We all say security is important, but does our behavior reflect it? In this episode, we explore what it really takes to build a true culture of security inside organizations.

Traditional awareness training and phishing simulations often feel surface-level and at times punitive. So how do we move beyond compliance checkboxes to meaningful behavioral change?

Joining us is Robert Siciliano, cybersecurity leader, speaker, and creator of the Strategic Human Firewall™. Robert shares how AI-driven social engineering, deepfakes, and synthetic identities are bypassing technical controls—and why the workforce is now the most critical line of defense.

We discuss:

• Why security culture starts with mindset
• The "Human Blindspot" and the instinct to trust the familiar
• Shifting from "I trust what I see" to "I verify everything"
• Turning security awareness into true security appreciation

In this Q&A-style episode, we revisit the CMMC landscape following the implementation of the rule and the finalization of the Title 48 procurement rule. We break down what's changed, how CMMC requirements are phased into contracts and most importantly, the types of CMMC services available to help you take your next best step.

We dive into boundary identification and definition, gap analysis/assessment, documentation support, readiness assessments, and formal Level 2 C3PAO assessments, along with key questions you should ask service providers to avoid confusion and unnecessary costs.

Whether you're just starting out or preparing for assessment, this episode is designed to help you better navigate CMMC confidently and with clarity.

References

• Episode 11 – CMMC Rollout Q&A
• Phased Implementation of CMMC (each one year in length)
  • Phase 1: Level 1 and Level 2 self-assessments; possibility of Level 2 C3PAO
  • Phase 2: Level 2 C3PAO for initial contract award; possibility of Level 3 and Level 2 C3PAO for option year awards
  • Phase 3: Level 2 C3PAO for option year awards; Level 3
  • Phase 4: Level 3 and full implementation across all contracts
• Key questions to ask CMMC service providers
  • Does the assessment allow me to still leverage you as a C3PAO?
  • Does the assessment mimic a full formal assessment, including all evidence collection? This is important, as some only include interviews and live demonstrations, but do not include formal evidence gathering.
  • Can I use evidence collected in one of these preparatory assessments during my formal assessment? Generally, the answer is yes, but a good rule of thumb is that the evidence shouldn't be more than 90 days old during a formal assessment.
  • Do you offer a scoped preparatory assessment? Alternatively, you may want to only cover the controls for which a POA&M is not allowed. Ask if these are a possibility. They'll save you money, time, and give you the peace of mind you're looking for.
• Contact the Kratos CMMC team
• Cape Endeavors

In this episode, we take a practical look at how cyber insurance fits into the broader world of organizational risk. While we often talk about risk from a security and compliance perspective, insurance brings its own lens, which has become increasingly important as threats evolve, and claims grow more complex.

Today's guest, Mark Westcott, President & CEO of ACNB Insurance, breaks down the types of risks insurers care about most, how cyber policies are shaped and the key factors that influence underwriting decisions. We also explore how compliance frameworks and certifications play into premium pricing, risk scoring, and eligibility.

Learn about:

• The types of risks insurers prioritize—and why
• How insurers approach cyber insurance
• The connection between compliance standards, certifications and insurance rates
• Core benefits of cyber insurance beyond financial protection
• Whether regulations mandate cyber insurance and what drives adoption
• Key questions organizations should ask when evaluating cyber coverage