Redefining CyberSecurity

Ryan Grant, Country Manager & GM, North America at ESET, joins Sean Martin to discuss the launch of ESET PROTECT, announced September 30, 2026. The platform brings 24/7 monitoring, AI security, and a cyber warranty to small and midsize businesses. Ryan Grant says the design came from feedback from ESET clients and partners, along with a survey of 2,000 SMB customers earlier this year. About 70% of those customers had some sort of antivirus tool, and less than half had tools such as multi-factor authentication, EDR, monitoring, or email security.
What does ESET PROTECT include? Ryan Grant describes an out-of-the-box cybersecurity-as-a-service offering built natively into one platform, where those pieces are typically stitched together with different consoles. It combines AI-led security, advanced endpoint protection, EDR, 24/7 AI monitoring with human oversight, Microsoft and Google environment coverage, premium support, and a cyber warranty. It comes in three packages: Core, Premium, and Ultimate.
Core includes the latest security protocols with AI, endpoint, server, and mobile protection, and management of Google and Microsoft environments. Ryan Grant describes it as just short of an EDR because it leaves out 24/7 monitoring. Premium adds EDR, 24/7 monitoring from the ESET SOC, the cyber warranty, and premium support. Ultimate adds a dedicated SOC analyst for the business, a human with eyes on glass 24/7 working with an additional team behind the scenes.
How does ESET PROTECT reach organizations with 10 seats? Sean Martin raises the divide between the haves and the have-nots, and asks whether a 15-person or 20-person shop can get the same level of protection. Ryan Grant says platforms with this security and services typically serve 500 or 600 seats in most cases, or 250 and above, and ESET took this one down to 10 seats. His reasoning is that SMBs were the biggest vulnerability point because they lack the budgets and the staff.
Many organizations cannot find security talent and many cannot afford it, Ryan Grant says, which is why he calls 24/7 monitoring the most critical piece. Partners told him last week that they consistently see breaches in the middle of the night and wake up to notifications about an incident ESET saw, how it was contained, and recommendations for what comes next. Ryan Grant says there is no silver bullet, and ESET aims to right size what each organization needs.
Where is the platform running? Ryan Grant says ESET sees it in legal offices, dental offices, regional retailers with offices behind several shops, education, and municipalities. Sean Martin adds that regulation brings overhead that makes it hard to achieve what the regulation is trying to accomplish, and puts it to Ryan Grant that ESET makes meeting the requirement feasible in a fiscally sound way.
How does the cyber warranty fit with cyber insurance? Ryan Grant says the warranty wraps around the ESET offering, and ESET's partnership with Cysurance is part of the launch. Sean Martin puts it that the controls he describes bring confidence and proof to the insurers, and Ryan Grant agrees. Cyber insurance takes a significant set of basics, including multi-factor authentication, a remediation plan, training, and EDR, and customers who meet the requirements can also go get a policy.
How should organizations approach AI tools and agents? Sean Martin points back to polymorphic viruses a decade or two ago, says he does not believe AI is so novel that organizations do not know what to do, and Ryan Grant agrees. Ryan Grant says to extend the existing cyber practice into AI tools, with governance, access control, a repository of approved tools, and attention to where data sits. He treats an AI tool like another employee with access to the infrastructure, and Sean Martin adds that employees plus things acting like employees add a wild card.
Ryan Grant sees the gap in baseline policy for what is allowed, governance of applications and data, and access controls, with shadow AI appearing when employees download the tools they need. He points to the ESET Research GuardBreaker article, where a malicious file carried a nuclear weapon prompt as a decoy for the AI. His response is multilayer defense, 24/7 monitoring, and human oversight.
For agents, ESET offers a free AI Skills Checker that sandboxes an agent and watches its behavior. Ryan Grant says about 900,000 scans over roughly two months turned up 25,000 suspicious scans and about 3,000 malicious files. People can call ESET, visit its website, or go through one of more than 2,000 partners across the US and Canada. ESET is making the portfolio available first in the United States, Italy, and Slovakia, with other markets following in a phased rollout.
Questions Answered in this Conversation
What does ESET PROTECT include, and how do the Core, Premium, and Ultimate packages differ?
Can an organization with 10 seats get the same level of protection as a larger one?
How does a cyber warranty fit with cyber insurance?
How should organizations manage AI tools and agents, and what does a free AI Skills Checker look at?
This is a Brand Story. A Brand Story is a ~35-40 minute in-depth conversation designed to tell the complete story of the guest, their company, and their vision. Learn more: https://www.studioc60.com/creation#full
GUEST
Ryan Grant, Country Manager & GM, North America at ESET
LinkedIn: https://www.linkedin.com/in/ryangrant/
RESOURCES
ESET: https://www.eset.com/us/
ESET PROTECT launch announcement: https://www.eset.com/us/about/newsroom/products/eset-protect-ai-native-cybersecurity-as-a-service/
ESET and Cysurance cyber warranty and insurance program: https://www.eset.com/us/about/newsroom/company/eset-preferred-mdr-vendor-cysurance-cyber-warranty-insurance-program/
ESET secure AI era page: https://www.eset.com/us/business/secure-ai-era/
ESET AI Skills Checker: https://www.eset.com/us/home/ai-skills-checker/
ESET Research on GuardBreaker: https://www.welivesecurity.com/en/business-security/guardbreaker-derailing-ai-assisted-malware-analysis-code-comment/
The AI Readiness Gap report: https://web-assets.eset.com/fileadmin/ESET/US/B2B_Resource_centre/whitepapers/Global_AI_ESET_SMB_Cyber_Readiness_Index_2026.pdf
ESET PROTECT launch video: https://youtu.be/0aPI7PkPTsw
Are you interested in telling your story?
▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight
▶︎ Want your brand on ITSPmagazine? Explore all of the options here: https://www.itspmagazine.com/advertise
KEYWORDS
Ryan Grant, ESET, Sean Martin, brand story, brand marketing, marketing podcast, ESET PROTECT, managed detection and response, MDR, EDR, cyber warranty, Cysurance, cyber insurance, AI security, shadow AI, AI agents, AI Skills Checker, GuardBreaker, SMB cybersecurity, small business cybersecurity, 24/7 monitoring, cybersecurity as a service, MSP, channel partners

