Fern Rojas

The real causes, in their view, are missing visibility, processes, and cross-functional ownership.

• Tools do not save organizations with broken fundamentals; they give them more expensive broken fundamentals.
• They also point to attackers automating discovery, privilege escalation, and data theft faster than teams can open an alert, and recommend practical steps: inventory everything, fix entitlements, build observability, align the CIO and CISO on shared goals, and stop approving alerts without reading them.

Writing after the Stryker breach, Fern Rojas describes inboxes filling within 48 hours with vendor emails claiming their products would have prevented it.

• They say the lesson from major breaches is not that a different tool was needed.
• The post closes by recommending Nabeel Nizar as someone to talk to about identity management.

A tension runs through the corpus: Fern Rojas criticizes the post-breach vendor pile-on, yet the same post ends with a personal recommendation of an identity specialist. Their argument is not that tools never help, but that tools cannot substitute for fundamentals.

Read original

They compare AI tokens to printer ink: the hardware looks cheap until the consumables arrive.

• Unlike a printer, AI gives no warning light when a budget is running low.
• Costs can escape notice when agents run longer than expected, SaaS tools quietly add AI features under pricing terms nobody read, or nobody sets a limit on unlimited usage.
• Their recommended response: track tokens like cloud spend, set limits, ask vendors not whether an AI feature is included but whether it will show up on the bill, and keep finance involved before the invoice arrives.

Fern Rojas recalls HP printers selling for $39, then discovering that cyan cartridges cost more per ounce than Louis XIII.

• The AI version: an agent gets a little too thorough over the weekend and uses mountains of tokens; the first warning is a CFO calendar invite on Monday morning.
• The cloud parallel is sprawl, forgotten instances, and bills nobody budgeted for.

Read original

The post describes 3AM calls, an eight-hour day quietly becoming twenty, families watching a storm they cannot see the end of, and plans that start to feel conditional because work can pull someone away at any moment. They say the load is often carried alone and wears people down more than the technical work does, tying the discussion to making the human behind the keyboard part of the professional conversation.

The concrete scene is a 3AM call: you roll over, see a name tied to work, and before answering already know your day is gone. Fern Rojas says the episode pairs Vito Rocco of UNLV with Damian Chung and Troy Wilkinson, whose experiences offer a way to understand what the job really costs.

Read original

The example is not a speech or a fight, but a short, honest answer in the room where it counted. They treat this as a learnable skill and warn that delaying the hard conversation to fix things first usually costs more than the problem itself.

A board member asks a CISO whether they have enough resources to do their job, with the CEO and CFO sitting right there and every budget request already denied.

• The CISO answers: “I'll never say no to additional resources.”
• Fern Rojas calls that the whole move: no speech, no fight, no one thrown under a bus.
• The episode guest is Bob Schlotfelt, whose healthcare career they describe as decades of walking into rooms most people avoid and making calls nobody wanted to make.

Read original

Their specific worry is the SOC analyst role, a sought-after entry point into cybersecurity that is now quietly disappearing. The argument addresses both people already in the role and those trying to enter through a door that is closing fast, pairing a hiring perspective with a view from early-stage companies.

Fern Rojas notes that more than 100 companies are competing in the AI SOC space.

• The episode features Damian Chung, credited with hiring more than 400 people into entry-level security roles, and Troy Wilkinson, who they say talks with stealth-stage companies pushing the envelope.
• They open with a Bruce Willis time-machine joke before turning to the staffing question.

Read original

The post is about the ecosystem around the technology — early-stage founders, a regional audience, and the role a podcast can play in connecting them. They describe watching vision turn into momentum and playing a small part in bringing stealth-mode innovation to the local community.

Fern Rojas congratulates four founders — Alon Gromakov, May Kogan, Sa'ar Elias, and Jonathan Gutman — on raising $61M, calling the episode one of the coolest stories to come from starting the DTF Cyber Podcast.

Read original

It is the clearest example of the familiar-analogy approach that runs through the posts.

Fern Rojas compares AI spending to the printer-ink business: hardware sold cheaply and refills sold expensively.

• The post shows how costs escape notice: agents run unattended and burn tokens; AI features are switched on inside SaaS tools without anyone reading the pricing page; and when a budget runs out, there is no warning light, only a finance calendar invite on Monday.
• Rojas compares this with cloud sprawl a decade earlier, when faster and cheaper led to forgotten instances and unbudgeted bills.
• The practical steps: track token use as you track cloud spend, set limits, ask vendors whether an AI feature will appear on the bill rather than whether it is included, and keep finance in the room, not just at the invoice.

