they just were like, ‘how did you? ‘They felt really bad. But they were also like, ‘how did you?’ I’m like, I know. 

CB: Yeah, gosh. And then when it comes to kind of the future of Informa TechTarget, do you see any more acquisitions ahead, or do you foresee any other media entities combining at this point? 

KJH: That’s a really good question. I don’t know about the company’s plans. I do know that, you know, cybersecurity is a very strategic piece of the Informa TechTarget puzzle for the company overall. So, I know that we’re our brands are very important to that. There’s a lot of other pieces to it. Of other pieces to it as well. So I feel like we’re strategic for the company, which I think is great that gives us so much room to grow and to, you know, try new things, and, you know, work as a group, and also ensure that we keep our individual brands unique. 

And I feel like, you know, the media industry is tough right now. A lot of, there’s been a lot of consolidation, a lot of, you know, shuttered doors, etc, but I feel like our industry especially is still so relevant that there will always be room for some, for cybersecurity, media, even in the AI world. You know, obviously, traffic has been affected. The last year, we saw that coming, right? We knew that was going to happen. But what always stands out on the analysis that we do is if you’re doing something unique, if you have a loyal audience that matters, like people want to read your they want to read what you have, because you have something that they can’t just find an AIO, AI, you know, summary. But I think it’s always going to be, it’s an ongoing challenge to kind of make sure you’re paying attention to that. You know, we’re very, we’re very cognizant of it, and working very hard to make sure we still but even, you know, when Dark Reading started, for example, there was really no SEO, and 20 years ago, wasn’t really a thing, so we didn’t even have that. 

So for me, it’s not shocking to my system, but it’s also like, okay, we need to, you know, think about other ways to and the key is really keeping our audience, our audience engaged, and that we’re still doing what they need, we’re giving them what they need, right? I think that’s true for all three of the brands. We’re really leaning into that and trying to, you know, just, try new types of content, new ways we communicate with our readers, you know. So that’s definitely like, I think survival for all brand, all media, to be more, you know, open to change.

CB: Yeah, absolutely.

MF: I think that’s part of what makes the media industry so fun and interesting, is that it is always adapting to what’s new. I know we’ve had some guests on in the past talking about how even journalism, it kind of goes back and forth. You know, at one point it was podcast, now it’s videos, now it’s journalists creating their own almost profile or not, not necessarily in the same way as an influencer, but reporters making more of that profile on social media, on these different platforms. So, I think it’s very interesting to see how all of these different publications and some corporations are doing it differently, for sure.

And then our final listener question for you, Kelly, we’re about a month into the new year, so any professional or personal goals for you this year that you’d like to share? 

KJH: Oh gosh, well, I think you know, we’re now a year into this merger, so I really want to take us to the next level. The three brands grow each of them, their audience, their market, and make sure that we’re, you know, still complement each other, but also each growing in our own way. I think that’s really important. You know, there’s always new things we can be doing. I don’t want to just think we’ve done it all like there is no way we have. So I think that’s really important to me.

 And you know, I this 20 year anniversary has really made me think a lot about how, you know, thankful I am that I’ve been with this. I’ve been doing this for so long, even before I started Dark Reading, I was doing this. And you know, I’m always trying to honor my late friend colleague, and mentor, Tim Wilson, who co-founded Dark Reading, and his imprint on the brand is, remains the foundation of Dark Reading. And I’m really proud and honored to be able to lead it and grow it and now help this whole Informa TechTarget, cybersecurity, media portfolio grow. I think that’s a, it’s a, it’s really, it’s an exciting and challenging role. And I’m really, I’m excited to do more with it this year. I think that now we’re settled in where we’ll be able to do more things, and I’m looking forward to that. 

CB: Yeah, well said, Well, Kelly, this has been amazing. Talking to you, learning more about the merger and talking about the 20 years of Dark Reading. So thank you so much for coming on Inside the Media Minds today to talk about it with us. 

KJH: It was my pleasure. Thanks for having me. Christine and Madison. Was great talking to you. 

CB: Yeah, absolutely. Thanks for everyone for tuning in.

CB: Thank you for listening to today's episode of Inside the Media Minds. To learn more about our podcast and to hear from some of our past guests, please visit us at w2comm.com/.

MF: You can also subscribe anywhere podcasts are found.

