Defending Trust and Baselining Behavior with NewYork-Presbyterian VP & CISO John Frushour

0:04Hi there, and welcome to Enterprise AI Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, Fortune 500 CISOs share how AI has changed the threat landscape, real-world examples of modern attacks, and the role AI will play in the future of cybersecurity. I'm Evan Reiser, the founder and CEO of Abnormal AI.

0:26Mike Britton: And I'm Mike Britton, the CIO of Abnormal AI. Today on the show, we're bringing you a conversation with John Frushauer, Vice President and Chief Information Security Officer at New York Presbyterian. New York Presbyterian is one of the nation's largest academic medical centers, defending patient care across a massive hospital network. That scale makes John's focus on human behavior rather than just tooling especially powerful. A few things stuck with me from this conversation. First, John thinks the real ceiling of a mature security program is baselining human behavior. Once you know what a good actor looks like, a bad actor stands out.

0:59Even a skilled attacker can't mimic those patterns perfectly. Second, the thing that keeps John up at night isn't a clever exploit. It's trust. We get used to answering the calendar invite from our boss, and social engineering weaponizes that habit in a hundred different ways. And finally, John's best defense against AI-powered attacks is turning everyone into a security engineer. He wants every nurse, clinician, and financial analyst carrying the flag because attacks are still aimed at human trust.

1:32John, well, first of all, thank you so much for joining us on the show. Do you mind telling our audience a little bit about kind of your background and maybe how you got to where you are today? I enlisted in the Marines initially as I was in the infantry. I was what's called an 0313 LAV crewman. I drove a little kind of like a tank. Most people would probably think of it as a tank, but it's actually a little different than that. And I drove that for a little while. Then I took a commission right after first deployment for the invasion in 2003 and had a career as an officer, a communications officer, which is pretty fantastic.

2:02Got my flair for Block & Tackle IT. And then when I retired, I worked for Motorola right before the split when Google acquired half of the company and did more networking IT stuff, network security stuff. got into enterprise operations, NOC SOC, architecture, delivery, building data centers, supporting data centers, remote sites, whatever. And then I had a brief stint at a software company and then went to Nuance where I ran the security for the line divisions of that company. Nuance back then was organized into kind of a corporate division and then separate revenue or line divisions, one for mobile and auto and one for enterprise and one for cellular.

2:45And then Siri was in there as well. And eventually ended up in NYP doing the security thing again and CISO. John, I'm not trying to lead the witness here, but there's not a lot of people I talked to who both enlist in the Marines, stayed for a while, who are not kind of mission-oriented. So I don't, I'm not sure I'm pushing that direction. But when you think about kind of what inspires you today, right? You know, BSCs is a tough job, right? Working cybersecurity is a tough job in 2026. There's easier things out there, right? That would certainly maybe let you sleep a little easier. What kind of like inspires you?

3:17What motivates you? Like kind of why do it? I would say it's the team. It's the people more than anything else. It's the glee, the energy that comes off of young engineers as they focus on hard problems to solve. We get the hard problems. InfoSec naturally sits, I've heard a lot of analogies, the tail that wags the dog, the ivory tower, the top of the stack, infosec technically sits in places where you kind of see all and touch all because we have to. The nature of our business is everything's commingled. And so seeing an engineer, you know, latch on to a task or a problem and touching all those familiar disciplines of IT to solve it is a pretty incredible thing.

3:57It's just challenging people of any age to explore and learn to typically and most often outside of maybe where they came from in IT or outside of IT, but InfoSec is a stimulating career field because of that. And as a leader, I take extreme joy in helping them, aiding them, providing to them so they can do that.

4:17Mike Britton: How has the role of the CISO changed over the last few years? You've done this for a while. You've probably seen some evolution in the role itself. Maybe some things that have evolved, some things that may have changed from when you first became a CISO. It's hard for me to say, like, really what's changed. I think the tools have changed. And really, they've just gotten better. Instead of operating with some rusty, ferrite-composed shovel, we've got this titanium, platinum, perfectly weighted, graphite-handled beauty of a shovel. The tools have matured, but I'm not so sure that really the game has changed that much to a point where we would ignore history.

4:57we would ignore the counsel of, you know, our elders, our smart people that have come before us.

5:04Mike Britton: So maybe a follow up. Do you think there's been a change in the expectation from boards or senior leadership on what the CISO should be or how they should function? It remains the case that every board member or any C-level executive still wants the CISO to kind of keep us safe. We're the watchers of the wall, right? Watchers on the wall, excuse me. Isn't that a Jimi Hendrix song? He'd be upset with me. We are the watchers on the wall, providing defense of our institutions, and in some cases, offense, depending on your particular institution. That has always been the same. What I'm really happy to see, though, is folks that traditionally didn't have an exposure to cyber, didn't grow up with this theme as they develop businesses or led businesses.

