“This report dives into the evolving role of generative AI in logistics, revealing how it’s reshaping visibility, communication, and adaptability across global supply chains. From forecasting weather impacts to managing labor shortages and customer-driven changes, the research explores both the promise and the limitations of AI. It also introduces a provocative challenge: should supply chains adopt disruption modeling, just as IT uses threat modeling?”
Whisper Report:What’s the biggest cybersecurity myth in 2025?
Published to clients: August 19, 2025 ID: TBW2090
Published to Readers: August 20, 2025
Whisper Email Release: TBD
Public and Video Release: TBD
Analyst(s): Dr. Doreen Galli
Photojournalist(s): Dr. Doreen Galli
Abstract:
This Whisper Report identifies eight persistent cybersecurity myths in 2025, from the belief that threats can be fully stopped to misconceptions about AI’s role in security. Experts from Black Hat USA 2025 clarify that resilience, strategic investment, adaptive training, and human oversight remain essential. AI is powerful but not a plug-and-play solution, nor a replacement for human judgment. Understanding these myths helps organizations build more realistic, effective cybersecurity strategies.
We took the most frequently asked and most urgent technology questions straight to the Cybersecurity professionals gathering at Black Hat USA 2025 held in Las Vegas. This Whisper Report addresses the question regarding what’s the biggest cybersecurity myths in 2025? Figure 1 displays the eight cybersecurity myths we uncovered we will now discuss.
MYTH 1: We can Stop all Threats
The first myth comes from Trustmi’s Corey Sienko and is that “we can stop every single threat from entering the organization” This may come as a surprise to some executives particularly those outside of cybersecurity but the expression used is always when not if you have an incident. No Need to fret, Trustmi’s Corey Sienko continues. “It’s about how do we respond to those threats and make sure that we protect the organization from losing valuable information and cards.” I believe all appreciate that clarification. Cybersecurity involves defense but it is also a game all about preparation for when and resiliency after. This topic is further discussed in Conference Whispers: Black Hat USA 2025.
Cymulate’s Avihai Ben Yossef brings us myth number two, “The more money you spend on cyber security the more protected you are.” Ben goes on further to explain. “I think in order to really be protected in cyber security from cyber attacks is by actually knowing what you need to do in order to make sure you are protected and when once you know that you don’t need to spend too much money you need to spend you know a very focused amount of money in what matters most.” If you are surprised by this, you really need to book an inquiry with TBW Advisors so we can help you review your cybersecurity strategy. Additional research regarding critical observations on cybersecurity spend can be found in the keynote covered within Conference Whispers: Identiverse 2024.
Cybersecurity Myth number three comes to use from Dune Security’s David DellaPelle. “Security awareness training is improving readiness and reducing risk. Security awareness training is dead.” Intrigued? Let’s hear more from David. “Security awareness training as it exists today, meaning legacy security awareness training technologies are not effective at reducing risk and create friction and an adversarial relationship between the security organization and the end users. The problem is if you think about a doctor who is looking to solve a patient’s problem, the first thing they would do is take in a lot of data and run tests to exclude the possibilities. They quantify the risk before they prescribe a medicine or a surgery. And so if there’s a security awareness training solution that doesn’t automatically provide uh user adaptation, it’s uh it’s kind of falling flat on its face. Every piece of security control or adaptation should be relevant to the individual user’s risk profile and that training or that security measure should be applied automatically based on the risk profile.” Training employees only on what that specific employee personally need to get better at? Sounds optimized.
Bringing us cybersecurity Myth 4 is StrikeReady’s Alex Lanstein. “AI is going to replace humans.” Alex further clarifi:ed, “AI is always going to augment humans. Anybody who’s ever leveraged any AI system, any generative AI system. You see that it makes mistakes. Sometimes those mistakes are obvious, sometimes they’re subtle. And no one is ever going to turn anything over to an AI when it’s making such obvious or subtle mistakes without a human in the loop.” Or as Elastic Security’s James Spiteri further explained, “we’re thinking about this fully autonomous security operations team. I don’t think that’s going to happen. I don’t think even think it’s the right approach to think about these things. AI and agents are phenomenal, but they are the perfect compliment to humans. They’re not they’re not there to replace humans. They’re there to make humans lives better. eliminate the stuff that humans don’t want to do and let humans do the fun things like make people excited about wanting to work in cyber and that’s what the AI is allowing us to do.”
of my agents, and his name is Ralph. Ralph, can you answer the question as you see it in our world view? What’s the biggest cyber security myth here in 2025? Absolutely, Brian. Happy to jump in here. So, from our perspective, the biggest cyber security myth of 2025 is probably the idea that AI is just a plug-and-play solution, that it’s kind of a one-size fits-all magic bullet.” Ralph and Brian went on to further explain, “In reality, the myth is that AI will handle everything securely on its own. But the truth is it needs a lot of oversight, a lot of transparency, and people often underestimate the complexity inside the machine. So that’s the big myth that AI is just simple and straightforward when really it’s a lot more nuanced. And that’s my take. Uh I would add my answer. I would extend onto yours is I agree, but um I’m used to systems that have access controls, authentication controls, and audit. Uh inside the black box, we don’t have any of them. Once I log in and I authenticate, it’s a wild wild west. That has to change. Immutable logs within the system is probably something that’s going to happen at some point. Uh or some other unique uh solutions to the problem.”
