Colorado = Security Podcast

Our featured guest this month is Tanya Janca, CEO of SheHacksPurple Consulting, board member for the Forte Group, and former keynote speaker at the Snow Frog conference, interviewed by Frank Victory. We break down the stark differences between privacy and cybersecurity policy globally, the uncomfortable gap between compliance frameworks and real-world risk, and her personal crusade to institute the world's first secure coding law. Plus, we dive into the major Colorado OIT restructuring, local development updates at DIA, and the latest threat intel and AI insights from Zvelo, Red Canary, Optiv, FusionAuth, and Lares! Our featured guest this month is Tanya Janca, widely known across the industry as SheHacksPurple. Tanya is the CEO of SheHacksPurple Consulting, a board member for the Forte Group, a former keynote speaker at the SnowFroc conference, and the best-selling author of Alice and Bob Learn Application Security. With over 25 years of IT and software development experience, Tanya joins Frank Victory for a candid, deep-dive exploration into the intersection of global security policy, developer workflows, and the massive disconnect between checked compliance boxes and truly defensive software engineering. Check out the full episode where we discuss: The Policy vs. Security Gap: Why international frameworks and high-visibility initiatives like the US SBOM Executive Order often favor visibility and tooling purchases over actual vulnerability remediation and code-level security. Shifting Left and Secure Guidelines: Why the industry routinely relies on catching vulnerabilities late via adversary simulation and penetration testing rather than establishing secure requirements, guardrails, and clear guidelines at the design phase. The Secure Coding Law Crusade: Tanya details her current petition in the Canadian House of Commons to establish a strict, accountability-driven secure coding law that could set a global baseline for how governments and private enterprises hold software to a true safety standard. Come join us on the Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com. This Month's News & Resources Colorado overhauls state IT office, lays off 173 employees after negative feedback (Colorado Sun) Colorado’s fierce two-year fight over AI regulation ends with watered-down law, little fanfare (Colorado Sun) Denver ranks among ‘most exciting U.S. cities to drink in right now’ (Westword) Denver airport plans pedestrian walkways between concourses (Ground News / DIA) Denver-area inflation increases to 5%. Blame energy costs. (Colorado Sun) How Lares Thinks About Mythos-Class AI in Offensive Security (Lares) The Security Risks of Agent-to-Agent (A2A) Communication (zvelo) Red Canary May Threat Intel Highlights (Red Canary) Advanced AI Protections for CISOs: A Practical Punch List (Optiv) We Surveyed More Than 300 Security Leaders on AI Identity. The Findings Are Counterintuitive (FusionAuth) Tanya Janca on LinkedIn https://cppcon.org/ https://www.devsecstation.com/ https://shehackspurple.ca/ Secure Coding Guidelines — Tanya’s free, boiled-down 84-item guide referenced in the episode. Upcoming Events Rocky Mountain Information Security Conference (RMISC) - 6/23-25. ISC2 Pikes Peak - 6/24. ISSACOS Biergarten - 6/25 Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Our feature guest this week is Kyle Mickey, Founding Machine Philosopher at Corewood. We’re also trying something new with our interviews and Kyle will be doing an Ask Me Anything in the #AMA channel on Slack. Head on over there to ask him any questions you might have! News from and a lot more! Come join us on the Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: A Rhino in RiNo! It's Up to You to Name the New, 22,000-Pound Sculpture A Mall No More: Looking Back at the Real 16th Street Attempt to tweak Colorado’s controversial, first-in-the-nation artificial intelligence law is killed Colorado’s quantum Tech Hub partners with IBM to train 3,500 workers ZScaler acquires Red Canary for boost in AI-driven security operations Zscaler's Buyout of Red Canary Shows Telemetry's Value Mobile security matters: Protecting your phone from text scams Rethinking The Supply Chain Risk You Can’t Ignore: Third-Party Access Upcoming Events: Check out the full calendar Denver ISSA - SIG: The Colorado AI Act and Its Impact on US Consumer Privacy Rights - 6/11 ISSA COS - Mentoring Matters - 6/12 Let's Talk Software Security - Is There Real ROI in Security Conferences - 6/17 Denver OWASP - A Web CTF for Everyone - 6/18 ISSA Pikes Peak - Chapter Meeting - 6/25 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Our feature guest this week is Nipun Mahajan, EVP at ISACA Denver. News from and a lot more! Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel Boulder, Colorado Named New Host of Sundance Film Festival Beginning in 2027 Popular grocery chain plans expansion into the Denver-metro area Denver sporting goods maker expands more than threefold Denver-based Angi Inc. completes spin-off, becomes independent Ball Corp. offloads product line to new joint venture Denver cryptocurrency company is being bought by a major industry player Five Critical Insights from the State of Trust Summit What does Google’s $32B acquisition of cloud security startup Wiz mean for security operations? | Red Canary Upcoming Events: Check out the full calendar ISSA Denver - Insider Threats: A Hacker's Perspective - 4/9 CSA Colorado - Securing the Cloud - Attack Vectors - 4/15 Denver OWASP - The Attacker’s Distributed Supercomputer: Your Browser - 4/16 ISACA Denver - Annual General Meeting - 4/17 Let's Talk Software Security - Can't We Just Automate Application Security? - 4/17 ISSA Pikes Peak - Chapter Meeting - 4/23 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Our feature guest this week is Rock Lambros, CEO and founder at Rock Cyber, interviewed by Frank Victory. News from Colorado School of Mines, Lufthansa, Boom Supersonic, Lumen Technologies, LucisPoint, Ping Identity, Optiv, NCC, Red Canary and a lot more. Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel The Coldest Place in the Known Universe Is at the Colorado School of Mines Lufthansa gives Denver first regular service on Airbus A380 - The Points Guy Denver-area company's experimental jet breaks sound barrier three times Lumen Technologies to auction 55-acre suburban campus, move employees to Denver Co-owners’ fraud, snooping claims threaten IT firm in Cherry Creek 2025 Predictions for IAM Leaders AI Security and Governance: A Practical Path to Protection How to Protect Your Child’s Data After a Breach - National Cybersecurity Center Tangerine Turkey mines cryptocurrency in global campaign | Red Canary Upcoming Events: Check out the full calendar Wild West Hackin’ Fest @ Mile High 2025 - 2/4-7 ISSA Denver - Privacy SIG: Hey, Siri: What We Should Get Out of Apple's $95M Snooping Settlement - 2/5 ISSA Denver - Cybersecurity Insights from Denver's Top CISOs - 2/12 Let's Talk Software Security - Are Security Breaches Evidence of Systemic Failures? - 2/18 ISSA COS - Chapter Open House - 2/18 ISACA Denver - Joint meeting with IIA - 2/20 ISSA Denver - AI/ML SIG: AI Revolution Blueprint: Mastering the Art of Strategy and Governance from Ground Zero Workshop - 2/26 ISSA Pikes Peak - Chapter Meeting - 2/26 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Jacob Rubin, CSO at Curana Health is our feature interview this week, interviewed by Frank Victory. News from Buc-ee’s, Dish Network, Maxar, Red Canary, Optiv and a lot more. Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel Second Colorado Buc-ee's in the Works Colorado's Population Growth Is Years Behind Past Forecasts CommonSpirit Health to demolish former TTEC HQ and build 42-acre campus Dish Network-DirecTV deal collapses 10 Colorado businesses make Deloitte's 500 fastest-growing tech companies Space tech giant Maxar confirms hacker accessed employees' personal data From the dreamhouse to the SOC: Ken’s guide to security District Attorneys Launch Investigation Into Secretary of State Office Voting System Passwords Leak 6 Tips for a Successful Security Vendor Consolidation Job Openings: Uplight - Vice President, Information Security Loxo - VP, Security and Privacy Bank of America - Business Information Security Officer (BISO) Engagement Senior Lead Fastly - Technology Compliance Lead Kroll - Associate Managing Director, Cyber Risk S&P Global - Head of Corporate Platforms Technology SOX & Controls Management The Trade Desk - Sr Data Privacy Director LaSalle Networks - Director of IT & Security Optiv - Cyber Security Architect Sumo Logic - Senior Security Compliance Analyst Rapid7 - Senior Security Solutions Engineer (SLED) Upcoming Events: This Week and Next: Check out the full calendar TechYeet Holiday Meetup Extravaganza - 12/10 Onspring - Denver GRC Summit - 12/11 COS ISSA - Members Only Holiday Party - 12/12 ISC2 Pikes Peak - December Meeting - 12/13 Denver ISACA + ISC2 - Joint Meeting - 12/19 Let's Talk Software Security - Is Your AppSec Strategy Increasing Cognitive Load of Developers? - 12/19 ISACA Denver - January Chapter Meeting (Online) - 1/9 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

CJ Cox, Chief Operating Officer at Black Hills Information Security is our feature interview this week, interviewed by Frank Victory. News from Sundance Film, Valhallan, Red Canary, Optiv and a lot more. Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel Boulder selected as 1 of 3 finalists to host Sundance Film Festival in 2027 Colorado adds a single Michelin-starred restaurant Houston-based esports company opens metro-area training center, plans more Five Colorado small businesses rank among U.S. Chamber's top 100 How Arvada became Colorado’s quantum hub The CrowdStrike outage: Detection and defense in depth | Red Canary A Technological Revolution: How AI is Increasing Efficiency in Cybersecurity Top Five Budget-Friendly OT Networking Improvements for Small Manufacturers UCCS Day of Service – Community Cyber Hygiene Open House - National Cybersecurity Center Job Openings: Invenergy - Director, Cyber Security Programs Twilio - Director, Cybersecurity Counsel S&P Global - Head of Security Architecture & Engineering Moody's - VP-Cybersecurity Engineer (Cyber Investigations Manager) The Trade Desk - Sr. Manager, Global Security & Resilience Bank of America - Cloud Security Controls Deployment Specialist – Global Information Security Protiviti - Privacy Management Senior Consultant ZOLL - Information Security Architect Red Canary - Senior Threat Hunter Xcel Energy - Senior Regulatory Security Consultant Upcoming Events: This Week and Next: Secure World Denver - 10/10 ISSA COS - October Meeting - 10/15 Let's Talk Software Security - Is Pursuing CHANGE Essential in AppSec? - 10/15 CSA Colorado - October Meeting: Addressing Material Risks - 10/15 ISACA Denver - October Chapter Meeting (Online only): Auditing with AI - Demos - 10/17 Webinar: Cisco SCOR: Building a Strong Cybersecurity Foundation - 10/17 ISSA COS - October Mini Seminar - 10/19 ISC2 Pikes Peak - October Meeting - 10/23 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Gadalia Montoya Weinberg O'Bryan, CEO and founder at Dapple Security is our feature interview this week, interviewed by our own Frank Victory. News from Southwest Airlines, Alterra Mountain Company, Vail Resorts, Botdoc, Crowdstrike, LogRhythm, Red Canary, Lares, Webroot and a lot more. Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel Southwest breaks with 50-year tradition and will assign seats; profit falls at Southwest, American Denver-based ski giants to host Olympics events How the Colorado, New Mexico quantum industry plan to use its federal funding Colorado company strikes AI partnership for security at car dealerships Communications outages from CrowdStrike update cancel RTD trains, shut down Colorado DMVs, hinder first responders A Comparison of AI Regulatory Frameworks Merged Exabeam and LogRhythm cut jobs, face lawsuit Halting a hospital ransomware attack - Red Canary Enhancing Organizational Communication and Culture through Purple Team Testing 7 Tips on Keeping Your Data Private When Using AI - Webroot Blog Job Openings: Pax8 - GRC Analyst City & County of Denver - CISO Lumen - Vice President, Deputy Chief Security Officer CoBank - Director, Internal Controls and Operational Risk, IT Westerra Credit Union - Director of Information Security (Hybrid - must reside in CO Meta - Security Partner - Mergers & Acquisitions (M&A) Robinhood - Enterprise Risk Manager State of Colorado - Cyber Criminal Investigator IV Fastly - Senior Manager, Security Detection and Response Motion Recruitment - GRC Analyst The Trade Desk - Sr Staff Product Manager-Data Governance & Policy Applications - Trust & Safety Upcoming Events: This Week and Next: ISSA COS - August Meeting - 8/13 ISSA Denver - August Meeting, "Incident Response" - 8/14 Let's Talk Software Security - Vulnerability Remediation:Fixing Problems or Creating New Ones? - 8/14 ISSA COS - August Mini Seminar - 8/17 Colorado = Security & Colorado CSA Summer Picnic - 8/24 ISC2 Pikes Peak - August Meeting - 8/28 Denver ISSA - AI/ML Special Interest Group - 8/28 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

Guy Sereff, Partner at Michael Best is our feature interview this week. News from Arapahoe Community College, Guild, Katilyst, LogRhythm, Ping Identity, Red Canary and a lot more. Support us on Patreon! Fun swag available - all proceeds will directly support the Colorado = Security infrastructure. Come join us on the new Colorado = Security Slack channel to meet old and new friends. Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com This week’s news: Join the Colorado = Security Slack channel Denver Named Number One on List of Best U.S. Cities for Foodies Colorado Legislature Passes First-in-Nation Artificial Intelligence Bill Denver-area community college first to join Space Force effort to teach aerospace workers How Colorado organizations are preparing to fill quantum positions Denver tech firm Guild grew rapidly, now it is shrinking rapidly Katilyst - Out of Stealth and Ready to be Your Security Champion LogRhythm and Exabeam Announce Intent to Merge, Harnessing Collective Innovation Strengths to Lead the Future of AI-Driven Security Operations What Is Liveness Detection? How It Helps Fraud Prevention What to consider when evaluating EDR Job Openings: Pax8 - IAM Architect Bank of America - Azure - Senior Cloud Security Engineer State of CO - Senior Security Administrator (Audit) CoBank - Director, Internal Controls and Operational Risk, IT Maxar - Senior Information Security Specialist Gates Corp - Cybersecurity & DLP Specialist Quizlet - Staff Cloud Security Engineer Flexential - Manager, Security Architecture Western Union - Information Security Engineer Upcoming Events: This Week and Next: RMISC - 6/11-13 BSides Boulder - 6/14 Let's Talk Software Security - Quality Tests, Security Outcomes: Are We There Yet? - 6/20 CSA Colorado - June Meeting, "Modern AI Threats and Challenges" - 6/25 ISC2 Pikes Peak - June Meeting - 6/26 View our events page for a full list of upcoming events * Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here. * Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0