5:50Now, maybe you'd call it kind of like the baby boomer era generation, is starting to kind of a turnover with the next generation that did grow up on Nintendo and MTV and did grow up, you know, with Game Boys. And I was trying to think of the pocket organizer, it escapes me, but BlackBerrys and all these technologies. And so what I think the perspective has shifted to not just wanting to know that we're safe, but also wanting to know how we're safe. Given we have some new technology, obviously like AI is the thing of the topic of every conversation today. But I imagine like if we kind of keep playing forward with, we have new technologies, AI or otherwise, there's probably things we can do that behavior in 2027 that weren't possible five years ago or 10 years ago.

6:32You know, what do you see as some of the opportunities there? And are there like things that, you know, you maybe think some of your peers should be thinking about kind of as we go into that potential future for cyber? So I think SOX and security teams, if you're starting from scratch, you're mostly event driven. Somebody clicked on that. What do I do? Someone sent this information. What do I do? What does the analyst, the engineer, the manager, what does the CISO do? Early on security programs or security programs maybe that suffer from a lack of investment are heavily focused on just event-driven analytics.

7:04That's where we started too. Eventually you'll mature into correlation and you'll start putting events together just to string them into incidents. You'll create an incident response playbook if you don't have one already. and you'll start looking for, well, this event and this event, but not this event. And only if this event goes above this threshold, do I action on it? And I think that's kind of like what's a CMMI levels or maturity levels. One of those levels, right? I've not wrote a book on this, but eventually what you'll end up getting to is behavioral analytics. You'll get to the point where, okay, I have all these events and I have all this data and I have all this signal from our user base.

7:44how do I discern what I actually investigate? How do I discern what's meaningful or not? Because we have a lot of automated systems to take care of those. You clicked on something bad or you installed something you shouldn't have, or, you know, we've automated a lot of that. And so we get to the point where how do we tell the difference between a good actor and a bad actor? What is the bad actor doing that the good actor doesn't? As humans, we're creatures of habit. We like our habits. We go back to habits. The American economy is built on habits of going right back to the same place for the same thing constantly over and over and over again.

8:20That's human nature. And so if you can baseline the behavior of a good actor, when that bad actor comes into your world, they're not going to look like the good actor. They're going to have different sets of patterns. And if they're a really good bad actor, they're going to try to mimic the behavior of a good actor. but they can't do it perfectly. And I think the zenith of the maturity of a security program is baselining human behavior to the point where you can get really, really good at looking for anomalies in human behavior. I'm curious, like in the context of cybersecurity, what are some of the applications of AI that you think maybe there's like more opportunity there than the average person and where do you think there's less opportunity?

9:01Modeling and essentially using AI to enable the digital twin construct. We've heard the digital twin for years. It's kind of like UVA.

9:16It's out there. Nobody's really mastered it yet. But I think it's a terrific use of AI to give rise to the digital twin to simulate and emulate how your network might behave as a result of remediation or defense. Where do you feel like maybe some things

9:33Mike Britton: are shifting in the threat landscape because attackers do have easy accessibility to large language models, whether that's the, you know, the foundation ones or whether that's, you know, things like DeepSeek or local models or whatever it may be. It's kind of leveled the playing field and opened the door to a whole new set of threat actors that probably were on the sidelines before AI. The ability for attackers to prey on human weakness. And sometimes we say weakness or comfort. I've heard laziness. But it's not really laziness in the negative sense. It's just you get used to doing those things.

10:09You get used to clicking on certain things, using multi-factor, responding to multi-factor fatigue, responding to emails or calendar differentations from your supervisor. You get used to these things. And it's amazing to me how easy they can be exploited because of trust. It's not laziness. It's just you trust that that's there. It works. It's supposed to be like that. And that's how you operate every day. I think it's just the compromise of that trust through attacks based on social engineering in a hundred different ways. That's what keeps me up at night because it's just so damn easy to exploit.

10:44AI is getting really good at like come up with really sneaky social engineering schemes that even like some of the smartest people like would never dream of. And some of these are even kind of unrecognizable by humans. What is the consequence of that, right? Does it change how we need to even think about what the threat vectors are, right? Or does it cause reconsideration of the threat model? Does it change the skills we need on our teams or the expectations we need from technology providers to kind of counteract that? We want everyone to be a security engineer. We want every nurse, every frontline nurse, every clinician, every administrator, every back office technician and financial analyst to carry the flag of information security.