Interestingly, Ariful Huq from Exaforce observed a similar concern. “Trying to build an LLM wrapper is what I call it without really understanding the data related to the problems that you’re trying to solve. LLMS can only get you so far, right? They are large language models and summarization and contextualization but at the end of the day if you want to solve problems related to say detections investigations LLMS can only get you so far right you really need to go back to the data go back to the fundamentals and then layer on a large language model on top of it to solve some of the problems that around like you know summarization um you know building agent workflows.” In other words, solutions are custom crafted – NOT plug and play.
Checkmarx’s Jonathan Rende brings us Myth 6, “AI generates secure code.” That myth should grab the attention all organizations leveraging coding agents to quickly advance their product. Jonathon continues, “It doesn’t. It doesn’t. And it will probably get better over time. And will it do a better job than a junior developer in simple mistakes that can cause vulnerabilities? Heck yeah, of course it will. But for the more complex issues, it’s not there yet. AI is not there yet.”
Let’s hear Myth 7 from Booli’s Joe Schorr, “the biggest cyber security uh myth is that AI is actually going to solve everything.” Joe went on to further explain, “I think if you judiciously apply AI, machine learning and very discreet task and things, it’s fantastic. I think it’s being overblown quite a bit right up at the myth level. I think that if you treat it like we treat it in Booli, we’ve got AI built in, but we don’t publish it all over everything we’ve got, but we treat it kind of like an idiot savant. It’s it does one to ask really well or does a discrete set to ask really well. It may not actually behave well in church, but you can get it to do what you want for something very very specific, which is how we do it. I think the myth is that AI is going to solve everybody’s problems.” Brian Sledge of imPAC also believes that AI will solve everything is a myth. “I think AIis best positioned more like a forcemultiplier, but I don’t think it solvesthe problems, the core problems of cybersecurity today. Um cyber security stillrequires context. It requirespolicy driven control and those thingsstill require human in the loop. And Ithink the best way to leverage AI isn’t so much in solving for cyber security,but it’s more for helping multiply andscale out what humans still need andwe’re required to do. So I don’t think Idon’t think customers should sleep onthe idea that humans still need to be very much engaged as part of cyber security. Because cyber security AIis only as good as the algorithms andthe models and the data it’s getting.” Thus believing in 2025 AI will solve everything is a stretch but will it solve something?
Microsoft’s Thomas Roccia brings us Myth 8. “right now I think most people in in the industry in the security industry doesn’t yet believe in this technology (AI) and that’s maybe one of the one of the myths that AI will not really solve issue in cyber security. We have and I think that’s a mistake it’s probably something which is changing the way we are doing and all the past work that we did for the past 20 or 30 years uh is going to be changing and evolving thanks or because to AI so that’s something to consider.” Thus, while it may not solve everything today, it is changing how the industry works and what it is fighting against.
*When vendors’ names are shared as examples in this document, it is to provide a concrete example of what was on display at the conference, not an evaluation or recommendation. Evaluation and recommendation of these vendors are beyond the scope of this specific research document. Other examples products in the same category may have also been on display.
“Effective strategies for securing customer data include encryption at rest, in transit, and during compute; cautious AI adoption; and strict access controls. Removing or masking personally identifiable information (PII) and training staff on cybersecurity best practices are essential. Legal compliance, intellectual property protection, and customer trust drive the need for robust privacy measures in customer interactions.”
We took the most frequently asked and most urgent technology questions straight to the technologists gathering at Customer Connect Expo 2025 held at the Las Vegas Convention Center. This Whisper Report addresses the question regarding What are the most effective strategies for ensuring data security and privacy in customer interactions? There are two reasons security and privacy are critical in this space. As Ford’s Dr. Kalifa Oliver pointed out, “to first really understand the laws..” In fact, all governance program definitions start with legal requirements, then industry regulations and requirements, then internal privacy promises made to customers. The second critical reasons for ensuring data security and privacy as Claritiv’s Sean Gigremoss reminds us, “your knowledge for your business comes from all the conversations that you’re having – that is your IP (intellectual property).”
Figure 1. Four Pillars of Customer Data Protection
As Macy’s Siva Kannan Ganesan pointed out, “all those regulation and implementing an regulation it’s a multi-step approach like data and motion data at rest should be encrypted and you have to make sure it’s like the access strict access control and frequent evaluation of the data breach.” With security depth is always valuable. TBW Advisors LLC advises clients to not only use encryption at rest and in transit, but to leverage protections during compute leveraging Confidential Computing. For additional research, enjoy Industry Whispers: Public is Privacy – Confidential Computing in the Cloud available on TBW Advisors YouTube Channel.