Inside the Media Mind of Roberto Torres, CIO Dive

For our first podcast of the year and inaugural episode as part of the N2K CyberWire network, my co-host Christine Blake and I chatted with Roberto Torres, Editor at CIO Dive, to learn about the AI trends he’s paying attention to and hot topics he’s looking to cover in 2026.

From writing punk rock concert reviews in Venezuela to now covering enterprise technology, Roberto has always enjoyed telling niche stories and connecting with people who are passionate about what they’re doing. Naturally, at CIO Dive, Roberto has a strong focus on telling good stories on trends and areas of interest for Chief Information Officers (CIOs) that help them do their job better. “We are obsessed with the questions that CIOs are getting on the day to day, right when they show up for work,” Roberto explained.

One particular area that fascinates Roberto is the current pipeline for professional development within the technology industry, including where AI may be replacing jobs and where it is creating more. 

“There are some jobs that are going to be automated away,” he said. “But when you think about the net effect, we are creating a lot of opportunity in areas like data science. And companies are going to need people who know this stuff.”

AI Governance for CIOs in 2026

Roberto believes this will be a big year for AI governance, considering AI systems now live in nearly every organization, in the hands of employees and in interactions with customers. Organizations must ask themselves if their governance framework is strong enough to ensure their systems operate appropriately.

“AI has been billed as this tool that is plug and play. It is not. It is a very complex task to make sure that a technology like this reaches everywhere where it needs to in an organization.”

Over the past decade, the CIO purview has expanded beyond just technology concerns to broader organizational operations and business goals. In 2026, Roberto anticipates that CIOs will focus on scaling AI adoption, understanding to a deeper extent the intersection between employees and the tools that they use, potential points of friction, and the training/resources needed to ensure an efficient and secure AI management program.

“‘How do we survive this rising competition from a more tech savvy competitor over here? How can we use technology to open up new channels of revenue for the organization?’ Those are the questions that CIOs are going to get in 2026.”

Listen to the full episode or read the transcript to hear more from Roberto about how AI vendors can set themselves apart in a crowded market, how AI agents can help with cybersecurity skills shortages, key takeaways from Informa’s AI Summit and more!

Timestamps

0:21 – Christine and Madison’s Podcast Preview

2:25 – How Punk Rock Led to Tech Journalism

4:50 – Roberto’s Role at CIO Dive

6:57 – The #1 Question for CIOs

9:30 – How the CIO Role is Evolving

11:46 – How AI Vendors Can Set Themselves Apart

14:10 – The Human Element of AI Governance

17:19 – AI Trainings & Employee Feedback

18:46 – How Roberto Gathers Insights

20:28 – Hot Topics for 2026

23:12 – Breaking News Adrenaline

25:07 – Roberto’s Free Time Interests

26:02 – Goals for the New Year

Ready to listen to more from Inside the Media Minds? Find all of our past episodes here!

Transcript

Christine Blake (CB): Welcome to Inside the Media Minds. This is your host, Christine Blake. This show features in depth interviews with tech reporters who share everything from their biggest pet peeves to their favorite stories. From our studio at W2 Communications, let’s go Inside the Media Minds.

All right. Madison, so on, today’s episode of Inside the Media Minds. It’s our first of the year, and the first one on the N2K CyberWire network. We had the pleasure of talking to Roberto Torres, the CIO Dive Editor. Fantastic conversation. We learned a ton about him, his background and a lot about AI and how CIO Dive is approaching the topic of AI. One thing I really liked about this episode is how he talked about the governance aspect of it, and how during 2026 they’re going to be focusing a lot on the governance aspect of AI, and what that’s going to look like for CIOs. What did you find most interesting?

Madison Farabaugh (MF): I think, building off of your governance point, I really enjoyed hearing how a big focus in 2026 will most likely be training. So not just, you know, AI implementation, but also, how are C-suites and other teams responsible for AI? How are they going to be empowering employees to onboard AI? How are they going to do that securely and efficiently? So loved hearing that. Loved hearing his takeaways from Informa’s recent AI Summit. So I think listeners will definitely be keen to hear about that. And then lastly, I really enjoyed his take on tech talent and how that’ll be a big focus for him personally next year, and seeing how how companies are kind of grappling with some of these skills shortages, and then how they’re kind of overcoming that and looking for tech talent in the future.