For brands planning a campaign

A vendor selling AI governance, cost controls or platform oversight can build a podcast segment or webinar around this analogy: Fern Rojas frames the buyer as the finance organisation, not the security engineer. The tone should match: concrete bill-level detail, not abstract AI risk language.

This is the most explicit version of an argument the posts repeat.

Written in the days after a widely reported breach, the post describes the wave of vendor emails that arrives within 48 hours, each claiming the sender's product would have prevented it.

• Fern Rojas accepts those claims only in a narrow, cherry-picked technical sense.
• The recurring lesson, they argue, is that visibility, entitlement hygiene, observability and shared ownership between the CIO and CISO were missing—and automated attackers now move before a team opens the alert.
• The recommended work is unglamorous: inventory everything, fix entitlements, build observability, and get executives into the same room with the same goals.
• The post ends with a named recommendation of an identity specialist.

For brands planning a campaign

Security leaders respond to fundamentals-first arguments. A vendor pitching here should expect the test that “tools don't save organisations with broken fundamentals” and be ready to explain how its product supports existing entitlement, inventory and observability work—not how it would have stopped a specific breach.

This is the clearest preview of episode structure, guest selection and the way a technical topic is turned into a human question.

Fern Rojas promotes a podcast episode about whether the security operations centre analyst job is quietly disappearing—a role many consider the standard entry point into cybersecurity.

• The framing is about people, not tools: what the shift to AI-driven security operations means for analysts already in the job and for those trying to enter through a door that is closing fast.
• Two guests anchor the episode: one who has hired more than 400 people into entry-level security roles, and another who regularly talks with early-stage companies pushing new technology.
• The post notes that over 100 companies are competing in the AI SOC space.
• The humour in the opening lines is typical of the account.

For brands planning a campaign

Workforce and entry-level pipeline questions are clearly in scope.

• A SOC or detection vendor needs a position on what happens to junior analysts, not just detection speed or analyst-hours saved.
• The two-guest format is also worth noting when proposing a collaboration: the show appears to pair a practitioner with a market-facing voice.

This post shows the human side that recurs across the episodes.

Fern Rojas describes the mental weight of security work: knowing things can go wrong at any time; the 3am call where a work name on the screen already means the day is gone; an eight-hour day becoming a twenty-hour one; and family plans that feel conditional because the storm can return without warning. The post argues that the mental load wears people down more than the technical work, and connects the theme to an episode with an academic guest from UNLV and two earlier guests, framed around why looking after the human behind the keyboard matters.

For brands planning a campaign

Wellbeing, burnout and retention are viable angles for a webinar or segment.

• A purely technical pitch may need a human consequence to fit the show.
• The audience also includes leaders who make staffing and support decisions, not just tool buyers.

A short scene: the CEO and CFO are in the room, and the budget request has already been denied.

• The security leader replies that they will never say no to additional resources.
• Fern Rojas treats that reply as the whole move—no speech, no fight, no one thrown under a bus, just honesty in the room where it counted.
• They note that telling truth to power without torching the relationship is hard to practise because the opportunity rarely comes.
• The post points to a podcast episode with a veteran healthcare security leader and adds a line worth remembering: delaying the hard conversation to fix things first costs more than the problem.

For brands planning a campaign

Executive communication works here: board reporting, budget conversations and how security leaders get funding. A vendor with a CISO-facing narrative can propose a segment on the language leaders use when money is refused, rather than on product capability.

It shows the convening role behind the podcast.

Fern Rojas describes helping bring stealth-mode founders to Arizona so local security leaders could see what technology was coming, and congratulates four named founders on raising $61M. The notable part, the post suggests, is the introduction: watching vision turn into momentum and playing a small part in bringing early-stage work to the local community.

For brands planning a campaign

The podcast also connects emerging vendors with regional security buyers, an introduction route a large brand may find harder to buy.

• A smaller vendor can build a collaboration proposal around that access.
• Ask whether the collaboration includes paid placement.

The clearest example is a DTF Cyber Podcast episode on the SOC analyst role, which they describe as a common entry point into cybersecurity that is now "quietly disappearing," with more than 100 companies competing in the AI SOC space.

• They turn to Damian Chung, credited with hiring more than 400 people into entry-level security roles, and Troy Wilkinson, who they say talks with stealth-stage companies pushing the technology forward.
• The discussion is aimed at people already in the role and those trying to enter through what they call a door that is closing fast.