TBW Advisors has frequently warned if you are not being charged for the product, you are the product. If you are the product, you should assume you do not have privacy. Today with many of the advanced AI products, even lower tier paid products do not get privacy; rather they are being used to further train the product. As Ford’s Dr. Kalifa Oliver observed, “you really got to start asking organizations that have AI technologies about their Blackbox about how the data is being trained. You have to ask them about data breaches you have to be conservative about how you implement things because I think the law is going to catch up and the hardest thing to do is trying to go back and fix it.”
One critical step to ensure privacy is to not send PII or personally identifiable information to tools. Enthu.ai’s Atul Grover denoted, “we also ensure that we deduct the PI information we deduct almost 16 kind of PIs including social security data birth credit card information …. we do that in the recording as well as all the analytics.” While removing the information is a common practice, masking data is also quite common. As Mitrol’s Pedro Lopez Slevin shared, “our banks for example you will probably have on premise data servers. Everything will be with TLS 1.2 two or higher you know and create your data. We’re talking about AI, we usually do rack so you will have to process every information into embeddings and those embeddings are..unreadable if you just put it in a vector database.”
While the term Human in the Loop has gained popularity with generative AI and agentic solutions, cybersecurity has always known the human in the loop as being a critical risk factor. Thus in order to truly ensure data security and privacy, you must train those humans! Randy Simmons from FaxSipIt shared the common journey towards compliance. “we’ve gone through a HIPPA audit and we’re secure there we just finished the SOC 2 audit and we’re SOC 2 compliant so people have come in they’ve audited our system our policies they’ve come with recommendations or not and we pass the audit for the socks 2 audit so our staff all goes through cyber security training as well we go through a wiser cyber security training and then also we send phishing to our to our employees and see if they’re going to click and if they click on a link then guess what they’re doing they’re doing that training all over Again.” So remember, do not click on that link without checking the link is safe first!
“Recent advancements in decentralized identity include passwordless authentication, time-bound credentials, and dynamic identity chaining. These innovations reduce risk, improve privacy, and enhance user control. Separation of authentication from authorization enables more precise access management. One-way functions protect biometric data in cloud environments. Emerging standards like SPIFFE and CSA’s agentic identity frameworks offer scalable, interoperable solutions. Together, these developments support secure, flexible identity ecosystems without relying on centralized authorities.”
“Organizations can implement zero-trust security without disrupting user experience by prioritizing frictionless authentication, especially biometrics, and enforcing least-privilege access through dynamic policies. Understanding user context and behavior enables informed decisions that preserve continuity. Self-service access tools reduce delays, while streamlined verification processes minimize frustration. With thoughtful planning and clear communication, zero trust can enhance both security and usability, ensuring users access only what they need—when they need it—without unnecessary barriers. This report includes insights from executives and technologists at CyberSolve, Lumos, Imprivata, Simeio, Panani, Keyless, Oasis, Apono, Omada, and Cubeless, quoted throughout the discussion.”
Target Audience Titles:
Chief Information Security Officer, Chief Technology Officer, Chief Digital Officer, Chief Information Officer
Chief Product Officer, Chief Experience Officer
IAM engineers, Security Architects, DevSecOps Engineers, UX Designers, IT Ops Managers, Application Security Architects
Key Takeaways
Use biometric authentication to streamline access and reduce friction for users.
Apply least-privilege policies with dynamic adjustments to maintain secure, appropriate access.
Enable self-service access changes to minimize delays and improve user experience.
Understand user context and behavior to make informed, non-disruptive security decisions.
How can organizations implement zero-trust security without disrupting user experience?
We took the most frequently asked and most urgent technology questions straight to the Technologists gathering at Identiverse 2025 held at Mandalay Bay in Las Vegas. This Whisper Report addresses the question regarding how can organizations implement zero-trust security without disrupting user experience?
What is the desired user experience?
At the end of the day, the goal is, as Imprivata’s Diron Chai put it, “authentication and visibility and control to making sure that you know the right people are accessing the data whether remotely or within the organization in terms of their role and their functionality and then be a being able to understand who’s in the system when and why that all ladders up to a zero-trust architecture that we’re able to bring forth in a full architecture.” Reaching this goal won’t be easy but as Simeio’s Octavio Lopez emphasized, “There’s a lot of communication that needs to happen and that’s something that we help a lot of our customers with.” A lot of communication and planning with the customers’ experience kept in mind. Here are five suggestions attendees at Identiverse offered also depicted in Figure 1.
1. Go Frictionless with Bio
One common suggestions to deploy biometric based identity and access management solution. As Panani’s Jim Harris suggested, “make the authentication of your customer as frictionless as possible a one-time identity verification process establishes that customer in the future they present a simple credential match their biometric information to the information stored in the credential that they own and control making it a very frictionless fast way to authenticate with your customer.” And this is something Alex Jones from Keyless can also agree with! “going to pitch biometrics this is the fastest way to prove who you are effectively implementing zero trust.”
