Cloud Security Podcast
- Episodios
- 366
- Se publica
- cada semana
- Último episodio
- 12 Nov 2026
Sobre el podcast
Learn Cloud Security in Public Cloud and for AI systems, the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We are honest because we are not owned by Cloud Service Provider like AWS, Azure or Google Cloud. We aim to make the community learn Cloud Security through community stories from small - Large organisations solving multi-cloud challenges to diving into specific topics of Cloud Security. We STREAM interviews on Cloud Security Topics every week on Linkedin, YouTube and Twitter with over 150K people tuning in.
Episodios 366
How to Scale Cloud Security with Auto-Remediation
When Cloud Security Posture Management (CSPM) tools generate thousands of low and medium-severity alerts, security teams often struggle to manage the infinite backlog. Many organizations avoid auto-remediation …
Notas del episodio
When Cloud Security Posture Management (CSPM) tools generate thousands of low and medium-severity alerts, security teams often struggle to manage the infinite backlog. Many organizations avoid auto-remediation due to the fear of breaking production environments and losing the trust of their engineering teams. However, by implementing strict guardrails and transparent communication, auto-remediation can become a powerful tool for standardizing security across complex, multi-cloud environments. In this episode of the Cloud Security Podcast, Ashish sits down with Andoni Alonso Fernández, DevSecOps Engineer, Crossmint and Samuel Burgos López, Senior Infrastructure Engineer, Flywire to discuss their pragmatic approach to auto-remediation. They share how their small team utilized infrastructure-as-code and open-source tools like Steampipe to automate fixes across AWS, GCP, and Azure. We speak about the importance of building trust with Site Reliability Engineers (SREs) by offering bypass options, configuration locks, and thorough testing in isolated environments. By automating the resolution of repetitive, low-risk issues like enabling default EBS encryption security teams can drastically reduce their alert fatigue and focus on complex, high-value architectural challenges.
Guest Socials - Samuel's Linkedin + Adoni's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to Auto-Remediation in Cloud Security(01:50) Samuel and Andoni’s Backgrounds in Network Security and SRE(04:00) Why Auto-Remediation Initially Failed the Industry(05:50) Standardizing Compliance Across Multi-Cloud Environments(08:30) Building Trust with Engineering and SRE Teams(11:50) Navigating Security Challenges During M&A Integrations(16:50) The Architecture of Safe Auto-Remediation (Lambdas and SQS)(18:00) Implementing Guardrails: Configuration, Locks, and Bypasses(20:50) Balancing Preventative Controls with the CSPM Alert Backlog(24:00) How to Safely Start an Auto-Remediation Program(27:30) Recruiting Security Champions for Beta Testing(30:50) How AI Accelerates the Development of Multi-Cloud Remediation Scripts(34:30) Fun Questions: Running, Music, and Thai Food in Adelaide
Resources spoken about during the episode:
Pentesting AWS Security Agent
When cloud providers introduce autonomous AI agents to conduct penetration testing on customer environments, who is responsible when the AI breaks out of scope?In this episode of the Cloud Security Podcast …
Notas del episodio
When cloud providers introduce autonomous AI agents to conduct penetration testing on customer environments, who is responsible when the AI breaks out of scope?
In this episode of the Cloud Security Podcast, Ashish sits down with Richard Fan, an AWS Security Hero, to discuss his research into the AWS Security Agent (recently rebranded as AWS Continuum). Richard shares how he successfully manipulated the agent to bypass AWS guardrails, utilizing internal DNS spoofing and HTTP redirects to trick the AI into attacking out-of-scope, public targets. We discuss why human pentesters easily spot these anomalies, whereas autonomous agents can suffer from context switching.
The conversation also explores the unexpected costs of running these AI tasks (at $50 per hour), the danger of overly simplistic prefix-matching allowlists, and how the AI agent actively circumvented tool restrictions by writing its own execution scripts.Guest Socials - Richard's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to AI Autonomous Pen Testing(01:50) Richard Fan’s Background as an AWS Security Hero(03:20) What is AWS Continuum (formerly AWS Security Agent)?(08:50) Research Goal: Testing the Guardrails of an AI Pen Tester(09:50) Bypassing Domain Verification using Internal VPC DNS(12:50) The Flaw of AI Context Switching vs. Human Intuition(17:00) Using HTTP Redirects to Force the Agent Out of Scope(20:50) The Danger of Prefix-Matching URL Allowlists(24:00) Redefining the Cloud Shared Responsibility Model for AI Agents(27:30) Why You Should Never Run Autonomous Agents in Production(30:00) The High Costs of Running AWS Continuum ($50/hour)(32:30) How the AI Agent Wrote Custom Scripts to Bypass Tool Restrictions
Resources spoken about during the episode:
Richard's Blog - Pentesting a pentest agent - Here's what I've found in AWS Security Agent
Using LLMs for Enterprise Threat Modeling
Creating an application threat model was a resource-intensive process that took weeks or months, resulting in static documents that were abandoned 80% of the time after their initial creation. However, with …
Notas del episodio
Creating an application threat model was a resource-intensive process that took weeks or months, resulting in static documents that were abandoned 80% of the time after their initial creation. However, with development speeds accelerating through AI, security teams must move away from point-in-time blueprints and adopt continuous, enterprise-wide threat modeling to keep pace. In this episode, Ashish sits down with Ben Oster, CPO at ThreatModeler, to discuss how AI is fundamentally changing how we secure software design. Ben explains how Large Language Models (LLMs) can ingest context from Terraform, code repositories, and Confluence pages to generate comprehensive threat models in minutes instead of months. By integrating AI directly into pull requests, organizations can continuously monitor architectural drift across microservices and reduce the manual burden on both developers and security architects.
Guest Socials - Ben's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to Continuous Threat Modeling(02:50) Ben Oster’s Background in Privacy, Compliance, and Cybersecurity(04:00) Why 80% of Traditional Threat Models Are Abandoned(06:30) How LLMs Generate Threat Models from Repositories and Confluence(08:30) Shifting from Point-in-Time Blueprints to Continuous Assessment(10:30) Integrating Threat Models Directly into AI Engineering Prompts(12:30) Moving Beyond STRIDE: Focusing on Speed and Developer Adoption(15:30) Building Enterprise-Wide Reusable Security Controls(18:30) The "Build vs. Buy" Dilemma for Continuous Threat Modeling(22:30) Managing Cascading Risks Across Complex Microservice Architectures(27:30) Using AI to Reason Through Pull Requests (PRs) and Architectural Drift(33:30) Connecting with ThreatModeler and Upcoming Product Launches
Mythos Hype vs. Reality: Why You Need an Agentic Harness
Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turning on a …
Notas del episodio
Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turning on a model like Mythos without a multi-stage orchestration layer is like handing someone the keys to a Ferrari when they don't know how to drive.