⬥EPISODE NOTES⬥
Something structural is shifting in how security work gets done. When anyone on a team can stand up a working tool in an afternoon, the constraint stops being capability and starts being coherence. John Linford, Security Portfolio Director at The Open Group, spends his time on exactly that problem, running the Security Forum, the Open Trusted Technology Forum, and the Assured Dependability Work Group, where practitioners from organizations of wildly different sizes argue their way toward standards that are supposed to survive contact with reality.
His framing of the tool question is blunt and worth stealing. When a team says it can build the thing, the first response is to ask what decision the thing informs. A dashboard showing numbers nobody was looking at before is not a security improvement, it is a new source of numbers. Standards, in this reading, are not compliance artifacts to be shown to an auditor. They are the thing that tells an organization which part of the problem a tool is supposed to solve, and how it fits alongside everything else already in place. The corollary matters just as much: when the tools themselves conform to a standard, vendors compete on the value they actually deliver rather than on the cost of switching away from them.
Linford takes the same argument up a level to architecture. Security architecture only works when it sits inside a broader enterprise and IT architecture rather than beside it, and that requires a CISO with genuine authority and a seat at the executive table. Where that authority is thin, The Open Group's Security Forum has leaned on the idea of security champions, people embedded across teams who do not need deep security skills but do need to know when to pull a specialist into the room. Getting that right moves the security conversation into the design phase, which is the only place it is cheap.
The scaling question gets an honest answer. The Open Group operates on one vote per member organization, which means a three-person shop carries the same weight in a final standard as Microsoft or RTX. That structure forces the standards to be implementable by organizations that have no security architect at all, and it shows up in deliberate choices like defining roles rather than job titles, because in a small company one person wears eight of them.
Then there is zero trust, which Linford describes with a line that circulates as a running joke inside the Security Forum: it is just what cybersecurity should have been from the beginning. The Zero Trust Commandments trace directly back to the Jericho Forum's deperimeterization work from the 1990s, and they fit on a single page on purpose. Secure assets according to their value and the damage their compromise would cause, and the spending priorities sort themselves out. The alternative, as he puts it, is announcing you will implement all five hundred-odd controls in NIST 800-53 and wishing yourself luck.
His closing point is the one most likely to sting. Security practitioners are fluent in security and frequently illiterate in business. Telling a board that twenty controls are required for conformance with the EU Cyber Resilience Act invites one question about cost. Telling them the same work opens a market and removes a year of analysis before expansion is a different conversation entirely, about the same twenty controls.
⬥GUEST⬥
John Linford, Security Portfolio Director at The Open Group | On LinkedIn: https://www.linkedin.com/in/johndouglaslinford/
⬥HOST⬥
Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/
⬥RESOURCES⬥
The Open Group | https://www.opengroup.org/
The Open Group Security Forum | https://www.opengroup.org/forum/security-forum-0
Zero Trust Commandments | https://pubs.opengroup.org/security/zero-trust-commandments/
Zero Trust Architecture at The Open Group | https://www.opengroup.org/forum/security/Zerotrust
The TOGAF Standard, 10th Edition | https://www.opengroup.org/togaf
Open Trusted Technology Forum | https://www.opengroup.org/forum/trusted-technology-forum
The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
⬥ADDITIONAL INFORMATION⬥
🎧 More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
📺 Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
📰 Subscribe to The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity
✉️ Connect with Sean Martin | https://www.seanmartin.com/
⬥KEYWORDS⬥
john linford, the open group, sean martin, zero trust, security standards, enterprise architecture, togaf, security governance, ciso leadership, security architecture, open standards, security culture, supply chain security, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

