EP 29 — Age of Learning's Carl Stern on Why Certifications Are Side Effects, Not Final Goals

Carl Stern, VP of Information Security at Age of Learning, explains why forcing controls into place without executive alignment guarantees you'll fight uphill battles every single day, as people begin to see security as a blocker rather than a business enabler. Instead, he starts with identifying crown jewels and acceptable risk levels before selecting any frameworks or tools, ensuring the program fits company culture instead of working against it. 

He also asserts that certifications like HITRUST and SOC 2 validate you're already operating securely; the real program is the daily processes people follow because they understand why, not compliance theatre. Carl also argues the cybersecurity industry exists at its current scale because of a systemic failure: companies ship insecure software without liability, pushing security costs downstream. Most breaches exploit preventable defects that should never reach production, not sophisticated zero-days. 

Topics discussed:

• Building security programs from scratch versus inheriting existing programs and why executive alignment prevents daily uphill battles

• Treating certifications as validation of operational security rather than the primary program goal

• Pairing administrative controls with technical monitoring to establish baselines before enforcement for unstructured data security policies

• Applying three-part investment calculus for lean teams: measurable risk reduction, manual work automation, and crown jewel protection

• Calculating true cost of 24/7 internal SOC coverage including shift staffing, turnover, training, and tooling versus managed services

• Why attack patterns remain consistent across healthcare, education, gaming, and retail despite different compliance requirements

• Explaining how AI lowers the barrier for exploit development and expands zero-day risk beyond traditional high-value enterprise targets

• Arguing that the cybersecurity industry exists at current scale because companies ship insecure software without liability, pushing costs downstream