Can security certifications keep pace with the products they’re meant to assure?Recorded live at the International Common Criteria Conference (ICCC) in Rome, this special edition of Trust & Turbulence brings Ashit Vora and Shawn Geddis back for a candid conversation about the future of security certification.We explore what happens when products evolve faster than their certificates, where AI and automation can help, and which decisions still need human judgment. We also tackle a potentially disruptive question: could vendors eventually conduct their own Common Criteria testing using scheme-approved tools—and what would that mean for evaluation labs?This episode continues a conversation that began on the ICT Compliance Podcast. Start with Part 1, then join us here for the rest of the discussion, including a question from our live audience. Listen to Part 1 on ICT Compliance: https://open.spotify.com/episode/76WhS7i1SVA7QjNUaOInGK?si=mvzFr6h5QBivbgnDHbxL9A

What would you automate first—and what would you always keep in human hands?

Share your thoughts in the comments.

Audio note: This conversation was recorded live at a conference. Audio quality varies; on-screen captions are included to help you follow along.

Subscribe to Trust & Turbulence for more conversations about security, compliance, technology and leadership.

#CommonCriteria #Cybersecurity #TrustAndTurbulence 00:00 — Live from Rome: Can Certification Keep Up?06:10 — AI and Automation: What Should Stay Human?10:35 — Who Has to Change? Vendors, Labs and Schemes14:45 — Could Vendors Test Their Own Products?

What happens when an AI speaks in a living expert’s voice, and who are we actually trusting? In the latest episode of Trust and Turbulence, Josh Brickman talks with @AngelaCMeyers author of Versatile: Human Intelligence in an Artificial Age, about meeting futurist Ray Kurzweil, talking with his AI avatar “Rai,” and why polymathic thinking matters more as AI takes over specialized work.In this episode: • What polymathy is, and how a polymath differs from a dilettante • Lunch with Ray Kurzweil and his view of AI’s promise and risks • What it’s like to talk with Rai, Kurzweil’s AI avatar • How to think about trust, authority and accountability when AI speaks for a real person • Why organizations still need specialists, and why AI makes integrators more valuable • The Knower Learner Assessment (26 questions, about 10 minutes) About the Guest:Dr. Angela C. Meyers is an organizational development expert and published author specializing in human intelligence, adaptive leadership and integrative thinking in the age of AI. She wrote the first doctoral dissertation devoted to modern polymathy, later published as In Pursuit of Polymaths, and is the author of Versatile: Human Intelligence in an Artificial Age and creator of the Polymathic Method.00:00 Dr. Angela Meyers–Trust, Accountability, and AI Avatars01:54 What Is Polymathy?06:55 Meeting Ray Kurzweil and Rai22:43 Trust and the Human Advantage in an AI WorldMentioned in this episodeDr. Angela C. MeyersWebsite: https://www.drangelameyers.comVersatile: Human Intelligence in an Artificial Age: https://a.co/d/05Kq494fKnower-Learner Assessment: https://www.drangelameyers.com/knowerlearnerCollective Intelligence Labs: https://www.drangelameyers.com/collectiveintelligencelabVersatile Leadership Training: https://www.drangelameyers.com/versatileleadershiptrainingPolymath Unleashed (online course): https://www.drangelameyers.com/polymath-unleashed-course

Youtube channel: https://www.youtube.com/@AngelaCMeyersFacebook: https://www.facebook.com/groups/polymathsplace

Producer: M. Gillan RitchieMusic by Mikhail Smusev from PixabayAnimation and Logo by Edith Brickman

Cybersecurity threats are evolving faster than the certification programs designed to provide assurance. So can programs like Common Criteria and FIPS keep pace?In this episode of Trust and Turbulence, I’m joined by Alicia Squires, Industry Principal for FIPS at AWS, and Kevin Micciche, Chief Technologist at HPE, two long-time practitioners in security certification and cryptography. We start with SolarWinds and a deceptively simple question: could a security evaluation have caught it? From there, the conversation moves to the tension between rigorous assurance and getting products to market, and why developing the next generation of security evaluators matters.Then we turn to Q-Day and post-quantum cryptography: crypto inventories, cryptographic agility, migration challenges, and what vendors and governments should be doing now. We also explore an increasingly important wildcard: AI. Could AI change the cryptographic threat? Can it find vulnerabilities that previously weren't practical to exploit? And can the same technology be used to make security certification faster without sacrificing trust?Finally, we look ahead at a world where security requirements are multiplying rather than converging—and ask whether AI, automation, and better reuse of security evidence can help certification keep up.Disclaimer: Views expressed are the guests' own and do not represent their employers.About the GuestsKevin Micciche is Chief Technologist for HPE Networking Platform Trust, where he leads work in cryptography, platform security, and the transition to post-quantum cryptography. A longtime security certification practitioner, Kevin has certified more than 150 products spanning 16 years against Common Criteria and FIPS requirements. https://www.linkedin.com/in/micciche/Alicia Squires is the FIPS Security Industry Principal on AWS's Cryptography team, with more than 25 years of experience in security certification, cryptography, and international compliance. Previously, she spent 15 years at Cisco, including leading its Global Certifications Team. Alicia is also a founding member of the Common Criteria Users Forum and served as its Chair for seven years. https://www.linkedin.com/in/alicia-squires/Title Chapters and Timestamps00:00 Kevin Micciche and Alicia Squires00:53 Can Security Certification Prevent the Next SolarWinds?13:52 Who Will Be the Next Generation of Security Evaluators?19:51 PQC, Q-Day and the AI Wild Card33:49 Can AI Fix Security Certification?40:17 The Future of Security CertificationMentioned in this EpisodeAWS CMVP queue-time dashboards, posted via the Cryptographic Module User Forum — https://cmuf-workspace.org/Products/Projects/Messages.aspx?prjID=17&id=622#ICT Compliance Podcast with Matt Campagna on post-quantum cryptography — https://youtu.be/oaZmlzcHrmc?si=709A7zkiLIfF2XHnICT Compliance Podcast with Dr. Lily Chen (NIST) — https://youtu.be/oaZmlzcHrmc?si=709A7zkiLIfF2XHnFilippo Valsorda on AES-128 and Grover's algorithm — https://words.filippo.io/128-bits/NIST CSWP 39, on cryptographic agility — https://csrc.nist.gov/pubs/cswp/39/considerations-for-achieving-cryptographic-agility/ipdExecutive Order 14028 (software supply chain and SBOMs) and Executive Order 14412, Section 6(b) (CMVP acceleration)-- https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurityOMB M-21-07, the phased IPv6 mandate Kevin offers as a model for PQC migration– https://www.gsa.gov/directives-library/internet-protocol-version-6-ipv6-policy-1Cryptographic Module User Forum (CMUF) — free to join — https://www.cmuf.org/Music by Mikhail Smusev from PixabayAnimation and Logo by Edith Brickman