CB: Yeah, it was such a fun conversation. We hope everyone enjoys it.

Hi everyone. It’s Christine Blake, co-host of Inside the Media Minds, here with Madison.

MF: Hey everyone.

CB: We’re excited for our guest today, our first guest of the new year. Here we have Roberto Torres, editor for CIO Dive. Roberto covers the software industry, data analytics and the future of technology. You live in Philadelphia now, right? And you come to D.C. often we heard.

Roberto Torres (RT): That’s correct.

CB: Yeah, awesome. We’d love to hear more about your background in media, how you got your start, what keeps you engaged, and a little bit more about your role at CIO dive.

RT: Absolutely. Christine, Madison, thank you so much for having me. My, I guess my story kind of begins with punk rock concert reviews, like something that you might run into with a lot of other journalists. You know, you just follow what is interesting. And so I was really connected to the rock scene in my hometown of Cabimas, Venezuela. And I just I started writing up reviews on my blog, and I fell in love with kind of having a story, telling a story for an audience that was really interested in something niche. I started studying journalism in my alma mater, the University of Zulia, and then quickly thereafter, I started working for the kind of the college newspaper. And there, I kind of got connected with all these different areas of knowledge. And I had a chance to speak with people from, you know, architecture or, you know, economists and people in political science, all these different experts, but the technology has always been a fascination for me.

So I moved to the US in 2015. I was working there at the university for a while, and when I got here to Philadelphia, I spent three fantastic years covering the local tech ecosystem, covering startups, mostly, and that’s how I got plugged into this whole universe of technology. And then in 2019, I joined Industry Dive, and I became the reporter for CIO Dive, a publication that’s focused on Chief Information Officers, covering the latest in enterprise technology, and I’ve been there ever since.

MF: That’s awesome. Yeah. Really appreciate the background there. And definitely that’s not, that’s not a background we always hear, so very cool to hear about the rock, the rock experience there and then how you’ve now ended up in the world of tech. And so we saw that in 2022 you had transitioned from mainly that reporting role at Industry Dive to now more of an editor role. And so what did that transition look like, and how do you split your time currently? And what would you say separates CIO Dive from the other industry dive publications, as well as broader other tech security publications?

RT: Sure. So that transition, I mean, it kind of happened naturally. I got obsessed with my beat, and I got to know really well all the sort of services, and I, and I was very connected to enterprise technology leaders. And, you know, once we started bringing on other folks into the team, and kind of our team grew, I grew curious for, how do you shape publications’ voices. Like, kind of those more big picture questions. And that’s when, right around the time, I started kind of splitting my time. I still, I was still writing stories, but also working with other reporters, helping them hone their craft, helping them develop their sources. And that was a really interesting exercise for me because I love connecting with people who are passionate about what they’re doing.

And I am still kind of splitting my time. I write about two to three stories a week, but mostly working with my reporters and freelancers, helping sure, helping make sure that the publication tells kind of a cohesive story about what’s going on in enterprise technology. For your second question, you know, CIO Dive, our sharp focus on Chief Information Officers, we are obsessed with the questions that they are getting on the day to day, right when they show up for work. What are the questions that are landing on their desks? And we’ve been able to tell, you know, really good stories and identify specific trends, specific areas of interest for CIOs that help them do their job better.

You know, especially as we’re kicking off the new year, this is a time when we’re looking ahead at what are the questions that are going to be asked, what are the trends that we’re kind of trying to identify to make sure that CIOs, when they show up to go to work and they’ve read our daily newsletter, they have an opportunity to be refreshed and just get a sense of what’s going on out there?

CB: I love that, so I have to ask now, what is, what do you think is the number one question CIOs are getting asked?

RT: Well, so all of 2025 was basically from the CEO on down. Every single executive has had to have a really cohesive answer for the AI question, right? How do you do it? How are you implementing it? How is this going to save us money? How is this going to help our company run better? And I think all of, all of 2025 was really focused on getting a return on investment, right? There’s been several years of experimentation. Companies are trying to figure out how they’ve deployed this stuff, but 2025 was focused on paring back on the use cases that didn’t work. 2026 is going to be big on AI governance, right? These systems are already live in every single organization that you come into contact with. These systems are already in the hands of employees, already interacting with customers. And the question is, do organizations have a strong enough governance framework to make sure that those systems don’t go awry, to make sure that those systems are operating appropriately?