2. Understand User Context
Guy Feinberg at Oasis suggests that understanding the user context is the winning approach. He started by simply asking “Are you familiar with the scream test?” For those of you not familiar, one not uncommon method in IT to understand how a resource, in this case an identity, is used by disconnecting or unplugging the resource and see who screams. Feinberg went on to further explain, “when you want to understand what’s this identity is used for so what you do you decommission it and just see who’s at the open space is screaming that something is broke. We do we help you construct all the context around the consumption of that identity so you can see the full picture before you’re taking actions so you’ll have informed actions deciding do we need this type of identity now uh should we change the permission should we decommissioning it completely all without disrupting the workforce and making sure that business continuity stays on and nothing is disrupted aspects of this.”
3. Understand User behaviour
Beyond the context of what the user is using, Imprivata’s Diron Chai recommends also understanding the how and the when. “ Being able to inject simple multifactor authentication into the environment at the local level also being able to track the behavior of credentials of people accessing like Windows endpoints as an example or mobile devices and be able to have the analytics to show utilization of the endpoint but also who what when was accessed within that session.”
4. Use Self-Service
To maintain the best user experience, Apono’s Ofir Stein recommends getting the human out of the loop. “you keep the user experience by allowing self-serve in your organization to provide access changes combine these two and you actually provide zero trust to all of the resources.”
5. Leverage Dynamic Policies
Omada’s Craig Ramsay highlighted the potential behind dynamic policies. “By using dynamic and continuous policies to make sure that their access is appropriate and it’s always at that level of least privilege and then it’s granted, when they join the organization, and as they move around the organization, and it stays appropriate.” It’s always nice when your privileges keep up with organizational changes – without human intervention or manual configuration.
In Conclusion
As Cubeless’ Treb Ryan concluded, “I find zero trust has greatly enhanced our user experiences and greatly made my job easier in the old days where there’s systems where you had to figure out which networks could connect or who would have access to what particular piece it was a nightmare.”
Finally Lumos’s Janani Nagarajan reminded all, “not just in the networking layer not just in the app layer but a critical layer for us is identities because that’s where the workforce the humans the employees the contractors the vendors your customers are actually interacting with the apps.” Identities is the key to minimizing friction for the users in zero trust. If your organization is implementing a zero trust architecture and want to ensure you are on the right track, remember to book an inquiry.
“Media companies now favor hybrid cloud workflows for flexibility, speed, and cost-efficiency. Open standards ensure interoperability, while strong security protects valuable IP. Experts stress aligning cloud use with business goals, maintaining control and visibility, and using cloud strategically—not universally—to optimize collaboration, performance, and infrastructure investment.”
Target Audience Titles:
Chief Technology Officer, Chief Digital Officer,
Chief Data Officer, Chief Marketing Officer, Chief Content Officer
VP Engineering, VP Media Technology, Dir Cloud Strategy, Dir Media Ops, Head of post production, Direct of IT Infrastructure
Cloud Solution Architects, Media System engineers, DevOps Engineer, Video Platform Engineer, Broadcast Engineer, Post Production Engineer, Media Workflow Specialist, Software Engineer, Storage and Archiving Engineer, SRE
Key Takeaways
Hybrid workflows balance cloud flexibility with on-prem performance and cost control.
Open standards ensure seamless integration across media tools and platforms.
Strong security protects media IP with access control and audit trails.
Cloud strategy should align with business goals, not just follow trends.
We took the most frequently asked and most urgent technology questions straight to the Technology experts gathering at NAB Show 2025 held in Las Vegas at the Las Vegas Convention Center. This Whisper Report addresses the question regarding what are the best practices for integrating cloud technologies in media workflows?
Its been fascinating to watch the Media’s use of the cloud the last handful of years. As Axle.ai’s Sam Bogoch observed, “during covid people would just put things in the cloud willy-nilly because there was no reason to put it anywhere else. They didn’t go to their offices. There was no on premise. There was no concentration of work.” Furthermore, as Dell Technologies’ Tom Burns pointed out, “The promise of cloud was that you didn’t have to own or maintain infrastructure and that’s been awesome.”
Or as Ross’s David Green observed, “they don’t have to have a large upfront capital investment.” Thus when there was no concentration of workers or work, the lack of capital investment and no need for infrastructure maintenance was quite attractive. But its important to keep in mind as Ross’s David Green further explained, “cloud is just a technology – not a solution.” Thus, in the post-COVID world, Media has been rebalancing how as an industry it works with cloud.