He talks about the 66,000+ CVE "vulnpocalypse" panic and that only 1% of vulnerabilities are ever actively exploited in the wild. We also examine real-world autonomous threats like "Jade Puffer" (the first documented agentic ransomware path) and walk through 3-step maturity framework for enterprise AI adoption: Visibility, Observability, and Actionability via Agentic Governance Gateways
Guest Socials - Johnny's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction: The Mythos Readiness Assessment Hype(01:50) Johnny Hands’ Background & Trend AI’s Mission(03:00) Debunking the Mythos Assessment Panic in Europe and Japan(06:30) Handing over the Ferrari: Why Mythos Fails Without an Agentic Harness(09:30) The "Vulnpocalypse": Clearing 66,000+ CVEs & Finding the 1% That Matter(13:30) Moving Away from "Busy" Metrics: How to Report AI Risk to the Board(17:30) Coupling Low-Severity CVEs with Risky User Behavior(21:00) Inside the Zero Day Initiative (ZDI) Multi-Stage Agentic Harness(25:30) Filtering LLM Hallucinations with Multi-Model Statistical Inference(28:50) Deconstructing "Jade Puffer": The First Autonomous Ransomware Path(35:00) Virtual Patching and Fencing Against Fast End-Day Weaponization(39:00) The 3-Step AI Security Maturity Model: Visibility, Observability, Actionability(44:30) The "You Laugh, You Lose" Cybersecurity Joke Challenge
How Block Solved DNS Vulnerabilities
When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those services are …
Notas del episodio
When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those services are spun down but the DNS records remain, it creates "dangling" domains ripe for takeover, a vulnerability that can compromise entire hosted zones, auth tokens, and session cookies.
In this episode, Ashish sits down with Ramesh Ramani, Staff Security Engineer at Block, to discuss how his team reduced their domain takeover bug bounty reports from over 80 in a single submission down to near zero. Ramesh breaks down the complex challenge of DNS attribution, explaining why automating DNS cleanup is impossible without first identifying resource owners and consolidating approved registrars.
We explore the technical architecture behind Block's stateless, AWS-native automation system, which continuously enumerates their external attack surface and routes vulnerable CNAMEs, MX records, and Elastic IPs directly to the responsible application teams. Ramesh also shares his thoughts on the limitations of AI when evaluating least privilege and parsing logs, emphasizing why security engineers still need deterministic signals.
Guest Socials - Ramesh's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction: The Threat of Domain and DNS Takeovers(01:50) Ramesh Ramani’s Background and 20-Year Tech Career(04:40) Discovering the DNS Problem During Block’s 2020 Cloud Migration(07:00) The Catalyst: Receiving a Bug Bounty Report with 80+ Vulnerable Domains(09:30) Why Third-Party PaaS Providers Can't Fix Your Dangling CNAMEs(13:10) How M&A Activity Creates Orphaned Route 53 Name Servers(16:30) The Difference Between Hosted Zone, CNAME, and MX Takeovers(20:00) Finding 400 Vulnerable Domains and the Challenge of Attribution(23:00) The Registrar Problem: Stopping Developers from Creating Unsanctioned Zones(27:30) Using AWS Service Control Policies (SCPs) to Enforce Domain Guardrails(30:30) Building a Stateless Serverless Engine for DNS Automation(37:00) Establishing a Single Source of Truth for the External Attack Surface(40:30) Driving Domain Takeover Bug Bounty Reports Down to Zero(44:00) The Limitations of AI for Deterministic Log Analysis and Least Privilege(50:30) Fun Questions, Korean BBQ, and Georgia Tech Master's Degrees(52:30) Ashish on Writing "AI Security Engineering" and the Rise of AI Agents
Resources spoken about during the interview:
The domain takeover challenge: Detecting and defeating it at scale
Why AI Security is Actually a Data Security Problem
When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environment. In …
Notas del episodio
When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environment. In this episode, Ashish sits down with David Gibson, SVP of Strategic Programs at Varonis, to explain why the rapid adoption of AI copilots and autonomous agents is fundamentally a data security crisis. We spoke about how connecting AI to your corporate environment before locking down your data creates massive, unintentional insider threats, allowing employees to instantly discover sensitive information they shouldn't see. We explore the Varonis Atlas framework, which provides a unified control plane to inventory AI systems, implement runtime guardrails, and execute automated red teaming. David also breaks down emerging threats like "hallucination squatting," untrusted agent inputs, and why managing identity groups without understanding data access is like holding a keyring without knowing what doors the keys unlock.
Guest Socials - David's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to AI Agents and Data Security(02:00) David Gibson's Background in IT and Joining Varonis in 2006(03:30) The "State of Cybercrime" Podcast and the "AI of A" Segment(05:00) The Through Line: How Legacy Data Auditing Gaps Amplify AI Risks(07:30) Unintentional Insider Threats: Employees Finding Sensitive Data via AI(10:00) Emerging Agentic Threats: Untrusted Inputs and SQL Injection on Steroids(11:00) The Threat of "Hallucination Squatting" by Malicious Actors(12:30) Copilot Enablement, Claude Cowork, and the Sprawl of Corporate AI Agents(14:30) Shrinking Exposure: Inventorying AI and Enforcing Runtime Guardrails(16:30) Why AI Agents Are Like "Well-Meaning Interns That Never Sleep"(19:30) The Varonis Atlas Framework: Inventory, Red Teaming, and Runtime Controls(24:00) Integrating Email Security to Stop Upstream IT Help Desk Impersonation(29:30) The "Inside Out" Security Strategy: Starting at the Data Layer(32:30) The Identity Gap: Holding a Keyring Without Knowing Which Doors They Unlock(34:30) Moving Out of the "Denial Stage" of Shadow AI Adoption(38:00) The "You Laugh, You Lose" Cybersecurity Joke Challenge
This episode was sponsored by Varonis
Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats
Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, security …
Notas del episodio
Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, security engineers at the AI software creation platform Lovable, to discuss how they actively secure AI-generated code and protect creators from supply chain risks.
Focusing on solutions rather than alarmism, Marcus and Samuel detail their response to an incident where malicious contractors mimicked AI agent commits. They outline their multi-layered defense strategy: securing a predefined tech stack, utilizing integrated security scanners, and tuning coding agents with strict guardrails to ensure secure output by default. The conversation also covers the evolution of the shared responsibility model in the AI era, the critical importance of foundational hygiene like Git commit signing, and the necessary transition from local "YOLO mode" to secure, sandboxed agent environments. Discover how platforms can leverage AI not just to write code, but to actively assist users in finding and resolving security issues through concepts like "CISO agents."
