What CISOs say on podcasts and webinars

What the four sources are

This explainer draws on four documents. They are a small sample, and they cannot show what every CISO says in public. Each one is a podcast or webinar page published on the site of a company that employs the CISO involved.

The first is a transcript of a Mitel podcast, "We're In!" Episode 56, with Mitel's CISO Bill Dunnion. The page carries no date. The host asks Dunnion about the CISO role, regulation, AI, supply chain and community work.

The second is a page for Episode 50 of the Ncast podcast from Ncontracts. The page gives a summary and a list of chapter titles, not a transcript. Because of that, this guide can report the topics the page lists but not what the guest said on each one.

The third is a Gathid blog post dated September 24, 2026. It is a short note pointing to a podcast with Gathid's CISO, Craig Davies.

The fourth is a GoTo post dated February 7, 2024. It summarizes a webinar with three security leaders and a moderator who is GoTo's Chief Marketing Officer.

Vendors and the supply chain

Vendor risk is the clearest shared subject. The Ncontracts page says Clay Carter discusses why breaches at financial organizations so often begin with a trusted vendor instead of a direct attack. One chapter is titled for vendor questionnaires and trust, and the page also lists a chapter on getting an enterprise AI agreement.

Dunnion talks about the same problem from the side of a company with many suppliers. He says the number of suppliers at Mitel would be measured in the thousands. He asks how a security team knows it is asking all the right questions and getting the right answers. His answer is to rank suppliers by risk.

He gives a contrast. A supplier of pens and paper with no connection to the IT environment is low risk, and he describes a managed service partner with broad access as high risk. The high-risk suppliers, he says, are where due diligence should be focused.

The GoTo webinar covers vendors in the AI context. The post says the panelists noted that vetting vendors claiming to use AI is crucial, and that many services lack transparency about how their AI stores and uses data.

AI: use, risk and data

AI appears in all four sources, and the speakers take different angles.

Dunnion opens by calling himself a skeptic. He says he is and argues that much of what is sold as AI is machine learning. He then says he sees value in security operations. He says machine learning tools can help sort the signal from the noise in that volume.

He also names the other side. He cites a capture-the-flag case in which an AI model got past controls on a misconfigured container, and a paper on using large language models against known vulnerabilities. His summary is that the tools can be used for good or evil, depending on who is using them.

His main caution is about data. He describes a public case in which Siemens made a breach announcement. He says that once code goes in, it is retained as training data, and his conclusion is that you have to know where your information goes and who keeps ownership of it.

On the GoTo panel, Attila Török makes a similar point about data. He says that and that companies must adhere to security and privacy regulations. The post adds that the panelists recommended a cross-functional committee. The post says this can help weigh the benefits against the dangers.

The Ncontracts page lists a chapter on security risks that financial organizations overlook when adopting AI. Its summary says advanced AI security depends on getting the basics right first.

Zero trust, automation and incident response

Zero trust gets its fullest treatment in the GoTo post. It reports that Török defines it as a framework that assumes no implicit trust, even inside the corporate perimeter. The post then describes the model in its own words. It lists least privileged access, network segmentation, continuous monitoring, dynamic policy enforcement and data encryption as key principles.

The Gathid page ties zero trust to identity and AI. It does not say how, because it is a one-minute summary and not a transcript. Beyond the sentence quoted earlier, the page offers no detail about what Davies says.

The GoTo panel also covers automation in practice. Bob Stasio, CISO of Renaissance Learning, describes cloud scanning that feeds the engineering team. He says tickets are prioritized and carry service-level targets based on criticality. The post names Wiz as the tool the panelists discuss for this. Allen Cox of MyFitnessPal speaks about SOAR, the security orchestration, automation and response approach. he says.

Resilience, liability and budget

Resilience, as a word, does not appear in any transcript among these four documents. The nearest material is narrower. The Ncontracts page lists a chapter titled The page gives no answer to it. Dunnion discusses outages when he talks about telecom risk and cites a Canadian carrier. He says the impact was seen in 911 services and hospitals.

Dunnion is the only speaker here who discusses personal liability. He says that in the cases he has in mind, the accountability concerned handling of the breach, not the attack itself. He says he asks, and recommends other CISOs ask, whether the CISO role is covered under the company's directors and officers insurance. He adds that he is not a lawyer.

He also talks about money. He says plainly that security teams compete for funds. He says Cybersecurity Awareness Month can be used to raise the visibility of the security team's work, and that the same visibility helps when the team later asks for additions.

What the public record shows about the role

Within these four sources, several features of the role show up. They are observations from the documents, not findings about CISOs in general.

First, the topics are operational and tied to the business. Dunnion says he does not believe there is a typical path to the CISO seat. He says security should act as a business enabler, which he describes as helping a company conduct business safely.

Second, the role includes outside work. Dunnion describes starting a security meetup group in Ottawa that became the Canadian Cyber Forum. He says that He gives his reason for the effort.

Third, context shapes strategy. The GoTo post says that industry, size, budget, regulations and legacy technology all influence what security leaders do. The panel structure shows it: a CISO from an education software company, a security and IT director from a fitness app company and GoTo's own CISO each describe different tools and approaches.

Fourth, every appearance here sits on the employer's site. Mitel hosts its CISO's podcast, Ncontracts its CISO's episode, Gathid its CISO's post and GoTo its CISO's webinar. The documents do not say why these companies publish them, and this guide draws no conclusion about it. What a reader can take from the sources is the list of subjects that came up: vendors, AI, zero trust, breach handling, liability and budget.

Two limits apply. The Ncontracts and Gathid pages summarize their episodes without giving the CISOs' words, so most of the substance here comes from the Mitel transcript and the GoTo post.