Regardless of where you put your workload for what part of the media workflow, the technologies involved must work together. Latakoo’s Jade Kurian gave us a great example, “if I have one company that does transcription let’s say really really well but it’s no connected to my media workflow. Then if I start using that as an enterprise media company, then the problem is I’ve created something that slows down my team even though I’m trying to make it faster for them.” To prevent the slowdown from incompatible tools, Cinnafilm’s Dom Jackson suggested, “to make sure that all of these technologies are using somewhat standardized APIs and ontologies and so on to allow somewhat atomic solutions to be combined easily into larger workflows.” In other words as Magnify’s Ken Ruck summarized, “the best ways to be open and not be a closed system.” The goal, as summarized by Jade Kurian, “it is all about speed -speed from camera to that pane of glass that exists that somebody’s watching on the other end”
Regardless of where your solution executes or where the media resides, protecting that media is absolutely critical. As Eon Media’s Greg Morrow simply stated, “media companies are built on their intellectual property so protection of their IP is incredibly important.” As warned during our coverage of Conference Whispers: NAB Show 2025, just because a technology can share media, doesn’t mean it does so securely with an audit trail. Lucidlink’s Gergana Berman further cautioned, “a lot of providers out there might claim that they have a very secure solution, but you have to check for yourself.” If this is an area your team is concerned with, clients should book an inquiry before purchasing the technology. In 2025, it is also critical to check the terms and conditions of any AI technologies leveraged. As Gergana Berman further explained, “ make sure their terms and conditions are not saying they can use your media copyrighted media.” Or as the saying goes, don’t use free products for when something is free – you are the product. In this case the valuable IP is the product of the media company for which you are working.
Some solutions have built in capabilities to assist in protecting your intellectual property. Greg Morrow pointed out that Eon Media’s solution has, “three levels of watermarking that we produce So we have produce a visible watermark on the asset and an invisible watermark.” Leostream’s Karen Gondoly perhaps best summarized the totality of the need, “I need to have control of my data. I need to have control of who has access to it. I want to secure that data so I want to make sure that I’m authorizing users correctly. I want to make sure that I’m using zero trust principles when I’m providing access to people. I need visibility. I want to make sure I always know who has access to my data what they’re doing with it where they’re accessing it from.” In other words, I don’t just need to be able to control it, I need a full audit trail of the five w’s for my data. Who accessed, What was accessed, When accessed, Where accessed and Why accessed as depicted in Figure 1.
Today, most media companies have settled into hybrid architectures involving a combination of on premise and cloud technologies. Strada’s Michael Cioni best summarized, “no one can actually put everything in one cloud. There’s too many collaborators. There’s too many different clouds. There’s too many pros and cons to clouds and nobody has enough money to store everything there So I think the best practices for integrating cloud into your workflow is to actually look for alternative solutions that may not use the cloud in the traditional ways and figure out how to collaborate across clouds versus putting everything in one place.” So what should go where? One can observe, those with on-premise based solutions have different answers vs those with predominantly cloud based solutions. Ross’s David Green recommends, “to not start with I want to do cloud the key is to start with whydo I want to use cloud and then figure out who can help you solve those.”
SNS’s Alex Hlvarty cautions, “we can’t control internet outages or data breaches or things like that are mitigated by making sure that you keep your own assets on site in your possession but then utilizing cloud for its very clear benefits as far as making things available to people all over the world through one single portal.” Axle.ai’s Sam Bogoch also likes to keep things he is actively working on close. “on premise the things that you’re immediately working on because it does not make sense to keep asking for them politely from the cloud when you’re getting work done much faster on premise and meanwhile things like archive and backup clearly belong in the cloud.” From a capitalization perspective, Dell Technologies Tom Burn’s recommends an extension of a common metaphor. “let’s think of the old rocks pebbles sand metaphor where rocks are the fully capitalized on prem infrastructure that you need to keep 99.9% utilized and the pebbles are the project-based uses of compute and storage that aren’t part of your base commit and don’t hit your ybudget and the sand is the pure burstable joy that is the public hyperscalers. We’re looking at hybrid workflows that combine all three screening up.”
Once again, clients should schedule an inquiry to review your hybrid media architecture against your organizational priorities.
Cyber-physical security, like healthcare tech, must carefully manage PII. Experts highlight privacy-preserving biometrics, user-controlled consent, and anonymous face matching. Regulatory compliance, such as GDPR, drives standardization and innovation. As laws vary by region, adaptable and consistent global system architectures are essential for scalable, secure, and compliant operations.
Public and Video Edition Released: August 11, 2025 11am
Analyst(s): Dr. Doreen Galli
Photojournalist(s): Dr. Doreen Galli
Abstract:
“Integrating AI customer service with existing IT systems starts by setting clear business goals. AI should enhance, not disrupt, current workflows and streamline real-time support. Every organization has unique systems, so tailored integration is essential. A major challenge is fragmented data—making robust pipelines and clean, synchronized data critical. Accurate timestamps and system compatibility across platforms are key to ensuring effective AI performance and a smooth digital transformation journey.”
Target Audience Titles:
Chief Information Officer, Chief Technology Officer, VP/Director of IT Operations, Enterprise Architects
Chief Customer Officer, VP/Director of Customer Services/Success, Contact Center Operation Managers
Solution Architects, DevOps & IT Administrators, Customer Support Agents, Data Scientists and ML Engineers
Key Takeaways
Start with clear business goals so AI enhances workflows without causing disruptions.