Guest Socials - Marcus's Linkedin + Samuel's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
(00:00) Introduction to Securing AI App Builders(02:00) Marcus & Samuel's Backgrounds and Roles at Lovable(04:30) Empowering Non-Technical Users to Build 40 Million Apps(08:30) Securing Predefined Tech Stacks and Tuning Coding Agents(11:00) Managing Trust When Customers Hire External Contractors(14:00) Addressing Supply Chain Risks with Synced GitHub Repositories(17:30) Educating Users and Developing "CISO Agents" for Support(24:00) Analyzing the Attack: How Threat Actors Mimicked Agent Commits(31:00) The Importance of Basic Hygiene: MFA and Commit Signing(38:30) Moving Agents from "YOLO Mode" to Sandboxed Environments(46:00) The Buy vs. Build Debate for Internal AI Capabilities(52:30) AI as an Educational Tool and Democratizing SQL Queries(01:05:00) Hobbies, Plants, and Pushing AI to Design 1940s Bridges
Why AI Won't Replace Your SOC: Federated Data & APEX Framework
Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck …
Notas del episodio
Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck at the bottom of the Pyramid of Pain, your incident response team is doused in noise while true threats slip through undetected. In this episode, Ashish sits down with Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl (former Secret Service investigator and Kroger security ops lead), to break down Cribl's open APEX framework. Nicole explains how APEX focuses on behavioral chaining, time-boxing, and clustering over raw telemetry to build high-fidelity detections without needing a thousand individual rules for every MITRE ATT&CK box. We also explore the shift from a "single pane of glass" to a deterministic "single lens" over federated data, why AI agents must be provisioned as true identities rather than unmonitored service accounts, and how to analyze hyper-fast threat archetypes like Anthropic's GTG 1002.
Guest Socials - Nicole's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction & The Death of Hashes and IP Detections(02:20) Nicole Beckwith's Background (Secret Service, GE Aerospace, Kroger, Cribl)(04:30) Moving Up David Bianco’s Pyramid of Pain to TTPs(06:20) Replacing the "Single Pane of Glass" with a Single Lens on Federated Data(09:40) Deciding What Logs to Pipe to a Data Lake vs. Keep in a SIEM(13:30) The Cost and Context Risks of Pointing AI Agents Directly at Unstructured Data Lakes(16:30) IAM Mistakes: Why AI Agents Must Be Provisioned as Identities, Not Service Accounts(18:40) The Biggest Blind Spot in AI Detection Engineering (Rule Writing vs. Tuning)(20:40) Why AI SOCs Break on Normalized Schemas and Need Raw Telemetry(22:20) Deconstructing the APEX Framework: Chaining, Time-Boxing, and Clustering(27:00) Detecting Anthropic’s GTG 1002 Archetype and MCP Scaffolding Abuse(30:30) How to Apply the APEX Framework to Any Existing Security Stack(34:20) Empowering Analysts: Why AI Should Not Be Used to Cut SOC Headcount
Resources spoken about during the interview
The "Hunt First" AI Security Strategy
Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-bad SIEM …
Notas del episodio
Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-bad SIEM alerts, you may be missing the silent breaches. In this episode, Ashish is joined by Damien Lewke, Founder and CEO of Nebulock, to discuss the critical shift toward a "Hunt First" mindset. Damien explains why moving away from alert fatigue and focusing on raw, normalized telemetry (across endpoint, identity, and cloud) is the only way to proactively surface unknown threats. We also dive into how AI is finally democratizing the elite skill of threat hunting, allowing even single-person security teams to investigate and attribute complex behaviors.From hunting down shadow AI (like unapproved MCPs) to challenging the notion that AI will replace threat hunters, this episode is a masterclass in modern security operations.
Guest Socials - Damien's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction: The Problem with Reactive Security Alerts(02:00) Damien Lewke’s Background (DoD, CrowdStrike, Arctic Wolf, Nebulock)(04:00) Why Breaches Happen in Silence: The Value of Telemetry Over Alerts(05:30) How AI Democratizes Elite Threat Hunting for Small Teams(07:30) Defining the "Hunt First" Mindset and Methodology(11:00) Surfacing Active Intrusions Using Cross-Domain Context(13:30) The Importance of Transparency in AI Decision Making(16:30) When NOT to Use AI for Detections (The Power of Heuristics)(18:30) The Best First AI Security Use Case: Hunting Shadow AI & MCPs(23:00) Detecting Rogue AI Agents via Tempo, Breadth, and Automation Signatures(28:30) The Future of SIEM: Data Gravity vs. Purpose-Built Security Analytics(34:30) Disagreeing with Gartner: Why Threat Hunters Are More Vital Than Ever(40:00) The 89% Rise in AI-Augmented Attacks and Taking Action(41:30) The "You Laugh, You Lose" Cybersecurity Joke Challenge
Resources spoken about during the episode:
- Hunting MCP Server Exploitations
- Using classical machine learning for threat hunting (and saving tokens in the process)
Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?
When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security tools …
Notas del episodio
When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security tools close enough to stop it? In this episode, Ashish sits down with Michael Leland, VP, Field CTO at Island, to discuss the critical need for an Agentic Control Plane. Michael breaks down why traditional security silos (EDR, DLP, CASB) fail to provide visibility when autonomous AI agents execute tasks outside the network, and why the browser is the ultimate line of defense for monitoring user intent. We explore the massive reality of Shadow AI and the hidden danger of well-intentioned employees accidentally hooking up sensitive data to public LLMs. Finally, Michael shares practical strategies for solving token waste through "model fit steering" and managing the complex "two-hop problem" when an agent calls another agent.
Guest Socials - Michael's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to the Agentic Control Plane(01:50) Michael Leland’s Background (Cabletron, Nitro Security, SentinelOne)(03:20) Why Island Evolved from the Browser to the Desktop for AI(05:50) The Failure of Traditional Siloed Security (EDR, DLP, CASB)(07:20) Goal-Oriented AI: How Claude Cowork Downloads Untrusted NPM Packages(08:30) Model Fit Steering: Routing Users to the Right LLM for the Right Price(10:30) The Threat of Malicious AI Skills and Plugins(11:30) The Well-Intentioned Insider Threat (The Next Cambridge Analytica)(13:00) Uncovering Shadow AI: From 8 Tools to 243(15:10) Token Brokering at the MCP Gateway(16:40) Protecting Non-Human Identities (NHI)(18:20) Solving the "Two-Hop" Problem (Agent-to-Agent Communication)(21:00) Fixing Hallucinations with Corporate RAGs(25:40) Calculating AI ROI Beyond "Token Maxing"(28:40) The "You Laugh, You Lose" Cybersecurity Joke Challenge
How Adobe Uses AI Agents for building a WAF Pipeline?