And I think CIOs this year are going to be really, really focused and on scaling adoption now that those tools are in the hands of employees, how do you make sure that adoption levels are where you want them to be? I don’t have the answer to those questions, because I’m not a CIO, but I think a huge focus is going to be on the human element, the intersection between humans and the tools that they use, and what are the kind of points of friction? We’ve heard from from different executives, that having the, you know, this, this really intense focus on things like training and making sure that that people have the resources and the tools that they that they need, is going to go a long way, because AI has been billed as this tool that is plug and play. It is not. It is a very complex task to make sure that a technology like this reaches everywhere where it needs to in an organization.

MF: Now, that makes perfect sense, and that kind of ties into what my follow up question was going to be in terms of the conversations you’ve been having with CIOs, some of these stories that you’ve been closely following. You mentioned, you know, AI adoption and implementation, that’ll be a big focus for next year and how they go about that. Have you seen conversations about how the CIO role is changing and evolving, and what has really stood out to you in some of those conversations?

RT: So, what one thing that’s really stood out to me is that CIOs are getting roped into more conversations now, right? A few years ago, the the narrative was the CIO is gaining a seat at the table. And I think the current thing is that they want the CIO to be at every single table, whether the discussion is about the employee experience, whether whether it’s a customer facing project that we’re talking about, or  whether it’s cost. CIOs are fielding a lot of questions about costs because these tools are very expensive, and I think the purview of the CIO is continuing to expand. It is gaining kind of a bigger outlook as to how an entire organization operates, not just technology. They are fielding more and more questions that are not directly related to how a technology operates, but what it actually does in terms of the business goals of a company.

And, we’ve been seeing that change kind of play out long, long ago, that the figure of the CIO was kind of a back office function. It was someone who got asked about, you know, the office phone and, you know, the fax lines. And we’ve witnessed in recent decades, you know, I would say over the past 20 years, that conversation as more systems become digital, as digital becomes a bigger part of company operations, the questions are strategic. How do we survive this rising competition from a more tech savvy competitor over here? Or, how can we use technology to open up new channels of revenue for the organization? Those are the questions that CIOs are going to get in 2026.

CB: No, those are good points and good questions, and it’s interesting too. Like on the vendor side, we’re seeing and hearing so many companies. It’s like, every single day there is a new agentic AI company and new agentic AI solution. And I’m just curious your take, because I’m sure you’re exploring a lot of these and kind of helping CIOs like learn about them through your reporting. How do you think this will really change the market, and how should all of these different AI vendors set themselves apart?

RT: A really interesting question. One thing that I’ll note is that I’ve been seeing a lot of kind of incremental developments from these big providers, right? It feels like the frequency at which companies are launching then relaunching tools is just dizzying, and CIOs are having to make sense of all that. Is it worth ripping apart the system that we’ve just spent a lot of resources building up to now come and add this this new capability, is this crucial enough? And there’s a couple of pieces to that from from the vendor perspective, like, how can they set themselves apart? One is just focus on the return on investment, which is the big question that we hear CIOs fielding. If I invest up front on this technology, what, what is the the the eventual outcome for for me and my organization?

But, the other piece of that that I think is really challenging is the human side. And I’ve heard from a lot of professional services firms that they’ve launched stand up solutions and programs to help organizations adopt AI to guide them through that journey that involves so many different moving pieces. And I think if some of these providers can, you know, help connect the thread between an organization and the tools that they need. And how do you make that sticky in a way? How do you ensure that employees don’t see these AI tools, as, you know, just something that got pushed on their computers, that kind of showed up one day in the enterprise tool belt, but something that’s going to enable them to succeed? Maybe a closer focus on on tech talent development, right, on the the increasing access to to the skills that that are needed to make sure that the AI systems are deployed. That’s something that I think could be a differentiator.

CB: Okay, I see, Yeah, that was one of the questions we were gonna ask you about too. Is, how do you think AI agents perhaps can help with cybersecurity, skill shortages or resource constraints, that kind of thing? And it sounds like there’s definitely room for that, but there’s also that human element, where the human has to, kind of help through, help people, help companies through that journey, and help them be successful with that human element as part of it.

