🎙 BARCELONA CYBERSECURITY CONGRESS
BCC Podcast: cybersecurity conversations
without filters
The official video podcast of Barcelona Cybersecurity Congress. Host Scott MacKenzie (Industrial Talk) sits down with CISOs, founders and researchers to talk about what really happens on the front line of cybersecurity: real threats, real decisions and ideas you can take back to your team.
Use code BCCPODCAST26 for a discount on your pass
4 episodesTop CISOs & expertsRecorded for BCC26
ALL EPISODES
Press play and level up your security thinking
Resilient architectures, CISO leadership, the psychology of human risk and identity-first security: four conversations with the people shaping the future of cybersecurity.
EP 01 · SOUNIL YU · 39 MIN
The DIE Triad: making cybersecurity irrelevant in the AI age
Why systems built to be Distributed, Immutable and Ephemeral need far less security, and how AI changes the game.
“We can either DIE intentionally, or we can die because the attacker has done it for us.”
DIE TriadResilienceAISecurity architecture
Sounil Yu
Cybersecurity veteran with 30+ years in the field, former Chief Scientist at Bank of America and creator of the Cyber Defense Matrix and the DIE Triad.
Can AI make cybersecurity irrelevant? Sounil Yu explains why systems built to be Distributed, Immutable and Ephemeral (DIE) need far less of the classic CIA triad (confidentiality, integrity, availability) and how AI is turning companies into high-velocity engineering organisations.
- âś“The more DIE, the less CIA. Short-lived, immutable, distributed assets lower your security burden: a vulnerability matters less if the asset is gone tomorrow.
- âś“AI enables high-velocity engineering. When rebuilding software is cheap, you can replace it faster than attackers can exploit it.
- ✓Pets vs. cattle. Some systems (hospitals, critical data) will always need protection; build everything else as disposable “cattle”.
- âś“Short term, attackers have the edge. Expect the next ~18 months to be hard for defenders as they ramp up on AI.
- âś“For newcomers: stay curious. Experiment with new technology, break it and learn from failure.
EP 02 · RUBÉN CORTÉS & ANTONIO DELGADO · 68 MIN
CISO Roundtable: real threats, real decisions, no BS
Two CISOs separate real threats from the noise: provider concentration, ransomware, cyber insurance and the board.
“Stop thinking that cybersecurity is a technical question. Talk about risks, not firewalls. Talk about business, not networks.”
CISO leadershipThird-party riskNIS2OT security
Rubén Cortés & Antonio Delgado · Global CISO Council Spain
Rubén Cortés, Director of Technology and Cybersecurity at Consorci AOC (serving around 2,200 Catalan public bodies), and Antonio Delgado, CISO of an international education group with around 30 schools in Europe, Latin America and the US.
Two CISOs from the Global CISO Council Spain chapter separate real threats from the noise: from dependence on a handful of providers to ransomware in schools, OT security, cyber insurance and how to talk to the board.
- âś“Real threats vs. hype. Concentration of services in few providers, third-party risk and ransomware/phishing are real; fully autonomous AI attacks are, for now, mostly noise.
- âś“The maturity gap. Small municipalities and schools often have no CISO and are prime ransomware targets.
- ✓Prepare before the incident. Contain, communicate and recover from an alternative instance. Frameworks like ISO 27001, NIST and Spain’s ENS force you to prepare.
- âś“Plan for provider failure. Multi-cloud, sovereign cloud and at least two providers per critical service.
- âś“Talk business, not firewalls. Present cyber risk to the board in terms of impact, and remember NIS2 fines.
- âś“Cyber insurance now requires maturity: MFA everywhere, backups, incident response plans, EDR and vulnerability management.
EP 03 · CHRISTIAN REINHARDT · 43 MIN
Why AI scams work on smart people, and how to stop the mechanism
Falling for a scam is about emotion, not intelligence. Simple habits to stop the mechanism at work and at home.
“Most attacks are successful not because we’re too stupid, but because we’re very emotional.”
Human riskPhishingSecurity awarenessPsychology
Christian Reinhardt · SoSafe
Sports psychologist at SoSafe who studies cybersecurity from the human side: how attackers manipulate behaviour and how to build lasting security habits.
