What a CISO and Marketing Partnership Actually Looks Like with Jason Rebholz of Evoke Security

**SPEAKER_1** (0:02)
You're listening to the CyberWire Network, powered by N2K. Welcome to the Breaking Through in Cybersecurity Marketing podcast, where we explore the hottest topics in cyber marketing, interview experts, and help you become a better cybersecurity marketer.

**Gianna Whitver** (0:28)
Hello, and welcome to another episode of Breaking Through in Cybersecurity Marketing. I'm your host, Gianna, here with my buddy and our super amazing guest, Jason Rebholz. He is founder and CEO of Evoke Security. Jason, so much for being on the show today. Tell us a little bit about you. Why did you start Evoke Security?

**Jason Rebholz** (0:50)
So, I had a moment where it was the cataclysmic event that I could see happening, unfolding right in front of us. And so, the genesis was I read a blog post, which I feel like every good story has to start with a blog post.

**Gianna Whitver** (1:05)
This is the first time someone started that answer with, I read a cataclysmic blog post.

**Jason Rebholz** (1:11)
Well, because it was really a fundamental reshaping for me of what we're walking into with agents. And so, this was a blog post around MCPs, and they were just highlighting, hey, there's this one risk. They called this out, there is a fundamental infrastructure challenge that we have here. And for me, that was the reshaping where I saw the whole path of AI unfold right in front of me. It was the yellow brick road for me.
And I realized we're repeating the same exact mistakes that I saw of 20 years in cybersecurity, and we were starting at the same exact point, going down the same exact path, but it was going to be so much more painful because we're doing this at the speed of AI. And so for me, I just went back to all of my experience doing incident response as a CISO and said, okay, I have an opportunity here to get ahead of the pain and try to solve this before we go way off the rails here.

**Gianna Whitver** (2:13)
Okay, so what was that pain, that like that long standing like, oh, I'm seeing it again, but it's gonna be happening faster than ever. Like, what was that pain?

**Jason Rebholz** (2:23)
For me, I grew up doing incident response, which incident response is where you're going in after a company has been hacked. So the damage has already been done. And I'm there to kind of clean up the pieces, figure out what happened and put it all back together so that that company can get back to business as usual. When I looked at this, what I saw was, we have an AI agent that employees are connecting absolutely everything to. Why?
Because it's the only way that they actually get the results. And so for me, I had this instance where, this situation where I started playing with Claude Cowork, and within 10 minutes, I disabled every single security feature on it, because without it, it was just a chat bot. And I don't need a chat bot, right? I need something that's going to do tasks for me.

**Gianna Whitver** (3:10)
If you have it downloaded to your desktop, you can actually give it permissions to access things on your computer and act on your behalf. Am I right, Jason?

**Jason Rebholz** (3:17)
It's spot on.

**Gianna Whitver** (3:18)
We also don't use it, but I like look at it longingly.

**Jason Rebholz** (3:21)
That's what we're trying to solve for, because I saw the value of that, as everyone else does, but there's this just like this concerns, this anxiety of what's the trade off that I have to give in order to move faster, right? The trade off is security, and that uncertainty of, is this going to do something I don't want to do on my behalf? Then I get blamed for it, right?
And so, what we're doing is we're coming in and saying, we want employees and users to go as fast and hard as they possibly can with local agents, like co-work, but the second they're about to drive off a cliff, we're going to nudge them right back in a safe direction. So, we're giving these safe boundaries for it to work in without pestering them with all these different pop-ups and warnings, we want to give them the latitude to work and move as quickly as they can with all of the safety and security built in.

**Gianna Whitver** (4:13)
You were an incident responder, but you also were a CISO at a previous company. So, you were a CISO at Corvus, which is a, if I remember correctly, a cyber insurance company, correct? That's right. And you were the CISO, not like a field CISO, field CISOs are great, but you were like the CISO there. And when we were talking in our scoping call, you were talking about your philosophy and how you worked with the marketing teams at Corvus.