Tailor integration to your unique tech environment to avoid inefficiencies.
Reliable, clean, and synchronized data pipelines are essential for effective AI-driven customer service.
We took the most frequently asked and most urgent technology questions straight to the technologists gathering at Customer Connect Expo 2025 held at the Las Vegas Convention Center. This Whisper Report addresses the question regarding how can we integrate AI-driven customer service solutions with our existing IT infrastructure? As Ford’s Dr. Kalifa Oliver shared, “first we need to break down our needs and our goals and figure out which pieces of AI actually build efficiencies in our IT systems because right now there are too many systems that are fragmented.” With ALL AI projects, it is best to start with the business goal not the technology. We do not want to spend resources to integrate technology that goes unused. Furthermore, the context of the business goal helps guide engineers when they have design choices to make.
AI in Customer Service is all about optimizing and improving the customer service workflow to lead to maximum customer satisfaction. As Zaon’s Jason Kaufman shared, “using artificial intelligence tools within the organization to actually help drive and make more efficient the processes that go into place in order to support good customer service. For example, leveraging artificial intelligence to actually analyze chats real time community forums real time. Actually monitoring that (the communities) helping to gain insights about what your customers have questions about so that you can leverage the AI to actually generate the knowledge on the fly to actually provide that (information removing confusion) back to them real time as if it’s another person on that community thread.” The nonobvious challenge in achieving this solution is best described by Claritiv’s CEO Sean Gigremoss. “Everybody has workflows. Every company is unique. What tools do they use? What products do they use now? Do we need to build it?” In other words, every organization has a unique, highly mixed environment with varying degrees of maturity both in the technology itself and the organization’s ability to deploy technology.
Verse.ai’s Zac Brooksher recommends focusing on complimenting the current workflows and processing. “We can integrate AI driven customer service solutions using full funnel metrics understanding all of the conversations the timestamps the channels the appropriate team members what next steps are all integrating into existing systems and processes just to complement what the current workflows and data processing is today like.” Any technology not realizing it is complimenting an existing process will instead create process interrupts. The distinction really is a big difference.
As Claritiv’s Sean Gigremoss shared, data is everywhere! “They make it so easy for us to integrate because in the end that’s important because all the data are in this different .. disparate systems. You need information from Salesforce you need information from zoom you need information from slack you need information from your database you need information from your customer’s database so to be able to do that you need to make sure that you’re using the tools or you’re partnering with companies that help you so that you can focus on what you do best.”
But the data isn’t just everywhere, it comes from everywhere. The first obvious location was shared by Enthu.ai’s Atul Grover, “we integrate with the telephony at the dialer.” And the rest such as the web and email communications, “we ingest that using an API driven environment.” Diabolocom specializes in capturing all that occurs between the customer and the organization on mobile devices. As Diabolocom’s Benjamin Shakespeare shared, “with our mobile solution that we are about to release
the market .. So all field reps anybody who is using a cell phone today with every interaction they have on their phone our AI will then score that call transcribe it and push it directly into the CRM So any lack of compliance that you are seeing today in your organization from people that are not sitting behind a computer that will be no longer.”
Now that we understand we are complimenting the existing customer experience workflows for the benefit of the customer experience and that data is everywhere, what can we do? As Macy’s Siva Kannan Ganensan shared, “you need to make sure your data pipeline is very robust when we talk about all this AI integration data is the core so make sure the data is cleansed and always readily available ready to serve with that we’ll be able to integrate an into your existing architecture or in your organization.”
Figure 1. Compliment Workflows & Leverage Robus Data Fabric
It’s all about the data infrastructure! You need robust data pipelines as part of your data fabric to seamlessly integrate any new AI offering as depicted in Figure 1. AND you must ensure data quality. For example, data quality is paramount when dealing with timestamps of customer communications. What time zone is your organizational standard? Do your IT systems work in that time zone, and do you know what systems provide timestamps in other formats or time zones? Is that true for any and all corporate acquisitions feeding data into the system? Is the system designed to handle the variety of daylight savings time scenarios? Are all the clocks adjusted for daylight savings automatically or manually? Finally, are the timestamp clocks aligned? To the second or to the minute? It’s valuable to know if you can look at time as fact or approximation in your organization. If your organization is going through any type of digital transformation, it is critical to get the best advice available to ensure your success. Ensure your success by scheduling your inquiry with a TBW Advisors advisor before starting any critical phase of your digital transformation journey. Get the smartest advice available and leverage our firsthand experience to your advantage.
To strengthen cybersecurity in FinTech, experts emphasize a layered approach that combines technology and human awareness. Rising threats like phishing, smishing, and fraud demand not just better tools but also vigilant, well-trained employees. Embedding security scans into software development, analyzing diverse data signals, and adopting a “defense in depth” strategy are all critical. Ultimately, staying curious, asking the right questions, and embracing evolving technologies—especially AI—can help organizations stay ahead of cyber risks.