Falling for a scam is not about intelligence, it is about emotion. Christian Reinhardt explains how attackers trigger strong emotions to bypass rational thinking, and gives simple, science-backed habits to protect people at work and at home.
- ✓It’s emotion, not intelligence. Attackers trigger fear or desire so we act before we think.
- ✓The 25-second rule. In SoSafe’s phishing simulations, 95% of people who clicked did so within the first 25 seconds. If in doubt, lock your screen and grab a coffee.
- âś“Ask someone else, verify through another channel. A second reader is less emotional; never use contact details from the suspicious email.
- âś“Attackers love short weeks. Busy days before bank holidays are peak phishing time.
- ✓Make awareness positive. Win people over, celebrate “cyber heroes” who report threats and show progress, like a personal trainer at the gym.
EP 04 · DARREN JAMES · 43 MIN
Identity-first architecture: proving you are you in the AI era
Voice cloning, stolen session cookies and MFA bypass: why identity and trusted devices are the new perimeter.
“Where is your security perimeter these days? It’s not the network. It’s the device you log in with.”
IdentityZero TrustMFASocial engineering
Darren James · Specops Software
Identity specialist at Specops Software (part of the Outpost24 group) with 15 years in cybersecurity, after starting his career on the IT service desk and running Active Directory for global companies.
Strong passwords and MFA are no longer enough. Darren James shows how attackers use AI voice cloning to fool service desks and steal session cookies to bypass MFA, and why the answer is identity-first, zero-trust security that users don’t hate.
- âś“The service desk is a target. With AI, anyone can clone a voice and build a convincing profile from LinkedIn; knowledge-based questions (date of birth, postcode) are not proof.
- âś“Verify identity for real. Government ID plus a liveness selfie, enforced before any password reset.
- âś“MFA can be bypassed. Adversary-in-the-middle phishing and infostealers steal session cookies after you log in.
- âś“Trust the device, not just the user. Bind credentials to known devices: the device is the new perimeter.
- ✓Security without friction. Self-service fixes, “Fix now” buttons and grace periods keep the business running.
ABOUT THE PODCAST
About the BCC Podcast
The BCC Podcast brings the conversations of Barcelona Cybersecurity Congress to your screen all year round. BCC is the cybersecurity event organised by Fira de Barcelona in collaboration with the Cybersecurity Agency of Catalonia, bringing together CISOs, public institutions, companies and startups.
In every episode, host Scott MacKenzie (Industrial Talk) talks to the experts shaping the industry, from the DIE Triad and CISO leadership to the psychology of phishing and identity-first security, with practical ideas for security teams of any size.
Podcast listener discount: use code BCCPODCAST26 when you register for BCC26.
Get your pass →
Frequently asked questions
What is the BCC Podcast?
The BCC Podcast is the video podcast of Barcelona Cybersecurity Congress (BCC). Each episode is a conversation with CISOs, researchers and security leaders about real threats, real decisions and practical ideas for security teams.
Who hosts the BCC Podcast?
The episodes are hosted by Scott MacKenzie of Industrial Talk, who will also broadcast live from Barcelona Cybersecurity Congress 2026.
Who are the guests?
Sounil Yu, creator of the Cyber Defense Matrix and the DIE Triad; Rubén Cortés and Antonio Delgado from the Global CISO Council Spain chapter; Christian Reinhardt from SoSafe; and Darren James from Specops Software.
What topics does the podcast cover?
Resilient security architecture and the DIE Triad, CISO leadership and third-party risk, the psychology of phishing and human risk, and identity-first, zero-trust security.
Is there a discount for BCC26?
Yes. Use the code BCCPODCAST26 when you register for Barcelona Cybersecurity Congress 2026 to get a discount on your pass.
When and where is BCC26?
Barcelona Cybersecurity Congress 2026 (BCC26) takes place on 3–5 November 2026 at the Gran Via venue of Fira de Barcelona, Hall 2, Barcelona.
Where can I watch the episodes?
All episodes are available on this page and on YouTube.
Want to be part of the conversation?
Meet these voices live at BCC26. November 3–5, 2026 · Barcelona, Gran Via venue, Hall 2.
Use code BCCPODCAST26 for a discount on your pass.