In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Roger Grimes, CISO Adviser at KnowBe4, cybersecurity veteran of nearly four decades, to break down what’s really driving breaches today and what security leaders can do right now to strengthen their defenses without getting lost in hype or complexity.

What You’ll Learn:

How to prioritize the two root causes driving 90% of breaches
Why you need to fight AI with AI-enabled tools
The phishing-resistant MFA framework
How to balance foundational security with innovation
Why a complete AI ban creates hidden risk

Roger Grimes is a CISO Adviser at KnowBe4, bringing nearly four decades of cybersecurity expertise spanning roles from PC repair to VP of IT. With 16 published books and over 1,600 magazine articles on cybersecurity, Roger has established himself as a thought leader in identity management, AI-enabled defense mechanisms, and vulnerability mitigation.

If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.

Episode Resources:

Roger Grimes on LinkedIn
KnowBe4 Website
GlobalSign Website
View and Integrate Website

Key Takeaways:

[00:57] Focus on the Basics First

Businesses often chase the latest intrusion detection tool while skipping unglamorous work like patching and staff training. The organizations that consistently do the fundamentals well are the ones that actually reduce risk, regardless of how sophisticated their tooling looks on paper.

[04:50] The Two Bubbles: Social Engineering and Unpatched Software

AI-assisted vulnerability discovery combined with AI vibe coding could push CVE disclosures from around 48,000 last year to as many as 150,000 this year. However, Roger sees this as a short-term cost rather than a long-term trend. Within a couple of years, he expects AI-powered defensive tools to give defenders a genuine edge for the first time in decades.

[07:34] Phishing-Resistant MFA vs. Traditional MFA

Any MFA is better than a password alone. Nevertheless, most MFA methods remain vulnerable to adversary-in-the-middle attacks, in which a victim is tricked into visiting a fake site that captures their code in real time. Use MFA everywhere you can, and prioritize phishing-resistant options wherever it’s practical to deploy them.

[09:26] The Danger of Blanket “No AI” Policies

Companies that ban AI outright often assume they’ve eliminated the risk. But employees are likely using AI tools in their personal lives regardless. A total ban just removes your visibility into what’s happening, whereas a sanctioned, monitored approach lets you set boundaries around what data can and can’t be shared.

Quotes:

“I think that businesses need to open their mind to using AI enabled tools to help fight AI enabled attacks.”

“Unpatched software and firmware and social engineering are about 99% of the problem in attacking home users and about 90% of the problem in most organizations.”

“You should be using multifactor authentication to protect your valuable data and systems instead of a password.”

“If you have the opportunity, you should try to use a phishing resistant form of multifactor authentication.”

“I'm a very big believer in using password managers because if you don't use a password manager, that means you're using the same password or a password pattern.”
“A complete ban against all AI is gonna hurt you in the end, and you need to look at AI enabled tools on a per instance basis.”