11:23And I don't know of another way to do it than to saturate them as much as possible with propaganda, you know, with annual training and with bulletins, bolos, be on the lookout, you know, email awareness. Some larger institutions have like a web page, a centralized place to get all your information and intranet advertisements. And then, of course, celebrating the heroes. You know, this person defended against this attacker that tried to impersonate someone and change their credit checks or their cash check banking account. I can't even think of the name. Sorry. But these types of things, celebrating, highlighting the misses in the most positive a way so that we can reinforce not doing it again.

12:07But this campaign of kind of highlighting the importance of InfoSec, I think is probably one of the best defenses to AI-based attacks being so much more targeted, wailing at certain individuals and precise. The accuracy and the precision of these attacks has been amplified. There's no doubt, but they're still the same types of attacks. I think as we grow cybersecurity and buy-in from individuals just entering the workforce today is way better than it was 20, 25 years ago. They're just way more sensitive to it. Were there things you observed through, you know, at the Marines or, you know, even in the rest of your kind of your journey career, any sort of leadership observations or principles that have kind of been really effective for you as you're kind of building and developing, you know, cybersecurity teams today?

12:55Part of my training was to drill into me that the troops come first. And so I think prioritizing their ability to execute has to be the most important thing a CISO can do. I'm not watching the sim. I'm not getting, well, I guess I do get a few alarms, but I'm not reacting to those alarms. I'm not working with the end users. They're like, what are you doing? Is this you? What's going on? What did you click on? Like, you know, I'm not doing that stuff. What my primary occupation is to enable our engineers, our architects, what I would call our front line, to be successful in their duties. Are they trained appropriately?

13:34Are they stimulated? Are they working on problems that can be solved? We're not trying to find the next NP complete problem out here and, you know, figure it out. We're trying to put our time and effort into real things that we can get something out of. Maybe we change the defense. Maybe we do some education. But, you know, I think enabling them and ensuring that their support comes before any new investment or new technology or whatever. The troops must always come first. The engineers, the defenders must always be my priority. And I'm not always the best at it. If any of them are watching or will watch this, I remember the time when you said, I'm human.

14:14I make mistakes. But that is something that I try to align myself to. The other thing I would say for CISOs, for like the director level and above that are making hiring decisions and trying to staff their teams or grow their teams, I will take initiative over technical acumen any day of the week. An engineer who has the initiative and the drive to maybe explore something that they don't understand or they they're fearful of their contribution might be meaningless while they don't understand it, but yet still steps into that room will get hired every day of the week. I will always take you can train technical acumen.

14:53Even the rocks among us can learn a few tricks. Right. But if you don't have the initiative or the zeal to lean into this field, it can be very hard to be successful, at least with me and I think in other information security teams.

15:07Mike Britton: What are some things we've done well in the community to get better representation and leadership? And where are ways where we're still not quite where we need to? And what do we need to do about that? When we started the information security team, when it started here at NYP, it was relatively non-diverse. And I think that's the case at most institutions, meaning it's typically dominated by males. I would say it's not so dominated by one particular, like white males, Asian males, black males. It's not a particular dichotomy of males as much as it's just males. And I think one thing I took away from my experience in the Marines is the familial sensation of having both females and equal distribution of females and males in the same team.

15:53There's it's just our human nature. It's the way that we're coded. And you have to appreciate that as a leader enough to understand how it can spawn new ideas and how people can have different perspectives. And I've learned a lot from a lot of prominent female leaders in my career of how women view certain job wrecks and goals and projects and milestones and timelines and deliverables versus how men view them. and no one's wrong, but not having an appreciation for both sides of that coin, your team can suffer. I think I'm very fortunate that I work in probably the most diverse city in the world where you walk down the street in Manhattan and you'll hear six different languages while you're trying to get a coffee.

16:39It's a wonderfully diverse area, but it's not like that in Springfield, Illinois. No offense to the population of Springfield, Illinois, but, you know, there probably doesn't have the same diversity of community as we do in New York. And so you have to be mindful of that and you have to watch out for, hey, are we thinking the right way here? It seems like we're in our own echo chamber. Let's, you know, reach out. I'd like to end the episode with a couple like we call lightning round questions. We're looking for like your one tweet response. Two questions are very difficult to answer in like one sentence.

17:13And so hopefully you'll still stay friends with us after we go through these five questions. But Mike, why don't you kick it off for us?

17:20Mike Britton: Yeah. So what's a piece of advice you'd have for a security leader stepping into their very first CISO job? Maybe something they would overestimate or underestimate about the role. Have a healthy paranoia and don't believe immediately that everybody's telling the truth, especially as a new CISO when you're coming in. And some of the expectation is you're going to be looking under couch cushions that the previous leader did not. or maybe there wasn't a leader. Maybe this is a new position elevated from a manager role or something like that. And a lot of people will come into the role and, hey, we're good on this technology and this is working just fine and we're getting the alarms and we're doing everything right and we're looking for whatever.

