How Many CTOs

Setting the Tone: Building Trust Through Security

How Many CTOs

Show Notes

In this episode of "How Many CTOs Does It Take?" podcast, hosts Scott Porad and Brad Hefta-Gaub discuss the role of CTOs in setting a security-minded culture and provide real-life anecdotes of security breaches and incidents. The conversation covers critical frameworks like CIS, SOC 2, and tools like Vanta, Wiz, Drata, and AWS Security Hub. They emphasize the importance of incident response, continuous vulnerability management, and making security practices an effortless part of development workflows. The episode concludes by highlighting the urgency of adapting to new security challenges posed by AI and other technological advances. 00:00 Introduction and Episode Kickoff 01:05 The Role of the CTO in Security 04:40 Real-World Security Incidents 08:08 Incident Response and Security Culture 12:42 Frameworks and Best Practices 21:44 Human Factors in Security 25:34 Supply Chain Attacks 26:26 Best Practices for Software Inventory 27:23 Setting Priorities for Vulnerabilities 34:30 Automating Security Checks 36:08 Tools for Compliance and Security 40:48 The Importance of Trust in Security 49:15 Final Thoughts and Conclusion Resources: How Many CTOs Pod: https://howmanyctospod.com Scott Porad: https://www.linkedin.com/in/scottporad/ Brad Hefta-Gaub: https://www.linkedin.com/in/bradheftagaub/ #TechPodcast #EngineeringPodcast #DevTalks #PodcastForDevs #HowManyCTOs #Podcast #CTOs #CTOPodcast #ChiefTechnologyOfficer #Technology #Engineering #SoftwareDevelopment #SoftwareEngineering #TechLeadership #EngineeringLeadership #EngineeringCulture #TechDebates #Security #SecurityIncidents #IncidentResponse #SecurityCulture #SoftwareSecurity #SupplyChainAttacks #SecurityChecks #ComplianceAndSecurity #AI #Vanta #Wiz #Drata #AWSSecurityHub #CIS #SOC2

More from How Many CTOs

Oct 20, 2026

In this episode of "How Many CTOs Does It Take?" podcast, hosts Scott Porad and Brad Hefta-Gaub interview software pioneer Kent Beck about his background (JUnit, test-driven development, extreme programming, Agile Manifesto, and his book "Tidy First?") and his current focus on "augmented development" with AI, which he calls a "genie." Beck argues that while AI shortens the build–feedback loop, it can also remove productive struggle that builds competence, agency, and flow, leaving developers exhausted and hollow. He critiques the "agent" metaphor, long tool latencies, and productivity measured as more code, proposing tools optimized for sub-second feedback, smaller safe increments, and even pushing changes to production thousands of times a day. Beck predicts programming demand will rise (Jevons Paradox), but warns mid-level "paycheck" developers must adapt. He advises leaders to use the tools themselves, build trust, and adopt via the technology adoption curve rather than mandates and layoffs. 00:00 Cold Open 00:22 Meet Kent Beck 04:31 Early Computing Origins 07:49 XP and AI Shift 11:29 Augmented Development Feel 13:06 Struggle Builds Competence 17:18 Beyond Agents Metaphor 20:39 Toil Versus Struggle 25:03 Flow and Feedback Loops 27:38 Amanuensis Junior Programmer 29:52 Manager Mode Reality 32:54 Optimize for One Second 36:35 Tech Cycles And Humans 41:01 Jobs And Jevons Paradox 46:56 Rethinking Productivity 52:15 Limbo Micro Deployments 56:01 Tool Seeds Sharing 59:34 Debugger Joy And TDD 01:02:19 Leading Adoption With Trust 01:08:57 Wrap Up And Credits

Oct 13, 2026

In this episode of "How Many CTOs Does It Take?" podcast, hosts Scott Porad and Brad Hefta-Gaub discuss TaskRabbit's overnight AWS region migration from us-west-1 to us-west-2, describing the months of preparation, detailed runbook, large war-room call, minor cleanup issues, and why periodic region moves can serve as valuable "hygiene" to relearn and document complex systems while advancing disaster recovery and business continuity. They then explain tabletop exercises as structured incident-response drills designed to uncover gaps in process and documentation, sharing scenario ideas like data deletion, token leaks, cloud outages, ransomware, and internal actors, including an embezzlement case where the perpetrator joined incident response. The conversation touches on an alleged AI sandbox escape involving Hugging Face, then debates claims that "unit tests are dead," arguing AI makes end-to-end testing easier but unit, integration, contract, and mutation testing remain important—especially for edge cases and dependency failures—and that agents can now generate extensive test coverage.

Oct 6, 2026

In this episode of "How Many CTOs Does It Take?" podcast, hosts Scott Porad and Brad Hefta-Gaub discuss growing fear about AI among engineers and managers, framing it as an "adaptive moment" requiring leaders to disrupt old stabilizing practices. They explore concerns that AI lowers the barrier for others to change systems, increasing accountability, on-call risk, and architectural drift—problems that existed pre-AI but are now intensified. Their proposed response is to strengthen the software factory/SDLC with non-human, deterministic guardrails: robust automated tests, CI/CD quality gates, mutation testing, and better observability, rather than human gatekeeping or fiefdoms. They share examples of risky AI agent behavior (attempting to access credentials to reorder Jira tickets) and real-world harm from AI claim adjudication pilots, concluding that best practices are now the floor and that engineers who build quality gates become more valuable. 00:00 Cold Open 01:04 AI Fear in Engineering 02:00 Adaptive Leadership Moment 03:55 Software Factory Mindset 06:10 Fear of Accountability 08:09 Old Problem New Pressure 11:58 Non Human Quality Gates 13:41 Scaling Creates Fiefdoms 16:34 Architecture Agent Example 20:26 Apocolyptic AI Concerns 23:51 AI in Medicare Risks 32:29 Best Practices Are Floor 33:41 Wrap Up and Subscribe

Sep 29, 2026

In this episode of "How Many CTOs Does It Take?" podcast, host Brad Hefta-Gaub is joined by guest Frank Bravo, a Bay Area technologist who spent 30 years as CTO in local media, helping put a newspaper's full editorial content online in 1994, and now serves as CTO at ProLegal, a legal services startup. Frank describes modernizing an old Act! database into a custom CRM, launching ProLegal Suite, and building systems that integrate with Uber and Lyft to schedule client rides on a lien. He explains how ProLegal uses AI to analyze case documents and train models on company-specific context, while keeping humans in the loop and reviewing AI-generated code. The conversation focuses on simplifying technology for non-technical users, the importance of shared terminology, troubleshooting and telemetry, and advice for CTOs on communicating clearly without acronyms.

Sep 22, 2026

In this episode of "How Many CTOs Does It Take?" podcast, hosts Scott Porad and Brad Hefta-Gaub discuss how AI is changing software engineering referencing Kent Beck's idea that AI makes much existing knowledge less useful while making a smaller portion far more valuable. They describe teams collaborating through "cohorts" of AI agents for PR review and adversarial checking, and debate whether engineers will be evaluated on agent quality versus their ability to direct and manage agents like a driver or jockey. Scott shares TaskRabbit's approach to shifting from organic AI adoption to "systemic usage" using an AI maturity matrix, gap analysis, and incremental rollout of agents (code review, security, architecture) with a six-week versioned cadence to help the whole organization keep up. They address skepticism, incentives in for-profit organizations, and the rapid pace of AI tooling innovation.

See all episodes →