RT: Yeah, definitely. You know, I just came back from the AI summit in New York. It’s organized by by Informa, and a lot of the questions that were asked were about the human in the loop model, right? You set an AI agent, and you create some guardrails, and you assign a human to make sure that that nothing gets broken. But more and more, there are questions being asked about this. There are kind of detractors to this model, where maybe a task can be performed efficiently, but the agent is either having access to data that it shouldn’t have had or, or, you know, breaking away from a preferred method for fulfilling a task.

The bottom line is that AI agents need clean, clear governance, and without the right governance framework in place, organizations are going to run into a lot of issues, deploying these, these systems and kind of letting them run wild. And it’s a it’s a management issue too. If you say that AI agents are going to be, you know, multiplying across the organization, but you need a human in the loop, then, at which point does that not become sustainable? So these are very, very complicated questions that CIOs are going to be fielding. I know that I’m going to be asking them for for their take on all of this in the coming year.

CB: Yeah, it’s certainly a super hot topic, and I love the perspective that you’re taking at CIO Dive with the CIO perspective. I mean, it’s so important to help them navigate that, and it just seems like such an overwhelming time to be a part of all these AI companies and seeing it all happen and play out in real time.

RT: Yeah, absolutely in cybersecurity. You mentioned cybersecurity, that’s a huge concern too, right? There are questions landing on the CIO desk about cybersecurity that they didn’t used to get because AI brings its own set of question marks around cybersecurity, right? You are having processes automated, and you’re having your I believe the expression is kind of an increased attack surface where you have bigger, you know, increased access to these very sensible databases by systems that could be compromised. And that, that’s another part, that’s another piece of the governance puzzle that executives are going to have to solve, and that that they’ve been trying to solve. This isn’t a this isn’t a new problem, and AI isn’t necessarily a new tool, but a but AI tools have are gaining new capabilities, which are making everything more complex.

MF: Yeah, this makes me think back to your comment earlier about training, and I’m sure in 2026 that’ll be a big theme as well, between trainings or tabletop exercises. I’ll be very curious to see how CIOs, CISOs, and, you know, broader, in terms of the C-suite, how they’re going to go about, I guess, implementing more training for AI adoption, you know, across an organization, versus just in a certain department.

RT: Sure, and it’s it’s about training, and it’s about exposing workers to the way that things should operate and getting a clearer, I guess, channel of communication between employee needs and the things that these new tools can do. Again, I was in the covering one of the talks during the AI summit last week, and I heard from from Paramount, for example, the CIO of Paramount talking about AI road shows. Basically, once they identified a few use cases that worked, it would take, you know, bring these use cases across different parts of the organization. Here is what AI can help you do and using that feedback to say, okay, we either have to shut this down, no one thinks this is helpful, to we need to scale this immediately to everyone and then everything in in between those two, you know, opposites, right? Using employee feedback to guide enterprise AI tool deployment is absolutely critical, and something that we’ve heard from from CIOs very, very frequently.

MF: So in terms of how you gather, I guess, insights from CIOs, what does that typically look like for you, and your process for you, know, reaching out to sources? Or is there any particular way you like to be pitched when it comes to whether it’s research or experts to speak to? What do you prefer?

RT: Sure. I love CIO conversations in person, and this year, fortunately, I’ve got to do a lot more of that than previous years and just traveling to events and having an opportunity to look at folks in the eye and asking them questions. You know, seeing stuff stuff that you can’t see, maybe necessarily over a phone call. So interviews in person at events or otherwise are fantastic, and I love them. I love speaking with people actually doing this job directly.

And then, you know, I love hearing from companies on research that they’ve done, especially if they’ve spoken directly to technology decision makers, and seeing what are kind of the trends, and especially what are the changes, the changes that they tracked over time. Like, tell me what it was last year and what it is this year, and kind of seeing that variation and having a way to formulate theories, or just ask questions about how, you know, what drove this specific change.

I love pitches like that that tell me about a a changing element in in CIO land, so to speak, and and we do a lot of outreach. We try to speak with CIOs at especially at enterprise companies that we know are dealing with the kind of scale that their peers are, so they will have useful things for executives in other similar organizations.

CB: And that’s great to know, outside of AI and the governance and all that stuff that you talked about, are there any other like hot topics you’re covering here in 2026 or that you’re looking to cover, any other trends you’re seeing?

