The Security Chiefs Who Finally Get to Tell Their Stories

Key points

• Red Mirror Studios launched an 11-episode documentary series called "Declassified" on 28 July 2026, days before the Black Hat USA security conference in Las Vegas.
• The series features 11 current and former chief information security officers (CISOs) from enterprise, government and critical infrastructure organisations speaking publicly about breaches and burnout.
• In one episode, Chainguard CISO John Sapp Jr. Describes criminals stealing $2 million from a manufacturing company through a fake bank phone call.
• Former healthcare CISO Tyson Kopczynski says the stress of protecting patients with almost no budget pushed him to leave the industry entirely.
• The series is produced independently after the original project lost backing when investors demanded editorial changes the founders refused to make.

The people responsible for keeping your hospital and your utility company safe from hackers are, almost by definition, not allowed to talk about what they do. When a breach happens, lawyers step in, statements get scrubbed. The actual story stays behind closed doors. A new documentary series wants to change that.

"Declassified" is an 11-episode series produced by Red Mirror Studios, an independent film company focused on cybersecurity. The first episode aired on 28 July 2026. It was filmed in March at the RSAC Conference, one of the biggest annual security industry gatherings, held in San Francisco.

How did a $2 million theft happen in a single phone call?

Criminals stole the money using social engineering, meaning they manipulated a real person into handing over access rather than breaking through any technical barrier. A bank that John Sapp Jr. Worked with was adding multi-factor authentication, an extra identity check beyond a password, when the criminals spotted an opportunity. They called someone, pretended to be the bank, sounded legitimate. Two million dollars left the account.

Sapp was CISO at a global medical device manufacturer with offices in Brazil when the incident happened. He now holds the same role at cloud security company Chainguard and appears in the first episode of "Declassified." He spoke to Dark Reading about why he decided to go on camera after years of silence.

"I think it's a healing opportunity because we had to carry this stuff bottled up inside of us for so long," Sapp said.

For context on how social engineering works and why it's so effective, see our plain-English guide to the technique.

Why don't security leaders speak out more often?

Two reasons. First, most of what a CISO knows is legally confidential. Second, speaking openly about a past breach can make the next job harder to get. The CISO role has only existed as a formal position for about 25 years, and its norms are still being written.

Tyson Kopczynski, a former CISO in finance then healthcare, hit his limit and left the industry entirely. Healthcare organisations typically run on tight budgets while protecting some of the most sensitive personal data imaginable, and attack fallout in that sector can affect patient care directly. The gap between expectation and available resources was, in his words, unbearable.

He is now a partner at White Rabbit VC, a venture capital firm. "We talk in our own language typically," he told Dark Reading. "We're not good at telling stories because either we can't tell them because we're not allowed to, or we don't have the language to speak in those terms."

That communication failure has practical consequences. When the people defending critical systems cannot describe what they do, the public cannot advocate for the resources those defenders need. Our story from 3 August found that 98% of cybersecurity leaders now report job stress, with researchers calling the design of the role itself a structural problem.

Should you worry about the backstory behind this series?

The series nearly never happened. Red Mirror founders Danielle Lewan and Clint Howard II previously worked on a separate project, "CISO: The Worst Job I Ever Wanted," while Lewan was director of global marketing at security company Nagomi Security. The lead investors later demanded they drop certain participants and rename the series, fearing the original title would put people off entering the CISO role. Lewan refused. The investors controlled the funding and had the final say. Lewan and Howard walked.

They found new backers who shared their commitment to unedited stories and built Red Mirror Studios around that principle.

In practice, the audience for a series like this isn't just security professionals. Sapp makes the point plainly: if ordinary people understood why strong passwords and scepticism toward unexpected phone calls matter, some of the incidents in the series would never have happened.

If your employer sends a breach notification letter, or if you get an unexpected call from your bank asking you to confirm details, call the bank's published number back yourself.