Practical Cybersecurity with Jen Stone

Practical Cybersecurity , hosted by Jen Stone (MCIS, CISSP, CISA, QSA), is the bridge between complex security frameworks and real-world business implementation. Whether you are a "Jack of all trades" IT manager or a business leader with limited resources, this show provides the roadmap to a defensible security posture.

Practical Cybersecurity with Jen Stone is a education podcast hosted by SecurityMetrics, with 121 episodes on record and a Required Pod Score of 80.

SecurityMetrics hosts Practical Cybersecurity with Jen Stone, a education show with 121 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #14

  How to Pass your PCI Assessment in 2027: Targeted Risk Analysis, MFA, and the E-Commerce Gap: (ep. 14)

  Sep 1, 202636 minS1

  PCI DSS 4.0.1 has been the standard for a while now, but a lot of organizations are still stuck on the same handful of requirements. In this episode, Jen Stone sits down with Matt Halbleib, Director of Assessments at SecurityMetrics, to break down where SMBs keep getting tripped up — and how to fix it. Key topics covered: Why you need to read the actual standard (not just the summary of changes) — and why the PDF version matters Getting senior management buy-in and putting a real project manager behind your PCI program Scoping: what's actually in scope, and why it's worth revisiting What replaced the old org-wide risk assessment, and how to build one Why MFA got bigger in 4.0.1, and where it now applies New service provider requirements, including the responsibility matrix Logging and alerting: what's changed, and where AI actually helps Password requirements, including the jump to 12 characters, and why a password manager beats a memorized passphrase Compensating controls: what they're for, and why they should never be permanent Matt’s honest take on the customized approach E-commerce and payment page security (Req. 6.4.3 / 11.6.1) Matt Halbleib has worked in information security for nearly 19 years, almost all of it at SecurityMetrics, where he now leads the assessments team. A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club. Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/

  ListenShow Notes
• 

  Episode #13

  AI Didn't Change the Rules, It Raised the Stakes (ep.13)

  Aug 4, 202639 minS1

  You can pass your PCI assessment and still be leaking cardholder data. In e-commerce, compliant and secure are not the same thing — and AI just made the gap between them a lot harder to ignore. In this episode, SecurityMetrics Principal Security Analyst Jen Stone is joined by forensic investigator Aaron Willis and [HOST NAME] for a practitioner panel on how AI is reshaping attacks on cardholder data — and why passing PCI DSS 4.0.1 isn't the same as being safe. It's a repurposed webinar built around what auditors and forensic investigators are seeing in the field right now. In this episode: - Why passing PCI (especially SAQ-A) doesn't mean your checkout is secure - Why PCI DSS 4.0.1 already covers AI without ever naming it - Where e-commerce skimmers really hide — and how one defeated a top detection agent - Requirements 6.4.3, 11.6.1, and SAQ-A FAQ 1588, decoded - The payment-redirect trap: the convenience attackers are cheering for - How AI reshapes your risk analysis, MFA, and third-party obligations - Treating compliance as security: a three-tier framework Chapters: (0:00) Why we're running the AI panel (1:08) 2026 forensic & cyber predictions (3:42) Inside 2,000+ e-commerce cases (4:54) Shopping Cart Monitor: one skimmer a week (6:35) What Specter AI does (8:06) The skimmer that beat a detection agent (10:19) Real-time and agentless defense (11:52) PCI DSS 4.0.1 and AI (14:05) Script security: 6.4.3, 11.6.1 & FAQ 1588 (17:30) The payment-redirect trap (19:56) AI-impacted requirements (24:18) Compliance as a security framework (26:28) Script inventory on the checkout page (27:35) Listener Q&A (35:45) Public vs. private AI tools (37:51) Final tip: AI raised the stakes Follow Practical Cybersecurity so you don't miss an episode. If this one helped, pass it to someone on your compliance or security team. Watch the full video version on YouTube: https://youtu.be/-CPruQnGRpc About SecurityMetrics: SecurityMetrics helps organizations secure payment data and meet PCI DSS. We're a certified PCI Qualified Security Assessor (QSA), Approved Scanning Vendor (ASV), PCI Forensic Investigator (PFI), and P2PE Assessor. A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club. Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/