When vulnerability disclosures shrink the wild exploit window down to less than 24 hours (or even minutes), traditional manual patching and WAF rule creation simply cannot keep up.In this episode, Ashish sits …
Notas del episodio
When vulnerability disclosures shrink the wild exploit window down to less than 24 hours (or even minutes), traditional manual patching and WAF rule creation simply cannot keep up.
In this episode, Ashish sits down with Ammar Alim (Product Security Engineering Lead at Adobe) to break down how to build an automated, agentic WAF pipeline. Ammar shares how his team manages the scale and complexity of seven commercial and open-source WAFs (including AWS WAF, Cloudflare, Akamai, Azure WAF, Wallarm, and ModSecurity) by leveraging AI agents.
Discover how to construct an agentic harness, orchestrate deep research agents to gather exploit POCs, and utilize multi-model architectures (e.g., Anthropic for rule generation and OpenAI as an LLM judge) to eliminate false positives and safely deploy virtual patches
Guest Socials - Ammar's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction & The Currency of Speed in Security(02:00) Ammar Alim’s Background: From Data Centers to Product Security at Adobe(05:00) The Multi-Vendor WAF Nightmare: Managing Scale Across 7 Products(08:30) Understanding False Positives vs. False Negatives in WAF Management(12:30) Why <24-Hour Exploit Windows Demand Virtual Patching(15:30) Pitching Product Leadership: Protecting Release Cycles with WAF Rules(18:30) High-Level Architecture: How the Agentic CVE Pipeline Listens for Disclosures(21:00) Testing Rules in ModSecurity, GitHub Actions, and Shadow Production(26:00) Defining an Agentic Harness: Memory, Constraints, and Context Engineering(32:00) Multi-Model Scoring: Using Anthropic and OpenAI as LLM Judges(34:30) Reinforcement Memory: Training Agents with OWASP and CVE Repetition(37:00) Do You Need to Be an ML Academic to Build Agentic Pipelines?(43:00) Applying Agentic Automation to Other Tedious Security Tasks
Resources spoken about during the episode:
The Tireless Guardian: Agentic AI and the Art of WAF at Scale - Ammar Alim's Talk at fwd:cloudsec
Why Runtime Agents Are Replacing Static Posture Checks
The attack window from the discovery of a vulnerability to its exploitation has shrunk to less than 24 hours and sometimes down to just 25 minutes. Is your security team prepared for the speed of AI-driven …
Notas del episodio
The attack window from the discovery of a vulnerability to its exploitation has shrunk to less than 24 hours and sometimes down to just 25 minutes. Is your security team prepared for the speed of AI-driven attacks?
In this episode, Ashish sits down with Sarit Tager, who leads Cortex Cloud product management at Palo Alto Networks, to discuss why the post-Mythos era is forcing Cloud Security and AppSec out of their traditional silos. Sarit explains how AI coding agents prioritize generating code over securing it, which can sometimes result in flaws like accidentally deleting production databases within two weeks.
We also explore how English has become the new primary programming language, effectively making everyone a potential developer. Sarit breaks down why relying solely on cloud posture management is no longer enough and why deploying active runtime agents is now mandatory to block real-time exploits.
Guest Socials - Sarit's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
(00:00) Introduction: The Convergence of Cloud and AppSec(01:50) Sarit Tager’s Background: From VP of Engineering to Palo Alto Networks(03:00) Why English is the New Programming Language(06:00) The Problem with LLMs Suggesting AppSec Fixes That Break Functionality(09:30) How AI Agents Can Accidentally Delete Production Databases(11:40) The Attack Window Shrinking to 25-30 Minutes(14:00) The Post-Mythos Fear and the Token Cost Challenge(16:30) Why You Must Deploy a Runtime Agent (Posture is Not Enough)(18:30) Why AI Coding Agents Put Security Second(24:00) Breaking the Silos: The Rise of Holistic Product Security(36:00) How AI Empowers Non-Experts to Investigate Across Security Domains(40:30) Fun Questions: 50 Countries, No Social Media, and Japanese Food
Thank you to Palo Alto Networks for sponsoring this episode:
The Hidden Cost of BlackBox AI: Bridging Cloud and Code Security
Traditional SCA and SAST tools are notorious for drowning security teams in false positives, historically flagging nine out of ten alerts incorrectly. But while generative AI seems like a magic bullet, simply …
Notas del episodio
Traditional SCA and SAST tools are notorious for drowning security teams in false positives, historically flagging nine out of ten alerts incorrectly. But while generative AI seems like a magic bullet, simply wrapping an out-of-the-box LLM around your code can result in confident hallucinations and astronomical costs extrapolating to as much as $52 million a year for a large enterprise using frontier models.
In this episode, Ashish sits down with Harry Wetherald, CEO and co-founder of Maze, to discuss the evolution of AI-native AppSec and Cloud Security. Harry breaks down the critical difference between vulnerability reachability (is the code active?) and true exploitability (can an attacker actually trigger it logically?). He also explains why the historical walls between cloud security and application security teams are finally crumbling as AI acts as a perfect translator between the two domains.
If your team is debating "Build vs. Buy" for AI security tools, this episode is essential. Harry shares the biggest red flags to watch out for in AI vendors (beware the "black box"), how to intelligently route across models to optimize token costs by 100x, and how a true "security brain" orchestrates multiple investigations to provide reliable context across your entire environment.
Guest Socials - Harry's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to AI in AppSec(01:50) Harry Wetherald's Background and the Founding of Maze(02:30) Reachability vs. Exploitability Explained(04:45) The "Build vs. Buy" Dilemma for AI Security Tools(08:30) Bridging the Gap Between Siloed AppSec and CloudSec Teams(11:30) Evaluating Out-of-the-Box LLMs vs. Specialized Security Tools(14:20) Solving the Historic AppSec False Positive Problem(18:50) AI Vendor Red Flags: The Danger of "Black Box" Products(20:50) How to Build a True AI-Native Security Architecture(24:45) The Hidden Cost of AI Models: Why Optimization is Crucial(28:00) When to Keep a Human in the Loop for Remediation(34:00) Building a "Security Brain" to Inform AI Coding Agents(39:20) The Launch of Maze Code for Deep Cloud and Code Investigations
Who Governs Your AI Agents? Identity, Offboarding & Open Standards
Are overprivileged AI agents the biggest emerging threat in cybersecurity? In a recent high-profile attack, a vibe-coding company had its entire source code stolen because an attacker exploited a long-lived …
Notas del episodio
Are overprivileged AI agents the biggest emerging threat in cybersecurity? In a recent high-profile attack, a vibe-coding company had its entire source code stolen because an attacker exploited a long-lived, overprivileged token tied to a third-party AI agent.