RT: A couple, a couple of things. Listen, I’m obsessed with tech talent, and I think that comes from my time covering the local startup ecosystem because I saw what a technology job can do for people. It can very much transform their lives, right? Some people have started a company and then gone on to great success and learning about different areas of life. And I just think tech is such a fascinating pipeline for professional development, so but the thing is that CIO is really grappling with with access to tech talent, and it’s been a long standing issue where there’s, there’s just in certain categories of technology, especially now there aren’t enough people to fill these, these roles.

I think there’s been a lot of kind of hysteria about AI replacing jobs, when a lot of what we’ve seen is actually more on AI kind of job creation in some pockets. There are some jobs that are going to be automated away. We know that, but, but when you think about the net effect, we are creating a lot of opportunity in areas like data science. And you just you companies are going to need people who know this stuff. And so anytime I talk to a CIO, that’s one of my kind of staple questions. I’ve been asking that question, I guess, for a decade now, because if you include my time covering the startup ecosystem, how do you get access to the talent that you need to do these fantastic things you tell me you want to do in your organization? That is something that I’m always fascinated with, especially when companies kind of stand up concerted efforts to upskill the workers that they have.

One common, I guess, piece of advice that I’ve heard on AI adoption is that if you have an employee that is naturally curious and naturally savvy about your company’s business, you can then take that kind of institutional knowledge and pair it with AI training, and then magically, you have someone who is bringing the best of both worlds to a specific position. That kind of experience I’m really, really interested in. And any time any company that has something like that, I want to hear about it.

CB: Well, no, that makes sense. And it’s like the AI space is changing so fast, you have to have people who are passionate and willing to learn and adapt to it. So no, that’s that’s good to keep in mind. Well, we’ll definitely watch your coverage in that area too, of course.

RT: Thank you.

MF: Yeah, I was going to ask for an example, it could be on that topic that you just mentioned, or another one of maybe somebody you interviewed who really stood out to you, or maybe the story that you ended up producing from it that has been one of your favorites over the past year. What has been most surprising or fun for you to cover in that regard?

RT: Well, listen, you asked about fun. I think I have a lot of fun when there’s breaking news happening. That’s the first thing that comes to mind. There’s kind of an adrenaline and every reporter is a little bit of an adrenaline junkie in that respect. You love to, obviously, getting scoops is fantastic, but then if something breaks and you want to respond to it, I really like the fact that CIO Dive has this approach where we’re able to get news out there and then we’re able to come back with a day two story to kind of produce something that’s tangible advice for CIOs. How do you respond now to this thing that we just told you about?

So one of the areas we’re going to be closely watching this year is AI regulation. We covered earlier this year a trio of executive orders from the Trump administration on AI. We’re closely watching a recent announcement around state AI laws as well. That that’s a topic that I think is going to have some legs but, but I always have fun with anything that’s that’s breaking and also, you know, we’re CIO Dive, obsessed with the Chief Information Officer, and we love personnel news. So appointing, you know, high profile appointments at large organizations, that’s something that that’s always fun to cover.

CB: Yeah, is there ever a time you can combine CIO with punk rock coverage?

RT: That’s a great question. I’ve been trying to interview the CI, this is a quick plug, but if you’re a CIO at one of the guitar make, making, the guitar design firms, talking Fender, Gibson, I want to talk to you, just putting that out there into the universe.

CB: We’ll see what we can do. We might have some connections. I don’t know.

RT: Okay.

CB: That’s so fun. Another listener question that we have for you. How do you like to spend your time when you’re not writing or editing for CIO Dive?

RT: I work really hard, so when I’m offline, I like to spend time with my family, my wife, my sister. I enjoy a good Netflix binge sitting. I’m very much looking forward to the new Stranger Things, Christmas morning. And I’m a hobbyist musician, so I play guitar and cuatro, which is the national instrument of Venezuela.

CB: Cool. That’s awesome. I’m also looking forward to the Stranger Things latest release on Christmas.

RT: Very exciting.

CB: Yeah.

MF: Awesome. Well, we have one final listener question for you, Roberto, because you will be our first guest of 2026, so kind of ending it on a fun note. Are there any goals you have for this year, and that could be professional, that could be personal, you can take it however you want it, but what are some goals you have?