  ListenShow Notes
• 

  Episode #12

  Your PCI Scope is Too Big (and how to fix it) Ep.12

  Jul 21, 202621 minS1

  How much of your business actually needs to be PCI compliant? Almost always less than you think. Every system inside your PCI scope is something you have to secure, document, and prove — year after year. So the fastest way to cut the cost and effort of compliance isn't working harder on controls. It's making your scope smaller. In this episode, Principal Security Analysts Jen Stone and Michael Simpson break down how PCI scope actually works — the three buckets every system falls into, the connected systems most people forget, and four practical ways to shrink your Cardholder Data Environment (and the bill that comes with proving it). In this episode: - What "in scope" really means, and why getting it wrong gets expensive - The three scoping buckets: primary, secondary (connected), and out of scope - The bucket almost everyone underestimates (hint: your Active Directory) - Four ways to shrink your scope: segmentation, P2PE, tokenization, and fixing phone payments - How taking payments by phone quietly balloons your scope, and the ways out - Why "we use a third party" and "we're in the cloud" don't get you off the hook - Three costly myths that keep merchants over-scoped and overspending Free PCI scoping resources: https://listings.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1.pdf https://blog.pcisecuritystandards.org/new-information-supplement-pci-dss-scoping-and-segmentation-guidance-for-modern-network-architectures Watch the full video version on YouTube: https://youtu.be/sSzZOGeGuYg A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club. Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/

  ListenShow Notes
• 

  Episode #11

  You're Probably Behind on CMMC. Here’s What To Do Next. (ep 11)

  Jul 7, 202617 minS1

  About 100 authorized assessors. An estimated 118,000+ companies that need to be assessed. That math is the reason CMMC can't wait — and it's where this conversation starts. Brett Cox, lead CMMC Certified Assessor and head of Boeing's DFARS CMMC Program Management Office, joins host Jen Stone to explain what the Cybersecurity Maturity Model Certification actually requires, why the November 2026 third-party assessment deadline is creating a bottleneck, and how a small or mid-sized contractor should take the first step. KEY TAKEAWAYS Phase 2 — the third-party (C3PAO) assessment requirement — goes live November 10, 2026. The right to waive the requirement goes away in 2028. Under CMMC, you must verify the subcontractor below you holds the required level before you can award them work. Their compliance is now your problem. The bottleneck is real: ~100 assessors vs. ~118,000 companies. Expect a months-long queue — get in line now. COTS (unmodified commercial off-the-shelf) is the only exemption, and there's no minimum dollar threshold. Modify a part and it's no longer exempt. You can't use the same company for both readiness consulting and your assessment. First step: decide your level (FCI vs. CUI), download the scoping and assessment guides from the DoD CIO site, and start your gap analysis. RESOURCES DoD CIO CMMC documentation (scoping & assessment guides): https://dowcio.war.gov/CMMC/Resources-Documentation/ Cyber AB Marketplace (find a C3PAO or consultant): https://cyberab.org/marketplace NIST SP 800-171 https://csrc.nist.gov/Pubs/sp/800/171/r3/final SecurityMetrics CMMC services: https://www.securitymetrics.com/product/cmmc About the Guest Brett Cox — Lead CMMC Certified Assessor; Principal & Team Lead, DFARS CMMC Program Management Office, The Boeing Company. LinkedIn: https://www.linkedin.com/in/brett-r-cox/ A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club. If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/

  ListenShow Notes
• 

  Episode #10

  Which PCI SAQ Do You Actually Need? (ep.10)

  Jun 23, 202635 minS1

  First time filling out a PCI SAQ? In this episode, two QSAs who've scoped hundreds of payment environments walk you through how to pick the right one—so you don't end up with the wrong form, the wrong security controls, and the wrong amount of risk. Choosing the right PCI DSS Self-Assessment Questionnaire (SAQ) isn't just a paperwork decision. Pick the wrong form and you can leave blind spots in your network security or lock yourself into compliance requirements you never needed. In this episode of the Practical Cybersecurity Podcast, SecurityMetrics experts Jen Stone (QSA) and Michael Simpson break down the complex, often misunderstood rules of PCI scoping. They translate confusing auditor-speak into a practical roadmap so you can identify your payment channels, reduce your data footprint, and satisfy your acquiring bank. In this episode: The e-commerce breakdown: the technical triggers that separate SAQ A, SAQ A-EP, and SAQ D—and the "iframe vs. direct post" buzzwords that decide which one is yours How to spot bad PCI advice, including the common Toast POS / SAQ A myth that sends merchants to the wrong form Why validated Point-to-Point Encryption (P2PE) is the gold standard for in-person payments and how it eliminates local network scope E2EE vs. P2PE: the critical difference between proprietary end-to-end encryption and a formally validated solution—and why you can't use the P2PE form for E2EE The cellular terminal question: how to document network-connected mobile payment devices Virtual terminals (SAQ C-VT): how to stress-test your network segmentation so a call center actually qualifies The SAQ roll-up: how to combine multiple payment environments into one master document without losing your mind Service providers: the one unyielding rule for B2B vendors who handle downstream cardholder data Resources: Official PCI SSC PTS device search: https://listings.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices?agree=true Talk to a SecurityMetrics QSA about scoping: https://www.securitymetrics.com/security-consulting A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club. If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/

  ListenShow Notes

Recent guests on Practical Cybersecurity with Jen Stone. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.