In this episode, Ashish sits down with Ely Kahn, CPO at Okta, to unpack the challenge of managing Non-Human Identities (NHI) in the AI era. Ely explains why traditional, static human permissions completely break down when applied to autonomous agents. To solve this, Okta has spearheaded Cross-App Access (XAA), an extension of OAuth that uses an Identity Assertion Grant (ID JAG). This open protocol, backed by 25+ partners, including Anthropic, XAA securely passes the baton between apps without annoying consent pop-ups or dangerous static API keys.
We also explore the four maturity levels of agent authorization, ranging from broad API keys to the ultimate "North Star" of intent-based security. Learn the difference between SPIFFE (for internal cryptographic identity) and XAA (for downstream resource authorization), how the Linux Foundation is building an Agent Domain System, and why every CISO needs an immediate "kill switch" for rogue AI agents.
Guest Socials - Ely's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Ely Kahn's Background: From DHS to Okta CPO(04:00) Why AI Agent Identity is Different from Human IAM(06:30) The Danger of Overprivileged Tokens: A Source Code Breach Case Study(08:30) Introducing Cross-App Access (XAA) and ID JAG(11:00) Agent Identities: Acting on Behalf of a User vs. Autonomous Scopes(13:00) SPIFFE vs. XAA: Workload Identity vs. Resource Authorization(14:30) The Linux Foundation's Agent Domain System for Cross-Company Passports(18:00) Assuming Breach: Why Prompt Injection Makes Identity the Highest ROI Security Action(19:30) The 4 Maturity Levels of AI Agent Authorization(21:00) Intent-Based Security and Zero Standing Privilege(23:00) How to Offboard AI Agents and Manage Identity Governance (IGA)(27:00) The 3 Governance Questions Every CISO Must Answer(28:50) Implementing a Universal Kill Switch for Rogue Agents
Resources spoken about during the episode:
Learn more about how Okta and XAA are setting the new security standard for the AI era
AI-Powered Forensics: How Attackers Automate Breaches
AI isn't necessarily creating impossible new attacks, but it is drastically lowering the technical barrier to entry for cybercriminals. In this episode, Ashish Rajan speaks with Simon Biggs, Cyber Incident …
Notas del episodio
AI isn't necessarily creating impossible new attacks, but it is drastically lowering the technical barrier to entry for cybercriminals. In this episode, Ashish Rajan speaks with Simon Biggs, Cyber Incident Response Specialist at Varonis, about how AI is accelerating the attack lifecycle.
Simon explains how attackers are using AI kits to instantly set up ephemeral phishing portals, query SQL databases in minutes, and bypass AI guardrails to compile Remote Access Trojans (RATs). We also discuss the shift in ransomware tactics from "encryption-first" to "data-theft-first," and how AI empowers attackers to post-process terabytes of stolen data to monetize it in novel ways.
For defenders, the message is clear: if your S3 access logs and SQL transaction logs aren't turned on before a breach, your forensics team won't be able to tell lawyers or regulators what data was actually lost. Discover why data classification and proactive logging are the ultimate lifelines for IR teams in the AI age.
Guest Socials - Simon's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:00) Simon Biggs' Background in Law Enforcement and Varonis(03:10) Is There a Huge Volume of Sophisticated AI Attacks?(04:10) How AI Accelerates SQL Queries and Business Email Compromise (BEC)(05:15) Why AI Kits Are the New Metasploit and BloodHound(08:15) Varonis Threat Labs: Copilot Prompt Injection Vulnerability(09:20) The Forensic Challenge: Auditing Prompts vs. Understanding AI Output(10:30) Tricking AI Guardrails to Compile Malware(12:15) Defensive Strategies: Shadow AI, Permissions, and Logging(15:30) Using Defensive AI and BloodHound for Threat Hunting(17:30) Why Ransomware is Now "Data First, No Encryption"(20:50) The Legal Nightmare of Unclassified Stolen Data(23:20) Why Windows Forensics Can't Tell You What Data Was Stolen(31:20) The Crucial Importance of Enabling S3 and Cloud Audit Logs(35:10) How AI Allows Attackers to Post-Process Terabytes of Stolen Data
Resources spoken about during the episode:
Thank you to Varonis for sponsoring this episode of Cloud Security Podcast
The 4 Pillars of AI SOC:From Threat Hunting to Vibe Hunting
Threat hunting has officially evolved into "vibe hunting". However, if your AI security tools lack the right semantic context, they might be doing more harm than good. In this episode, Ashish sits down with …
Notas del episodio
Threat hunting has officially evolved into "vibe hunting". However, if your AI security tools lack the right semantic context, they might be doing more harm than good.
In this episode, Ashish sits down with Aqsa Taylor, Chief Security Evangelist at Exaforce, to discuss the rapidly changing landscape of Security Operations Centers. Aqsa explains how her team coined the term "vibe hunting" after autonomously tracking IOCs and exposure windows during the nationwide attack. We also explore the limitations of upstream detections, highlighting complex threats like the HackerBot Claw pull-request manipulation, TeamPCP NPM supply chain attacks, and APTs posing as fake employees on Google Workspace.
If you are navigating the noise of the 54+ new AI SOC startups, Aqsa breaks down the 4 Pillars of an AI SOC (Triage, Detection, Investigation, and Response) and speaks to "Build vs. Buy" debate regarding internal security tooling.
Guest Socials - Aqsa's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction to AI SOC and Vibe Hunting(02:40) Aqsa Taylor’s Background at Twistlock, SACR, and Exaforce(03:40) The Origin of "Vibe Hunting" and the Iran Striker Attack(09:30) Why AI Hurts Without Context: The HackerBot Claw Attack(12:30) Hunting North Korean Fake Employees on Google Workspace(14:20) SaaS Detections and the TeamPCP NPM Supply Chain Attack(18:40) Navigating the Noise of 54+ AI SOC Startups(20:30) The 4 Pillars of an AI SOC: Triage, Detection, Investigation, Response(28:40) Automating Response: Containing Credential Stuffing Attacks(33:00) The Build vs. Buy Debate for Internal AI SOC Tooling(39:30) Building Confidence in AI with Semantic Knowledge Graphs(44:20) Fun Questions: Content Creation, Family, and Korean BBQ
Resources spoken about during the episode:
Native Cloud Firewalls Falling Short in a Multicloud World
As enterprises expand across multiple cloud environments, on-premise data centers, and dynamic AI workloads, traditional perimeter defenses and siloed cloud-native tools are no longer enough to secure the …
Notas del episodio
As enterprises expand across multiple cloud environments, on-premise data centers, and dynamic AI workloads, traditional perimeter defenses and siloed cloud-native tools are no longer enough to secure the modern network. In this episode, Ashish sits down with Murali Rathinasamy, Senior Director of Product at Cisco, to break down the next evolution of network security: the Hybrid Mesh Firewall. Murali explains why relying solely on cloud-native firewalls can create visibility gaps, and how unified policy orchestration allows security teams to manage enforcement points seamlessly. He shares a real-world case study of how Multicloud Defense is used to eliminate manual route table configurations and achieve zero-downtime, blue-green upgrades. The conversation also tackles micro-segmentation. Murali breaks down why segmentation initiatives usually stall in "analysis paralysis" and provides a practical, agentless roadmap to reduce your attack surface "one bite at a time".
