In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon.

🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio
🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors
🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze
🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows
🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses
🔗 Chaining vulnerabilities and what separates a checkbox test from a real one
💸 Why pen testing so often becomes an ineffective use of resources
📋 Compliance and contractual drivers vs. genuine risk reduction
🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement
🤝 Engaging pen testers as partners and maturing the process over time
🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring
🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare
🥃 Bourbon tasting and discussion

⏱️ Timestamps
00:00 Intro
01:26 Guest introduction & background
02:18 RareMed Solutions & patient assistance programs
05:01 Book writing & amateur radio
08:11 BSides Pittsburgh overview
15:04 Running a conference: planning & organization
22:05 Marketing & audience engagement
25:07 Dividing responsibilities as you grow
27:59 The value of ticket pricing
31:50 BSides & the conference model
46:11 Penetration testing & scoping
57:28 The purpose of pen testing
58:23 When pen testing goes wrong
01:00:16 Reasons for pen testing & compliance drivers
01:03:04 Continuous monitoring, testing & detection
01:06:19 Is your company ready for a pen test?
01:07:07 A risk-based approach
01:13:58 Scenario-based testing & resilience
01:17:31 Evaluating the value of pen testing
01:29:01 The constant state of change
01:31:01 Compliance & cyber insurance
01:32:19 Bourbon tasting
01:36:32 Government scoring & risk analysis
01:50:36 HIPAA compliance & ransomware
01:55:01 Wrap-up & call to action

🎧 Distilled Security Podcast

Cybersecurity, GRC, and leadership, one pour at a time.

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

🎤 Guest

• Jon Buhagiar linkedin.com/in/jonbuhagiar

📬 Send Us Your Questions!

ask@distilledsecuritypodcast.com

🌐 Connect with Us

Website: distilledsecuritypodcast.com

X: @DisSecPod

YouTube: @distilledsecurity

Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for monthly

security and compliance insights.