⬥EPISODE NOTES⬥

For a full year, agentic AI was the pitch. This year the conversation shifted to whether it holds up once it is actually running in production, against real work. Vendors came armed with customer-sourced numbers rather than concept demos — hours returned per analyst per week, percentages of alerts dispositioned without human review, agreement rates measured against human analyst judgment. Buyers arrived having spent the months since the previous major conference testing products and weighing what they were told against what they saw.

Not one of the four questions that dominated the show is exciting, and not one of them is actually an AI question. Naming an owner before something ships is governance. Showing your work is audit. Knowing where your components came from is supply chain hygiene. Configuring a tool to reach the outcome it was bought for is the oldest plain, unrewarded work there is. AI did not create those problems — it made them impossible to keep deferring. Marketing volume held steady. Scrutiny went up.

In this edition of Lens Four:

🔹 Why the easy read on Black Hat USA 2026 — that AI arrived — is a year late, and what moving from pilot to production actually exposed underneath it

🔹 The 4 questions that replaced the whether debate: who is accountable, what is the evidence, where is the data coming from, and is the foundation configured to hold the weight

🔹 How production turned governance into a named, accountable owner assigned before an agent ships, with a documented business justification behind it

🔹 The sharpest reframe of the week: a rogue agent is usually not malfunctioning, it is doing exactly what it was told, relentlessly, until it succeeds

🔹 The Midnight in the War Room session on the gap between people authorized to take risks and people expected to mitigate them, and why burnout rather than obsolescence is the analyst risk to manage

🔹 Why "black box" became unacceptable, and the 2 ways teams are validating: reading the reasoning trail directly, and replaying historical alerts against what human analysts already concluded

🔹 Sovereignty getting repaired in real time, from a geography and compliance word into a control word about who owns the derivative value of an organization's data

🔹 AI's own supply chain, and the 2 capability gaps leaders keep naming: a basic AI inventory, and third-party visibility into which vendor products already have AI embedded in them

🔹 The Vulnerability Research in the Agentic Age keynote on a pipeline producing well over 1,000 potential local privilege escalation findings, and why discovery got cheap while absorption did not

🔹 Post-quantum timelines compressing from 10 to 15 years toward as little as 3, and why crypto-agility belongs in the refresh cycle rather than a standalone initiative

🔹 What buyers were actually shown: roughly 75 percent of 10,000+ daily alerts cleared without primary analyst review, up to 19 minutes returned per analyst per hour at 99.7 percent agreement with human verdicts, and analyst throughput moving from about 10 closed alerts per shift to 50 or 60, all vendor-reported rather than audited

🔹 The 47 AI SOC vendors counted on the floor, roadmaps compressing from 12 to 18 months down to 3 to 6, and why the market got louder exactly as buyers got more specific

🔹 Why token costs that are not falling set a ceiling on adoption pace that governance readiness cannot lift, and what that means for consumption-based pricing

🔹 Why a resurgence of value-added resellers and system integrators is the market pricing a job that has to happen somewhere: which products fit which environments, and how you connect it all

Fourth Lens: Proof does not transfer. Different analysis approaches expose different properties, which makes tool efficacy hard to compare in the abstract, and prioritization frameworks are already moving toward environment-specific attributes. A number on a vendor slide came out of someone else's alert mix and someone else's data — it is evidence of something, but it is not evidence about you. So the burden lands partly on the buyer, with a split most people get wrong. The vendor owes the apparatus: a visible chain of reasoning, audit logs, the ability to replay your own history, and hands-on access without a six-month procurement cycle in front of it. The buyer owes the environment and the baseline. Neither side can produce the answer alone, and human on the loop is what that bargain looks like once it is running. If scrutiny only works when you have built something capable of doing the checking, what have you built?