RT: That’s a, that’s a great question. I I want to become a more organized note taker, and I think part of it is going to be, you know, maybe counterintuitive. Intuitively, I want to take more notes by hand and have kind of like an organized system for making notes that don’t live in the digital, very noisy world of our computers, right? So I might have to pick up a special notepad for 2026.

CB: I like it. No to the Google doc notes, and hello to the pen and paper. That’s awesome. Well, thank you so much, Roberto, for coming on our podcast. It was great to get to know you better, more about CIO Dive, what you’re covering, all things AI. So really great to hear from you. Thanks for being our first guest in 2026.

RT: Of course. Christine, Madison, thank you so much for the time. I really appreciate it. It was great to talk to you.

CB: Thank you for joining us on today's episode of Inside the Media Minds. To learn more about our podcast and hear all of our episodes, please visit us at w2comm.com/podcast, and follow us on Twitter at Media Mind Show, and you can subscribe anywhere podcasts are found.

N2K CyberWire Network Welcomes W2 Communications’ Inside the Media Minds Podcast

Podcast provides unique media perspectives from the top technology and cybersecurity reporters 

MCLEAN, Va., January 13, 2026 – Today, W2 Communications, leading marketing and strategic communications agency, announced the launch of the Inside the Media Minds podcast on the N2K CyberWire network, the leading B2B media network providing concise intelligence-driven news and industry commentary.

Since its start in 2018, Inside the Media Minds offers an inside look at the inner workings of the technology media landscape through candid conversations with hosts, Christine Blake and Madison Farabaugh. The podcast provides listeners with direct access to what’s top of mind for journalists on the frontlines of the technology industry, including insights into major tech topics, current events, tips for smarter storytelling and how to cut through the noise. This partnership with N2K CyberWire will allow the podcast to expand its reach, deepening its connection to audiences interested in the intersection of technology and media. 

“Joining the N2K CyberWire network marks an exciting new chapter for Inside the Media Minds,” said Host and Executive Producer, Christine Blake. “I’ve always admired N2K CyberWire for their ability to provide important industry insights in a smart and entertaining way. We’re thrilled to partner with them to strengthen our connection with listeners and elevate our conversations with the reporters who shape the narratives.”

After more than seven years and 100 episodes, Inside the Media Minds has featured influential journalists across broadcast, radio and print. The conversations have evolved from cloud security, GDPR, privacy and data breaches, to the COVID pandemic, remote/hybrid work, ransomware, election security, critical infrastructure concerns – and now, how the industry is working and adapting to AI. 

“We’re proud to welcome Inside the Media Minds to the N2K CyberWire network,” said Peter Kilpe, Chief Executive Officer of N2K Networks. “Their perspective on how technology stories are shaped and shared adds depth to our mission of delivering curated, high-impact content that helps leaders stay informed and ahead of the curve.”

The first episode of Inside the Media Minds on the N2K CyberWire network features CIO Dive’s Roberto Torres and is available now on the N2K CyberWire website and wherever you get your favorite shows. The episode explores Roberto’s background in journalism, his current role at CIO Dive and his thoughts on AI in 2026.

New episodes are released on the second Tuesday of each month. Subscribe and follow Inside the Media Minds on N2K CyberWire for updates on upcoming episodes.

About W2 Communications

W2 Communications is a fully integrated marketing and strategic communications agency that supports its clients across the entire spectrum of fueling go-to-market – including public relations, demand generation, creative, SEO, custom research and more. Our team of expert storytellers supports clients across B2B and B2G with an immense depth of targeted experience in supporting cybersecurity, public sector, space and satellite in both marketing and communications. To learn more, visit www.w2comm.com.

About N2K Networks

From news to knowledge, N2K delivers critical industry insights, strategic intelligence, and performance-driven learning products that empower cybersecurity professionals to adapt, grow, and lead with confidence in an ever-evolving industry. Trusted by the most influential leaders and operators, N2K collaborates with the world’s top training and knowledge platforms, and partners with organizations ranging from Fortune 100 enterprises to fast-growing startups. N2K and its brands like N2K CyberWire connect the cybersecurity ecosystem and help security businesses and professionals grow.

Visit N2K.com to discover more about our learning products and enterprise offerings. Sign up for our industry leading podcasts and newsletters at N2K CyberWire.