Rojas opens with a pop-culture analogy, then hands the substance to named guests with direct hiring and market experience before closing with a short pointer to the episode.

For brands planning a campaign

A vendor selling into security operations can use this theme to reach practitioners, not just buyers: a live podcast or webinar segment on how AI is changing SOC staffing decisions, with Rojas framing the question through named practitioners. The brand can join a candid staffing conversation rather than deliver a product pitch, and the topic gives the vendor a reason to invite its own CISO customers into the discussion.

Examples: Source 1

Rojas compares AI tokens to printer ink, noting that the original hardware looked cheap until the consumables arrived, and points out that unlike a printer, AI gives no low-supply warning.

• The post lists specific failure points buyers can address: an agent running longer than expected and consuming tokens, SaaS tools quietly adding AI features under pricing terms nobody read, and unlimited usage with no limit set.
• They also draw a direct cloud parallel, where faster and cheaper turned into sprawl, forgotten instances, and bills no one budgeted for.
• Their recommendations: track tokens like cloud spend, set limits, and ask vendors what their AI features cost in compute.
• Finance teams, they add, are often outside the channel where these tools get approved and simply receive the invoice.

An analogy leads into a concrete list of cost traps and prescriptive steps readers can take this week.

For brands planning a campaign

This is a strong fit for a vendor marketing AI-era risk and cost control to security and IT leaders, especially one with a FinOps, cloud-security, or SaaS-governance story.

• A webinar or podcast segment built around a real token-spend audit would let the brand contribute substance rather than warnings.
• The finance-versus-security tension Rojas raises gives the vendor a natural co-speaker: a security leader paired with a finance counterpart.

Examples: Source 1

They say the real causes are missing fundamentals, visibility, processes, and cross-functional ownership, and that tools only give broken organizations more expensive broken fundamentals.

• Attackers, they note, are automating discovery, privilege escalation, and data theft faster than teams can open an alert.
• They call for a genuinely strong baseline, not one that is strong on paper or compliant for an audit.
• The post ends with practical steps: inventory everything, fix entitlements, build observability, align the CIO and CISO on shared goals, and stop approving alerts without reading them.
• They also name Nabeel Nizar as someone to talk to on identity management.

The post briefly shifts to a personal recommendation and names a contact for identity work, making it more direct than the general commentary elsewhere.

For brands planning a campaign

A vendor whose message is disciplined security practice over tool sprawl can use this theme for thought leadership, with a built-in counterpoint.

• A podcast episode or webinar could contrast the fundamentals argument with a specific identity or observability use case, showing where a tool genuinely fits into a working baseline rather than promising to replace one.
• The post names a possible collaborator; confirm their interest before planning a joint session.

Examples: Source 1

The answer they highlight is short and non-confrontational: the CISO would never say no to additional resources.

• They read it as honesty delivered in the room where it counted, without a speech or a fight, and frame it as a skill that is hard to practise because such situations are rare.
• The associated DTF Cyber Podcast episode features Bob Schlotfelt, whose healthcare career they describe as involving decisions nobody wanted to make.
• The post closes on the point that delaying a hard conversation usually costs more than the problem itself.

A short, concrete boardroom scene opens the post, followed by the lesson in one line and the guest's background as broader evidence.

For brands planning a campaign

A vendor selling to security leadership can use this theme for a webinar or podcast on communicating risk and budget to non-technical executives. It suits brands that want to help CISOs make their case rather than sell past them, and gives the vendor a reason to invite a board-level or finance-side guest alongside a security leader.

Examples: Source 1

The post describes 3AM calls, an eight-hour day quietly becoming twenty, families watching a storm they cannot see the end of, and plans that start to feel conditional because work can pull people away at any moment.

• They note that the load is often carried alone and wears people down more than the technical work does.
• The post connects the discussion to a conversation with Vito Rocco of UNLV alongside Damian Chung and Troy Wilkinson, bringing the human behind the keyboard into the professional conversation.

The post focuses on lived experience, with podcast guests speaking as people who have faced the work's mental toll rather than as technical authorities.

For brands planning a campaign

This opens a people-and-culture lane for a vendor that wants security leaders to see its investment in the workforce, not just the tooling. A jointly hosted podcast or webinar on burnout, on-call load, and retention could pair a security leader with a people or wellbeing guest, giving the brand a credible position on a topic few competitors address with specifics.