▶ Full article and references: seanmartin.com/lens-four

▶ All Black Hat USA 2026 conversations: ITSPmagazine podcasts playlist

▶ Subscribe to Lens Four: seanmartin.com/lens-four

▶ Redefining CyberSecurity Podcast: redefiningcybersecuritypodcast.com

▶ Music Evolves Podcast: musicevolvespodcast.com

▶ ITSPmagazine: itspmagazine.com

▶ Studio C60: studioc60.com

Sean Martin, CISSP is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and the Music Evolves Podcast, and the author of Lens Four, a weekly column on business, innovation, and messaging at seanmartin.com.

Keywords: Black Hat USA 2026, agentic AI, AI SOC, security operations, non-human identity, agent accountability, named accountable owner, rogue agent behavior, AI governance, chain of reasoning, human on the loop, AI supply chain, AI inventory, sovereignty, post-quantum readiness, consumption-based pricing, proof of value, CISO decision making

⬥EPISODE NOTES⬥

Tidal is about to stop paying royalties on any track it judges to be fully machine-made. Frame that as a music story and you miss the shift underneath it. By Deezer's own detection, roughly 75,000 AI-generated tracks now arrive every day, about 44% of everything uploaded, yet that same AI music is only 1 to 3 percent of what people actually play, and around 85% of those streams are flagged as fraudulent. The flood is not an audience. It is an attack on a shared payout.

This edition follows one pattern across six industries: when the cost of generating something collapses toward zero, platforms stop paying for output and start paying for proof of human origin. Tidal cuts AI royalties. The Authors Guild sells a "Human Authored" badge for ten dollars a title. YouTube demonetizes "inauthentic" content. curl killed its bug bounty after a flood of AI slop, then reopened when the slop got good. And where no gatekeeper owns the payout, hiring, the open web, the scientific record, the flood just degrades the mechanism until no one trusts it.

In this edition of Lens Four:

🔹 Tidal's July 15 policy ends royalty attribution and direct-to-fan sales for fully AI-generated tracks, a payout decision, not a content ban.

🔹 Deezer takes in about 75,000 AI tracks a day (44% of uploads), up from roughly 10,000 a day at the start of 2025, while human uploads barely moved.

🔹 The paradox that reframes the debate: AI music is 44% of uploads but 1 to 3 percent of listening, and about 85% of those streams are fraudulent.

🔹 The first US criminal AI streaming-fraud case: Michael Smith pleaded guilty after collecting more than 8 million dollars in royalties from hundreds of thousands of AI songs and roughly 1,000 bot accounts.

🔹 curl shut down its bug bounty under a flood of AI vulnerability reports, then reopened a month later because the AI reports got good enough to read. Cutting the money did not cut the volume.

🔹 The counter-case: recruiters see about 11,000 job applications submitted to LinkedIn every minute, up 45% in a year, with no single payout to switch off.

🔹 Provenance becomes a product: Suno (2 million subscribers, about 7 million songs a day) adds identity-verified voice cloning while the Authors Guild sells human certification.

🔹 The danger tier: roughly 20% of AI-recommended software packages do not exist (slopsquatting), and close to 10% of cancer papers show paper-mill signatures.

🔹 The language turned first: Merriam-Webster made "slop" its 2025 word of the year, and YouTube quietly renamed "repetitious" content to "inauthentic."

🔹 Human filters see it clearest: DJ Sam Young asks why we need fifty versions of the same thing, and producer Gregoire Gensollen says he will remember the human moments, not the tool.

Fourth Lens: The three lenses meet at one move. Platforms re-price payouts around human origin, the market builds products that certify it, and the language teaches us to want it. That is not a defense of artists, it is a paywall around authenticity, sold as virtue, and it is arriving before audiences even asked for it. Reality has come at a premium, exactly as predicted in 2017. So the real question is not whether the real is worth more. It is this: when proof of human becomes a product, who is making the money, and who handed them the right to decide what counts as real?