Target Audience Titles:
Chief Technology Officer, Chief Security Officer, Chief Information and Security Officer, Chief Trust Officer, Chief Compliance Officer, Chief Risk Officer
Head of Product, VP of Product, Chief Marking Officer, Data Protection Officer, Director of Data Protection
Adopt a Layered Defense: Use a “defense in depth” strategy—combine multiple security measures and analyze broad data signals to stay resilient against evolving threats.
Train Your Team: Human error is a top vulnerability. Regular employee training helps prevent phishing, smishing, and social engineering attacks.
Build Security into Development: Embed security checks directly into software pipelines to catch issues early and reduce risk at every stage of development.
We took the most frequently asked and most urgent technology questions straight to the finance technology experts gathering at Fintech Meetup 2025. This Whisper Report addresses the question regarding what the best practices are for enhancing cybersecurity in FinTech. As SecurityMetrics’s Matt Cowart shared, there is a, “big rise that we’ve seen is fishing and smishing.” Your employees are getting targeted via email and SMS messages. But that is not the only threat. The user or customer angle also brings in cybersecurity issues. Incentiva’s Heather Alvarez shares, “fraud is something that is very big right now and (is something) that we’re trying to combat.”
Cybersecurity frequently feels like a game of whack-a-mole. Vulnerabilities seem to pop up in every dimension you explore but there is still hope. As Socure’s Matt Thompson shared, “creating layers and looking at lots and lots of data signal is important for protecting your Enterprise.” This is also known as defense in depth.
What might these layers include? Gitlab’s Field CTO, Joshua Carroll recommends, “making sure your code is secure and doesn’t have vulnerabilities by building the security scanners into your pipelines and do those as you build the software you can save yourself an awful lot of time.” Likewise, SecurityMetric’s Matt Cowart points out that it all, “comes down to training. The weakest link is where hackers get in. Being able to strengthen your entire area – all of your employees making sure they know what to do what not to do is going to be on of the biggest things that keeps your network safe.” Effective training can minimize phishing and smishing as well as positively impact fraud detection during customer interactions.
Thus to enhance your cybersecurity, ensure a depth in defense security strategy and that the strategy includes both technical aspects of your enterprise as well as your humans in the loop. But most important stay curious and keep building. As Incentiva’s Heather Alvarez shared, “ask the right questions .. continuing to push and look for new features look for to AI to help us because there are a lot of Technologies out there.”
If you are evaluating your cybersecurity environment, be sure to book an inquiry for timely advice.
*When vendors’ names or quotes are shared as examples in this document, it is to provide a concrete example of what was on display at the conference or what we heard doing our research, not an evaluation or recommendation. Evaluation and recommendation of these vendors are beyond the scope of this specific research document.
Cybersecurity in healthcare is responsible for protecting the data that represents the life’s story of patients and infrastructure to enable proper care. Managing and securing the plethora of edge devices and the interoperability of all the technologies is an increasing challenge. There are four steps to take to enhance your healthcare cybersecurity: select a framework, leverage depth in defense, automate where possible, and test your environment.
Target Audience Titles:
Chief Information Security Officer, Chief Information Officer, Chief Security Officer, Chief Technology Officer, Chief Compliance Officer, Chief Data Officer, Chief Privacy Officer
VP of Cybersecurity, Director of Information Security
Security Architect, Information Security Architect, Network Security Engineer, Systems Security Engineer, SOC Analysts, IAM Specialists, Director of Privacy
Key Takeaways
Device maintenance and interoperability continue to challenge healthcare environments cybersecurity.
Four steps to enhance cybersecurity in healthcare environments. Select a framework, leverage depth in defense, automate where possible, and test your solution.
Tags
cybersecurity, privacy, healthcare, healthcare technology, health tech, HIMSS, HIPPA, medical devices, edge devices, IoT, depth in defense, automate, integration, cybersecurity frameworks, Evidently, Hal Wolf, Kai Romero, Brennen Reynolds, Absolute Security, Alexander Group, Trey Chamberlin, Aisera, Daniel Carvajal Marin
We took the most frequently asked and most urgent technology questions straight to the health systems technology experts gathering at the Healthcare Information and Management Systems Society (HIMSS) 2025 Global Health Conference and Exhibition or HIMSS 25 for short. This Whisper Report addresses the question regarding the best practices for enhancing cybersecurity in healthcare. Given that data breaches in 2024 affected 1 in 2 American’s health records, cybersecurity is top of mind in healthcare1. But healthcare data is not your shopping data, it represents much more. As Evidently’s Kai Romero shared, “the narrative Arc of who they are how they’ve suffered, how they’ve overcome the illnesses that they’ve experienced, you can’t treat that lightly … this is their life.” But there is a reason for concern in healthcare. For those unfamiliar, Russia has been found the source of ransomware attacks on the healthcare industry2. As HIMSS Hal Wolf shared, “security is a major issue our own the federal government the United States just announced that they were bringing down cyber security blockage or fundamentals against another foreign country recently that was yesterday.” There is no indication that the cyberattacks on healthcare will stop, just an announcement that the government is no longer stopping such attacks.