Examples: Source 1

They call it a highlight of starting the DTF Cyber Podcast and point to the value of watching vision turn into momentum and playing a small part in bringing stealth-mode innovation to a local community. The focus is the ecosystem around security: early-stage builders, regional audiences, and the role a podcast can play in connecting them.

This post marks a personal and community milestone rather than commenting on a security topic.

For brands planning a campaign

A vendor seeking visibility with early-stage or regional security audiences can work with this theme by co-hosting an event or episode that introduces emerging builders to a local security community. The fit is strongest for brands that benefit from supporting the ecosystem; the named founders give the vendor concrete people and companies to consider for a joint session.

Examples: Source 1

Examples include Episode 38 with Bob Schlotfelt on hard conversations with executives, and an episode featuring Damian Chung, Troy Wilkinson, and Vito Rocco on what the changing SOC analyst role means for people in it.

View example

Foster compares cloud and on-premises choices to solving the right problem, and explains why 90 days of asset history or a year of security events matters when asking how an attacker got in.

• Rojas makes a similar argument about tokens, budgets, and where AI spending quietly accumulates.
• Readers who like their plain-spoken explanations of AI-era operations will recognize the approach.

Foster writes from inside a security platform, describing named product capabilities such as correlating assets with known exploited vulnerabilities and applying agentic reasoning to telemetry. Rojas writes as a podcast host and commentator, using guests and post-mortems rather than product detail, and focuses on leadership, staffing, and cost questions.

Read original · Original 2

Rojas argues that the lesson of a breach is not that a different tool was needed.

• Z Ali S. argues that AI vulnerability discovery creates fatigue and false positives, and that security hiring may grow rather than shrink.
• Both make their case through a specific, checkable observation rather than a slogan.

Z Ali S. focuses on vulnerability discovery, noise triage, and data-request volume, and writes about the technical and compliance workload they create. Rojas ranges more widely across funding announcements, boardroom communication, and practitioner mental health, using the podcast format to carry much of the argument.

Read original · Original 2

Tsanev relays CISO objections and renewal conversations; Rojas shares what a CISO said in a boardroom and what guests say about entry-level hiring. Both turn those conversations into practical guidance and use a podcast to do it.

Tsanev focuses on go-to-market: how founders sell into enterprises, why the champion closes the deal rather than the founder, and why CISOs cut products they cannot defend.

• The advice is vendor strategy aimed at founders.
• Rojas focuses on the practitioner and leadership experience of the work, including its personal cost, rather than how a deal gets closed.

Read original · Original 2

The posts show a podcast host who interviews cybersecurity founders and centres the conversation on selling into large enterprises and how CISOs adopt AI — the same buyer Rojas reaches, but through a go-to-market lens.

• They also name a specific show and episode, list a guest by name and role, and describe a working network of CISO introductions.
• A vendor can join an established interview format with named guests instead of commissioning one from scratch.
• If the AI-era risk message is really a positioning message for enterprise buyers, this is the closer fit.

The editorial centre is founder and vendor go-to-market, not security operations.

• A message about breach fundamentals, token spend or practitioner burnout would need recasting as a selling-to-CISOs story, and part of the audience is other vendors rather than security leaders.
• Before setting a budget, ask for listener numbers, download figures and listener job titles.

Examples: Source 1 · Source 2

The posts work the same theme as Rojas's printer-ink post — token spend, usage-based pricing, context limits and runaway tool-call loops — and add close technical detail on telemetry history and agentic reasoning. Their company-voiced, product-linked style makes this kind of contributor a quick fit for a vendor's own blog, webinar or LinkedIn series, keeping the product message on screen.

The posts read as company promotion rather than independent editorial: they promote a named product and platform, carry company hashtags and link to a product site.

• A collaboration built on them inherits that vendor voice.
• There is no hosted show or interview format, so the vendor has to provide the editorial vehicle rather than plug into an existing one.
• Ask for evidence of the audience and any guest or episode track record before booking.

Examples: Source 1 · Source 2

The posts argue that AI vulnerability discovery will generate more noise and false positives than teams can absorb, that the work will demand more security people rather than fewer, and that adopting AI safely raises new data-governance questions. That fits a campaign built around a written point of view on 'what AI changes for security teams', especially for a vendor selling detection, prioritisation or data controls.

The posts are written commentary, not a hosted show.

• Their framing stays on tooling fatigue and workforce demand; the breach-response and board-room scenarios that anchor Rojas's posts are not present, so a campaign built around those concrete buyer moments travels less well here.
• Before booking, ask for audience data and confirmation of any interview or guest format.

Examples: Source 1 · Source 2