▶ Read the full article and references

▶ Subscribe to Lens Four

▶ Redefining CyberSecurity Podcast

▶ Music Evolves Podcast

▶ ITSPmagazine

▶ Studio C60

Sean Martin, CISSP, is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and Music Evolves Podcast, and writes Lens Four at seanmartin.com.

Keywords: AI-generated music, Tidal, Deezer, streaming fraud, provenance, content authentication, Human Authored, Authors Guild, Suno, slopsquatting, curl bug bounty, AI slop, paper mills, AI job applications, Merriam-Webster slop, DJ Sam Young, Gregoire Gensollen, Sean Martin, Lens Four

⬥EPISODE NOTES⬥

Almost every booth at Infosecurity Europe 2026 had settled on the same four words. Outcomes. Resilience. Sovereignty. Human in the loop. The messaging had grown up, more tempered than RSAC, more honest in its European register. The tell was quieter — almost none of it could connect those words to a definition of success a buyer could actually verify.

Strip away the polish and the show floor was a working argument about what the cybersecurity market is for, at the exact moment the clock that governs it collapsed to seconds. The go-to-market caught up to the language. The capability did not. This is the prove-it problem, and it is worth pulling apart clearly.

In this edition of Lens Four:

🔹 Why the quiet vocabulary convergence mattered more than any single product launch — outcomes, resilience, sovereignty, and human in the loop became the words everyone said, and almost none could tie them to a definition of success a buyer could verify

🔹 The number that should reorganize every SOC — the jump from initial access to the next stage collapsing from 8 hours to 22 seconds, with ransomware finishing in under an hour, most often on a Wednesday night

🔹 How Qualys reframed measurement itself — a client environment of 62 million risk findings cut to under 1% that could actually be executed, because the dashboard was never the deliverable, remediation was

🔹 Why Corelight put the same test on the detection itself — a black box tells you little, so keep the data behind every alert in the open and let an analyst prove what it actually is, the way one proof of value surfaced unencrypted sensitive traffic in 30 minutes

🔹 How Sumo Logic showed the repeatable version — prove a fix once, then let an agent apply that proven fix across 599 identical machines under human oversight, and its move into the AWS European Sovereign Cloud put something concrete under the week's sovereignty talk

🔹 What the criminal economy revealed as the honest mirror — an underground market for AI attack tools that went from 38 posts to over 1,400 in two months, tiered and redundant, an AI call center for hire that sounds like SaaS

🔹 Why the board's only real question, are we okay, now lands on the CISO as personal liability, just as AI moves from experimentation to deployment inside the organization

🔹 How consolidation and absorption are sorting the floor — 40-plus tools in silos, "make us relevant" becoming an executive hire, and the 12-to-18-month reckoning where AI absorbs functions that fill today's expo hall

🔹 The tell underneath all of it — when every booth converges on the same three or four words, the words stop doing the one job language has at a trade show: helping a buyer tell two things apart

Fourth Lens: The vocabulary moved faster than the products underneath it. The industry repositioned around outcomes without ever defining the outcome, and the bill comes due over the next 12 to 18 months, not because AI arrives, but because AI removes the last place to hide the question. Naming the outcome was the easy part. Proving it repeats, across environments and teams and budgets that share nothing but the problem, is the part the vocabulary skipped. When the story can no longer be rounded up, are we okay, and can you prove it twice?

🥁 🎶 A very big THANK YOU to our Infosecurity Europe 2026 Full Coverage Sponsors: Corelight · Qualys · Sumo Logic 👏 👏 👏

▶ Full article and references

▶ Full Infosecurity Europe 2026 coverage

▶ Subscribe to Lens Four

▶ Redefining CyberSecurity Podcast

▶ Music Evolves Podcast

▶ ITSPmagazine

▶ Studio C60

Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and Music Evolves Podcast, and co-host of On Location and Random and Unscripted. Learn more at seanmartin.com.

Keywords: Infosecurity Europe 2026, cybersecurity go-to-market, security marketing, vendor positioning, machine-speed attacks, agentic AI, ransomware economics, post-quantum cryptography, boardroom liability, digital sovereignty, security tool consolidation, network detection and response, mean time to resolve, threat intelligence, resilience, Sean Martin, Lens Four