Practical Cybersecurity with Jen Stone
Practical Cybersecurity, hosted by Jen Stone (MCIS, CISSP, CISA, QSA), is the bridge between complex security frameworks and real-world business implementation. Whether you are a "Jack of all trades" IT manager or a business leader with limited resources, this show provides the roadmap to a defensible security posture.
Practical Cybersecurity with Jen Stone
AI Didn't Change the Rules, It Raised the Stakes (ep.13)
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
You can pass your PCI assessment and still be leaking cardholder data. In e-commerce, compliant and secure are not the same thing — and AI just made the gap between them a lot harder to ignore.
In this episode, SecurityMetrics Principal Security Analyst Jen Stone is joined by forensic investigator Aaron Willis and [HOST NAME] for a practitioner panel on how AI is reshaping attacks on cardholder data — and why passing PCI DSS 4.0.1 isn't the same as being safe. It's a repurposed webinar built around what auditors and forensic investigators are seeing in the field right now.
In this episode:
- Why passing PCI (especially SAQ-A) doesn't mean your checkout is secure
- Why PCI DSS 4.0.1 already covers AI without ever naming it
- Where e-commerce skimmers really hide — and how one defeated a top detection agent
- Requirements 6.4.3, 11.6.1, and SAQ-A FAQ 1588, decoded
- The payment-redirect trap: the convenience attackers are cheering for
- How AI reshapes your risk analysis, MFA, and third-party obligations
- Treating compliance as security: a three-tier framework
Chapters:
(0:00) Why we're running the AI panel
(1:08) 2026 forensic & cyber predictions
(3:42) Inside 2,000+ e-commerce cases
(4:54) Shopping Cart Monitor: one skimmer a week
(6:35) What Specter AI does
(8:06) The skimmer that beat a detection agent
(10:19) Real-time and agentless defense
(11:52) PCI DSS 4.0.1 and AI
(14:05) Script security: 6.4.3, 11.6.1 & FAQ 1588
(17:30) The payment-redirect trap
(19:56) AI-impacted requirements
(24:18) Compliance as a security framework
(26:28) Script inventory on the checkout page
(27:35) Listener Q&A
(35:45) Public vs. private AI tools
(37:51) Final tip: AI raised the stakes
Follow Practical Cybersecurity so you don't miss an episode. If this one helped, pass it to someone on your compliance or security team.
Watch the full video version on YouTube: https://youtu.be/-CPruQnGRpc
About SecurityMetrics:
SecurityMetrics helps organizations secure payment data and meet PCI DSS. We're a certified PCI Qualified Security Assessor (QSA), Approved Scanning Vendor (ASV), PCI Forensic Investigator (PFI), and P2PE Assessor.
A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.
Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place
But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/