18:04And I'm not saying what's the X-Files mantra, like don't trust anyone. I can't remember what it is, but similar to that. I'm not saying don't trust anyone, but just have that healthy paranoia. If somebody tells you that something's working fine and there's no threats and it's configured appropriately and there's no vulnerabilities and whatever, it's like, meh. Like, it's probably a little too strong. If that doesn't work and that's a little too pragmatic, there's another five-word ditty that I live by, which is expect what you inspect and inspect what you expect. And that means go looking for the things that you expect to see.

18:44And then when you see them, don't be surprised. What would be your advice about how maybe some of your peers should really stay up to date with the latest technology trends, whether it's AI or otherwise? Get involved in the ISAC. Get to the forums. Check the forums once a day. What are people talking about? Conferences are also a great way if you have the budget for something like that or local security groups or something like that. But honestly, the biggest one is just socialize. And it can be hard. You get a lot of people in InfoSec that are kind of introverted because they just love spending eight hours in the basement chasing the rabbit on some hard problem.

19:22And those are great InfoSec engineers. Those type of people are just ridiculously committed to solving the problem. Love that community. But you kind of need to get out there, especially in the leadership roles, and talk to your peers. as much to discover what lousy CISOs are focused on as much as the good ones are focused on. Because you'll be able to tell real quick which ones are just faking it because they don't have a problem saying no and someone needed to put a person in that role to say no.

19:54Mike Britton: Hey, you mentioned some good books already, but is there one book that you've read that's had an especially big impact on you and your career? And it doesn't necessarily have to be cyber related. You can look up a guy named Rick Evans, who used to be the CSO at Palo Alto. I think he's doing his own thing now, but he maintains a cyber reading list. It has a cute name, and I'm blanking on it, but you can easily Google him. Former Army Colonel, retired Army Colonel, ran the Red Team at a JITIC at one point in his life. He's got kind of the canon, the cyber canon. That's what it's called. I finally remembered.

20:30The cyber security canon, and it's just a reading list. and basically anything that that man puts on that list sign it buy it go to go to amazon and get it because i guarantee you it'll be a gem when he first started this he queried a bunch of us and like what do you think what should you put on there and it was a unanimous vote that a book called the cuckoo's egg by cliff stoll was kind of maybe the first book on the cyber canon on rick's cyber canon the cuckoo's egg is is as much of a kind of a tom clancy for nerds novel as much as it's a computer history novel, as much as it's just an appreciation for hippie culture in Berkeley in the late 70s.

21:10But it is the first kind of documented, I think it's still the first documented remote cyber attack ever, I'm pretty sure. And Cliff goes through, Cliff was the unknowing kind of recipient and defender. And he goes through physical remediation to digital remediation to discovery to offensive security. And it's just an amazing story, an amazing, amazing story about people trying to get into Berkeley and steal state secrets. John, one last question. Can I give you the one sentence version of this one? What's your kind of message or what do you want? How do you want to, what would you say to kind of like the next generation of security leaders, right?

21:51If someone's maybe thinking about joining the cybersecurity field, they're thinking about joining your team, they think about joining our kind of civilizational defense force. What's, What would be your message to them? I don't know if it's going to sound more somber than the intent, but I think about that quote from Saving Private Ryan when Tom Hanks' character is dying, sitting next to this tank, and Matt Damon leans into him and he says, earn this. To be a competent, capable, contributory security engineer, you're probably going to have to go through a lot of stuff and learn a lot of fundamentals that maybe you didn't expect.

22:33I think our education system in this country is, in the last 25, 30 years, has really understood what cybersecurity is and promoted all kinds of different cyber education programs and certifications and quick wins, quick four-year cyber degrees to get you out there and get you into a SOC and get you monitoring events, which works. And you might make a career out of it. But I also think that understanding the fundamentals of Boolean logic, linear algebra, finite and non-finite automata, discrete functions, modeling and statistical math for statisticians or maybe computer security for statisticians or stats for cyber or whatever the word is.

23:25But these fundamental disciplines that probably might not be in a SANS course or a one-week boot camp, the foundational nature of them will make you head and shoulders above your peers. I like it. Well, John, thank you so much for joining us today. It's been really inspiring hearing you talk and share your ideas about the past, present, and future. And I'm looking forward to doing it again sometime soon. Thanks, guys. That was John Freshour, Vice President and Chief Information Security Officer at New York Presbyterian.

23:56Mike Britton: I'm Mike Britton, the CIO of Abnormal AI. And I'm Evan Reiser, the founder and CEO of Abnormal AI. Thanks for listening to Enterprise AI Defenders. Please be sure to subscribe so you never miss an episode. Learn more about how AI is transforming cybersecurity at enterprisesoftware.blog. This show is produced by Abnormal Studios. See you next time. Thank you.