Guest Socials - Murali's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions
(00:00) Introduction(01:40) Murali Rathinasamy's Background and Role at Cisco(02:30) What is a Hybrid Mesh Firewall?(04:30) Bridging the Skills Gap: NetSec vs. CNAPP/CSPM(06:45) Case Study: Royal College of Surgeons in Ireland (RCSI)(09:40) The Limits of Cloud-Native Firewalls in a Multicloud World(13:30) Securing AI Workloads and Managing the Agent Blast Radius(15:40) Why You Need Unified Policy Orchestration Across Firewall Vendors(17:40) Why Micro-segmentation Fails: Overcoming Analysis Paralysis(24:45) How to Implement Micro-segmentation "One Bite at a Time"(31:30) Detecting and Blocking Prompt Injections with Cisco AI Defense(33:30) Where Does the Hybrid Mesh Firewall Fit in the Tech Stack?
Resources spoken about during the interview:
How AI Agents Will Negotiate Your Vendor Contracts
Third-Party Risk Management (TPRM) has historically been a tedious, 200-page paper exercise that felt like being catapulted back to 1979. But AI is changing that.In this episode, Ashish sits down with Igor …
Notas del episodio
Third-Party Risk Management (TPRM) has historically been a tedious, 200-page paper exercise that felt like being catapulted back to 1979. But AI is changing that.
In this episode, Ashish sits down with Igor Andriushchenko (CISO at Lovable) and Jasper Mills (CEO of Ethira) to discuss the collision of TPRM and AI.
We dive into the hidden risks of Shadow AI, exploring the chaos that ensues when non-technical teams spin up unauthorized AI tools without security oversight. Jasper and Igor explain why the future of vendor risk involves treating AI agents like a contracted workforce, managing their lifecycles, and preparing for the 2027 era of "agent-to-agent" negotiations where humans are entirely removed from the loop.
We also cover the impact of DORA (Digital Operational Resilience Act) regulations, the Build vs. Buy debate for AI security tooling, and how to use autonomous agents to finally automate tedious vendor questionnaires.
Guest Socials - Igor's Linkedin + Jasper Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:00) Jasper and Igor's Backgrounds (Athira and Lovable) (04:00) Why Traditional Third-Party Risk Management is Abysmal (06:20) DORA Regulations and the Collision of AI and Compliance (11:30) Using AI to Automate Vendor Assessments and Questionnaires (16:30) The Build vs. Buy Debate for AI TPRM Tools (22:30) Shadow AI: "Giving a Kindergarten a Nuclear Bomb" (25:30) Using AI Agents for Automated Vendor Discovery and Inventory (28:30) 2027: The Future of Agent-to-Agent Negotiations (30:40) Treating AI Agents Like a Contracted Workforce (34:10) Enforcing Contractual Accountability through AI Guardrails
How Claude Mythos Changes Vulnerability Management: From CVSS to Exploitability
Is your vulnerability management program ready for something like Claude Mythos? The old days of treating vulnerabilities as temporal events (like Heartbleed or Log4J) and patching them on a leisurely 30, 60 …
Notas del episodio
Is your vulnerability management program ready for something like Claude Mythos? The old days of treating vulnerabilities as temporal events (like Heartbleed or Log4J) and patching them on a leisurely 30, 60, or 90-day cycle are officially over.
In this episode, Ashish sits down with Brad Hibbert, COO and Chief Strategy Officer at Brinqa. Brad explains how the release of Anthropic's Claude Mythos, an AI model capable of discovering vulnerabilities at machine speed without human intervention has compressed the time-to-exploit from months down to mere seconds.
We discuss why the traditional assumption that "sophisticated attacks require sophisticated attackers" is no longer relevant, and why leaning solely on CVSS scores will drown your remediation teams in noise. We speak about how defenders must pivot from generic patching to focusing on true exploitability within their specific environments. Learn how AI can chain multiple "low severity" vulnerabilities (which were previously ignored 90% of the time) to gain root access, and why siloed AI security tools will lead to an expensive and ineffective game of "Whac-A-Mole".
Guest Socials - Brad's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:30) Brad Hibbert's Background and Role at Brinqa(03:40) Heartbleed vs. Claude Mythos: Temporal vs. Persistent Threats(05:30) AI Weaponization: From Months to Seconds(06:50) Elevating the Threat Model Beyond CVSS(09:30) The Tsunami of Vulnerabilities and the Need for Exploitability(12:10) Bridging the Blind Spots in Exposure Management(15:10) Resolving Friction Between Security and Remediation Teams(21:00) Automating Remediation Without Losing Oversight(28:30) The Problem with Treating Every Vulnerability Individually(30:20) Why We Ignored 90% of Low Severity Vulnerabilities(32:30) Siloed AI and the Costly Game of "Whac-A-Mole"(35:30) Defining "Reasonable Security" in the AI Era(41:10) Quick Wins: Where to Start Uplifting Your Program
Resources spoken about during the episode:
5 Things Every CISO Should Do Before the Next Mythos
Thank you to Brinqa for sponsoring this episode
AISPM Isn't Enough: How to Apply Zero Trust to AI Agents
We are officially entering the "Multi-AI Era." Much like the multi-cloud times, organizations are no longer just using a single AI tool like Microsoft Copilot, they are building custom, agentic workflows using …
Notas del episodio
We are officially entering the "Multi-AI Era." Much like the multi-cloud times, organizations are no longer just using a single AI tool like Microsoft Copilot, they are building custom, agentic workflows using diverse third-party models and MCP servers . In this episode, Ashish sits down with Shawn Hays from Varonis to discuss why the security market has over-pivoted on AISPM (AI Security Posture Management) . Shawn spoke about how having visibility and an inventory of your AI models is a great start, but it fails to secure the enterprise if you lack the guardrails to actually stop an agent from going off the rails and exfiltrating data . Shawn breaks down the components of a robust AI security platform (like Varonis Atlas) and explains why data security is inseparable from AI security. He spoke about why AI agents will blindly "read whatever is on the teleprompter," meaning your AI is only as secure as the data access and identity controls surrounding it . Tune in to learn how to apply Zero Trust across the entire AI chain from the prompter to the cloud infrastructure