Understanding that healthcare data represents the whole person and their life, where are the vulnerabilities coming from in the healthcare environment? Examining the source of the security vulnerabilities can offer insights to the efforts to defend and protect this valuable healthcare data. Turns out there are two large sources of vulnerabilities.
Device Maintenance
First, devices in the healthcare environment itself are an issue. As we discussed in Whisper Report: How can AI be effectively integrated into healthcare systems?, many devices on site are old. They may not have over the air (OTA) updates, may require human in the loop to update. As Absolute Security’s Brennen Reynolds stated, “any given organization that man that has our technology about 15% of the devices that are being manually managed have some missing critical security control which increases their risk to either an operational outage or a cyber event like Ransomware.” It may sound like simple advice you have heard a million times, but keeping your equipment up to date with the latest software and security patches is simply critical.
Interoperability
Healthcare creates complicated environments full of an array of diverse vendors. Somehow these vendors and their technology – or more specifically – the diverse array of data about the patient derived must interoperate. Not just interoperate, the data must come together to provide a picture of the patient for the practitioner. Unfortunately, as Alexander Group’s Tray Chamberlin pointed out, “a lot of interoperability issues and leaks.” Getting the technology to work together is so difficult in and of itself, the process created that ‘works’ may not be a secure solution. It is critical that during any interoperability project that protection of the data in the processes is the first a priority. Furthermore, the integration architecture and solution must be examined at a detailed level to understand and identify any potential leakages created in the process.
Organizations concern about security in healthcare technology is not going to go away. Per HIMSS’s Hal Wolf, “this is going to be the coinage of which we really improve Healthcare is information (and) information comes from data the data will be unprotected so .. it is why it (cybersecurity) is one of our (HIMSS) four focus points.. at HIMSS (25) digital Health transformation, AI, cyber security, and Workforce Development.” Information is how we improve care, thus information is the goldmine of healthcare. Figure 4 depicts Four Steps to Enhance your Healthcare Cybersecurity.
Select Framework
Through the various conversations while conducting this research, it became very clear that each organization has their own framework to guide their cybersecurity program. When selecting amongst the frameworks, ensure these common characteristics are present.
It should be 100% restricting while enabling productivity.
Needs guardrails and controls
It should be deliberate and intentional with how it handles your assets.
Leverage Defense in Depth
Regardless of where the technology is used within healthcare, certain security practices should be consistent. As Evidently’s Kai Romera shared, “some of the same things that we use in the clinical setting to protect patient data whether that’s logging out of a screen pretty quickly after it’s not active or you know taking away the protected patient information so that anyone who’s looking at the screen would not know who that patient was you want to know that they’re employing those things because this (is) patient data.” Understanding no single method covers all scenarios, it is good to use every method available when possible. For example, clinical data masking technology and standards can easily be applied to the terminals used at the front desk and billing as well.
But data masking is not just useful at the terminal level. As Aisera’s pointed out, regarding you agentic AI solutions, we can do everything from masking PII for mask any personal data “architecture that’s going to keep your data private data privacy is probably the most important thing especially when it comes to healthcare right .. but also how it is stored right even in our cloud approach” our customers get the unique architecture so when you’re training the LLM you’re not trained in our models.”
Deploy Automation
Many shy away from automation, but as we pointed out in Conference Whispers: Black Hat USA 2019, a ransom ware attack can take down an organization in 30 minutes. What human on call can get notified, get online and stop an attack that fast? Furthermore, as Absolute Security’s Brennan Reynolds shared, “topic of automation there’s just too many things to be done in a day to allow and require humans to be doing all of the maintenance and management task so if the it devices across their organizations whether you have a th000 devices 10,000 or a million devices you’re never going to have enough staff to manually execute tasks to keep those devices safe and secure.” Thus it is physically impossible to stop many attacks or even simply update all the devices on site without automation.
Test!
Regardless of the care taken, it important to review the architecture and test the system. As Alexander Group’s Tray Chamberlin explained, “make sure that it’s not just we want this system we want to stand it up and we want the functionality but also going through the paces and testing and making sure that is playing nice but also doesn’t open up a new vulnerability within your system going forward.” A system that simply works is not the goal. Rather, a system must work and be secure, resilient, and hardened against attacks including its integration points is the minimum standard.
We will close with remarks by HIMSS’s Hal Wolf, “ I think cyber security is going to continue to be at the Forefront of our thoughts whenever you’re dealing with data and information they are going to be bad actors… HIMSS is focused on cyber security we have cyber security forums (and) there are cyber security events taking place.”
*When vendors’ names or quotes are shared as examples in this document, it is to provide a concrete example of what was on display at the conference or what we heard doing our research, not an evaluation or recommendation. Evaluation and recommendation of these vendors are beyond the scope of this specific research document.
