Data Security Decoded
Securing the Software Supply Chain
June 24, 2025
In this episode of Data Security Decoded, Allison Wikoff, a 20-year cybersecurity veteran and threat intelligence expert, cuts through the noise and identifies some unique threats within today's security landscape. From the surprising shift toward exploiting old vulnerabilities to the reality of AI-powered attacks, discover why the fundamentals of cybersecurity matter more than ever. Whether you're a CISO navigating supply chain risks or a security analyst trying to separate hype from reality, this episode delivers practical intelligence from someone who tracks threats for a living. • Understand why known vulnerabilities have become the dominant attack vector (even for criminal groups) • Learn to identify and manage third-party risks before they become ransomware nightmares • Discover the truth about AI attacks and why they're not as revolutionary as headlines suggest • Get actionable steps to strengthen your security posture without massive budget increases
Navigating Modern Cybersecurity: From Supply Chain Risks to AI Evolution


In this episode of Data Security Decoded, Allison Wikoff, a 20-year veteran in information security and threat intelligence, explores current cybersecurity challenges, emerging threats, and practical defensive strategies for organizations of all sizes.


What You'll Learn:

Key Insights:

Highlights:
[00:00:00] Vulnerability Exploitation Trends
Allison Wikoff reveals that vulnerability exploitation has become a dominant attack vector across both criminal and state-sponsored threat actors. The shift marks a departure from traditional assumptions that mainly espionage-focused groups leveraged vulnerabilities. Security teams must prioritize patching edge devices like VPNs and WAPs that provide remote access capabilities. Rather than trying to patch everything, organizations should focus on understanding their network architecture and critical access points. A real-world example is the Log4j vulnerability, which highlighted the challenge of identifying vulnerable components embedded within other systems. This insight helps security teams better allocate limited resources by focusing on the most critical vulnerabilities first.


[04:30] Supply Chain Security Essentials  
Wikoff emphasizes that modern supply chain security requires looking beyond just your own organization's defenses. Organizations must thoroughly understand their vendors' access levels and potential impact on operations. She recommends implementing specific training programs and enhanced authentication measures, particularly for password resets and employee validation. Running tabletop exercises focused on supplier-related ransomware scenarios helps identify weak points. The key takeaway is maintaining backup suppliers for critical services to ensure business continuity when primary vendors face disruptions.


[07:23] AI in Cybersecurity: Reality vs Hype
Tolin shares that while AI adoption by threat actors is increasing, it hasn't revolutionized attack tactics as many feared. Current AI usage focuses mainly on improving phishing email quality and assisting with malware code generation. Organizations should understand that threat actors typically follow the path of least resistance rather than pursuing complex AI-driven attacks. Most AI implementation mirrors legitimate business use - automating repetitive tasks rather than enabling sophisticated new threats. This insight helps security teams maintain perspective and avoid overinvesting in AI-specific defenses while staying focused on fundamental security measures.


[14:08] Threat Profile Development
Tolin advocates for organizations to start by understanding what assets would interest attackers rather than chasing every new threat. The rapidly changing threat landscape makes it impossible to defend against everything, requiring a focused approach based on your specific risk profile. Security teams should identify their most critical assets and likely threats, then build defenses around protecting those priorities. Organizations shouldn't hesitate to leverage external expertise, as even government agencies rely on partners for threat intelligence. This practical framework helps organizations develop sustainable security programs aligned with their actual risks rather than theoretical threats.


Episode Resources: 


Data Security Decoded is handcrafted by our friends over at: fame.so