Guest Socials - Shawn's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Shawn's Background: Microsoft, CMMC, and Varonis (03:50) The Biggest AI Security Challenges (Copilot to Agentic AI) (05:50) Third-Party AI Risk (Jira and Salesforce Agents) (08:40) The Connector Ecosystem Danger (Copilot + Salesforce) (11:50) 8 Distinct Areas of an AI Security Platform (Varonis Atlas) (14:00) Entering the "Multi-AI Era" (Analogies to Multi-Cloud) (16:00) The AI Bill of Materials (Athena AI & Grammarly) (20:50) Why Data Security and AI Security are Intertwined (22:00) Applying Zero Trust to the Entire AI Chain (24:50) The Role of Identity and ITDR in AI Systems (27:00) HIPAA, OCR, and Regulating AI Data Access (31:30) Creating a Governance Plan for Microsoft Copilot (33:50) Securing Pro-Code AI Systems (AWS Bedrock & MCP Servers) (38:30) Why the Security Market is Over-Pivoting on AISPM (44:10) The "Ron Burgundy" Analogy for AI Agents (45:50) Fun Questions: Crocodile & Caramel Tasting (47:20) The Ed Sheeran & Yelawolf Mixtape Connection (48:50) Hobbies & Pride: DJing Weddings and Playing Ice Hockey in Alabama (51:50) Favorite Food: Alabama White Sauce BBQ & Milo's Burgers
Resources spoken about during the episode:
The Rise of Agentic Cloud Security: Code-to-Cloud Shrinks to 3 Days
Is your cloud security strategy ready for the "messy middle" of AI adoption? With developers pushing code from inception to production in under three days using "vibe coding," and adversaries capable of …
Notas del episodio
Is your cloud security strategy ready for the "messy middle" of AI adoption? With developers pushing code from inception to production in under three days using "vibe coding," and adversaries capable of exfiltrating data in just 25 minutes, human-led security is no longer fast enough .In this episode, Ashish sits down with Elad Koren from Palo Alto Networks (Cortex Cloud) to discuss the shift toward Agentic Cloud Security. Elad spoke to us about why bolting an AI chatbot onto legacy security tools doesn't work, and why you must run AI directly where your data lies . Elad shared a real-world case study: an organization that rapidly spun up an "internal" AI workload to test the market, only to have a red team discover it was exposed to the public internet with zero authentication .If you want to know how the role of cloud security practitioners will evolve from manual analysts to AI orchestrators within the next five years, listen to this episode.
Guest Socials - Elad's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Elad Koren? (Palo Alto Networks / RSA Security) (04:00) The Explosion of "Vibe Coding" and AI Applications (05:10) How CNAPP is Evolving from Posture to Active Protection (07:20) The New Threat Model: 25-Minute Exfiltration Windows (09:30) What is "Agentic Cloud Security"? (Fighting Machines with Machines) (11:40) The "Messy Middle" and the Evolution of Security Practitioners (14:30) Platformization: Why Security Can No Longer Survive in Silos (16:50) Blurring the Lines Between Cloud and Enterprise Estates (18:20) Case Study: An Unauthenticated "Internal" AI Workload Exposed (20:30) How AI is Shrinking Code-to-Cloud Cycles to 3 Days (22:30) The Coming Crisis: Security Token Budgets vs. Speed (23:30) Fun Questions: Kangaroo Jerky Tasting (25:20) Hobbies & Family: Cycling, Audiobooks, and Fatherhood (26:30) Favorite Food: Thai Cuisine in the Bay Area
Resources spoken about during the episode:
Why EDR Fails at AI Security & The Rise of Endpoint Behavior Modeling
Is your EDR blinding you to insider threats? In this episode, Ashish is joined by Brandon Dixon (Co-Founder & CTO of Ent AI, and former Microsoft Security Copilot leader) to discuss why traditional endpoint …
Notas del episodio
Is your EDR blinding you to insider threats? In this episode, Ashish is joined by Brandon Dixon (Co-Founder & CTO of Ent AI, and former Microsoft Security Copilot leader) to discuss why traditional endpoint security tools are failing in the AI era .
Brandon talks about the reality of modern "Insider Risk." Attackers are no longer relying on malware; they are "living off the land" by using legitimate enterprise software (like Zoom or Microsoft Office) to look like everyday employees . Why EDR tools can see that Zoom is running, but are completely blind to a user granting remote control to an outsider .
We also explore the explosion of Shadow AI, highlighting a real-world HIPAA violation where an HR employee tried to feed patient records into Meta AI via WhatsApp . If your SOC team is drowning in alerts from "dumb control points," this episode talks about how to move from reactive pattern matching (legacy DLP) to proactive behavioral intent modeling at the endpoint
Guest Socials - Brandon's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Brandon Dixon? (RiskIQ, Microsoft Copilot, Ent AI) (04:00) Redefining Insider Risk: Malice vs. Mistakes (05:10) "Living Off the Land": Why Adversaries Use Legitimate Tools (06:30) The Zoom Example: Why EDR is Blind to Remote Control Hacks (09:30) The Failure of Security Training against "Click Fix" Attacks (11:50) Case Study: A HIPAA Violation via Meta AI in WhatsApp (13:50) Why Traditional DLP Fails at Semantic Context (16:50) Local AI Usage: Why Workloads Are Returning to the Endpoint (18:50) The Problem with UEBA: Putting Anomalies in Context (22:30) Why You Can't Build This With a Data Lake (26:30) Stopping the "Trophy SOC" and Dumb Alerts (27:40) Fun Questions: Kangaroo Jerky Tasting (28:40) Hobbies & Pride: Ultramarathons and Growing Up in Baltimore (29:20) Favorite Cuisine: Burmese Food (Tea Leaf Salad)
Solving Prompt Injection & Shadow AI for AI Malware
Are AI agents functioning like adversarial malware inside your network? In this episode of the Cloud Security Podcast, Ashish sits down with Jasson Casey, Co-founder and CEO of Beyond Identity, to speak about …
Notas del episodio
Are AI agents functioning like adversarial malware inside your network? In this episode of the Cloud Security Podcast, Ashish sits down with Jasson Casey, Co-founder and CEO of Beyond Identity, to speak about the security risks introduced by Shadow AI and code assistants .Jasson explains why an AI agent executing a tool is the perfect opportunity for prompt injection or proprietary data exfiltration comparing unchecked agents to Ron Burgundy reading whatever is on the teleprompter . We discuss the "barbell" reaction of CISOs (either blocking AI entirely or blindly accepting the risk) and why placing device-bound identity at the core of your security stack is the only way to safely enable AI speed .From an $80,000 stolen Anthropic key nightmare on Reddit to a red-team exercise that cloned voices using Hugging Face models in just four hours, this episode highlights the tangible threats and solutions of the AI era .
Guest Socials - Jasson's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Jasson Casey? (CEO of Beyond Identity) (03:50) The Reality of Shadow AI: Marketers & Devs Moving Fast (05:10) Why AI Agents Execute Like Adversarial Malware (06:20) Prompt Injection Over Time & Agent "Memory" as Persistence (07:40) The CISO "Barbell": Blocking Everything vs. Accepting All Risk (09:30) Applying the NIST Framework to AI Agents (12:00) The Reddit Horror Story: An $80,000 Stolen Claude Key (13:00) Why Device-Bound Identity is the Ultimate AI Control Plane (15:50) The Death of SaaS IT Products (Replaced by Git + Claude Code) (19:30) Fixing Prompt Injection & Exfil via Attributable Identity (20:50) Moving from UI Dashboards to API Data + AI Skills (26:20) Building "Agentic Playbooks" for Security Teams (27:40) Red Teaming: Cloning Voices in 4 Hours via Hugging Face (30:20) Fun Questions: Kangaroo vs. Crocodile Tasting (31:50) Hobbies: Radar Projects & Northern Mexican Cuisine (Dark Mole)
This episode was sponsored by Beyond Identity
Resources spoken about during the episode:
To get started with Ceros, the AI Trust Layer - Visit beyondidentity.ai
Browser Security Explained: Consent Phishing, "Click Fix" Attacks & The Limits of EDR
Is your security team treating your Identity Provider (IDP) like a firewall? In this episode, Adam Bateman (CEO & Co-founder of Push Security) explains why that's a dangerous mistake and how modern attackers …
Notas del episodio
Is your security team treating your Identity Provider (IDP) like a firewall? In this episode, Adam Bateman (CEO & Co-founder of Push Security) explains why that's a dangerous mistake and how modern attackers are bypassing SSO entirely .Drawing from his background leading red teams that simulated nation-state attacks , Adam breaks down the massive architectural shift from network-based attacks to browser-native exploits. We dive into the terrifying evolution of phishing, from "Click Fix" attacks that trick users into running malicious commands via their clipboard, to "Consent Phishing" that completely takes over Azure without ever touching the endpoint .If your company relies heavily on SaaS applications or Chromebooks, this episode would be a valuable listen.
Guest Socials - Adam's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Adam Bateman? (Red Teaming & Simulating Nation States) (05:40) Why Identity & MFA Are Not "Solved" Problems (07:50) The Myth: Why an IDP is Not a Firewall (11:30) Consent Phishing: Exploiting OAuth Apps (13:30) The Architectural Shift: Network to Browser (15:30) Scattered Spider & The Rise of Identity Coalitions (19:30) Threat Modeling: On-Prem vs. Chromebooks (23:20) The Problem with SSPM and API Limitations (28:40) How "Click Fix" Attacks Trick Users into Running Malware (32:30) Omnichannel Phishing: LinkedIn, SMS, and Google Ads (34:30) Weaponizing Legitimate SaaS Apps (The DocuSign Exploit) (37:00) Consent Fix: Full Azure Compromise Inside the Browser (38:50) Disrupting the Secure Web Gateway (SWG) Market (41:40) Fun Questions: Wakeboarding, Culture, and Brat's Restaurant
Resources spoken about during the episode:
You can find out more about Push Security here.
Thank you to Push Security for sponsoring this episode.
Is AI Hallucinations a Myth and the Real Threat from AI
Are attackers really using AI to run end-to-end cyber campaigns? In this episode, Edward Wu (Founder and CEO, DropzoneAI) joins Ashish to separate the hype from reality when it comes to AI-driven attacks …
Notas del episodio
Are attackers really using AI to run end-to-end cyber campaigns? In this episode, Edward Wu (Founder and CEO, DropzoneAI) joins Ashish to separate the hype from reality when it comes to AI-driven attacks .Edward explains how attackers are currently using open-source LLMs for reconnaissance and spear-phishing , and why the major commercial models now explicitly prohibit users from generating exploits without vetting . On the defense side, Edward shares how AI agents have successfully automated over 160 years' worth of alert investigations in the real world proving that 100% software-delivered SOC triage is already here .We also debunk the myth of AI "hallucinations," explaining why most errors are actually just poor context management . If you're building a security operations center or working with an MSSP, this episode will teach you how to shift from manual alert fatigue to leveraging AI for threat hunting.
Guest Socials - Edward's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Edward Wu? (Founder of Dropzone AI) (04:50) The Reality of AI Cyber Attacks Today (Recon vs. End-to-End) (07:20) Why Commercial LLMs Are Blocking Exploit Generation (11:50) How MSSPs are Evolving with AI Triage (18:20) The Asymmetric Capacity Gap: Why Humans Can't Keep Up (22:30) Automating 160 Years of Alert Investigations (23:50) Why AI Hallucinations are Actually Context Management Failures (26:00) Build vs. Buy: The Data Network Effect for AI Agents (29:20) The New Workflow for SOC Analysts & Threat Hunters(31:30) Defining "Threategy": Scope, Authorization, and Context (35:50) How to Detect Prompt Injection (Treat it like an Insider Threat) (38:30) Dropzone AI Announcements at RSAC
Resources spoken about during the episode:
- If you want to learn more about Dropzone- you can do that here!
Why AI Infrastructure is Harder to Secure Than Cloud
Is AI security just "Cloud Security 2.0"? Toni De La Fuente, creator of the open-source tool Prowler, joins Ashish to explain why securing AI workloads requires a fundamentally different approach than …
Notas del episodio
Is AI security just "Cloud Security 2.0"? Toni De La Fuente, creator of the open-source tool Prowler, joins Ashish to explain why securing AI workloads requires a fundamentally different approach than traditional cloud infrastructure.
We dive deep into the "Shared Responsibility Gap" emerging with managed AI services like AWS Bedrock and OpenAI. Toni spoke about the hidden dangers of default AI architectures, why you should never connect an MCP (Model Context Protocol) directly to a database.
We discuss the new AI-driven SDLC, where tools like Claude Code can generate infrastructure but also create massive security blind spots if not monitored.
Guest Socials - Toni's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Toni De La Fuente? (Creator of Prowler)(03:50) AI Security vs. Cloud Security: What's the Difference? (07:20) The Shared Responsibility Gap in AI Services (Bedrock, OpenAI) (11:30) The "Fifth Party" Risk: Managed AI Access (13:40) AI Architecture Best Practices: Never Connect MCP to DB Directly (16:40) Prowler's AI Pillars: Generating Dashboards & Detections (22:30) The New SDLC: Securing Code from Claude Code & Lovable (25:30) The "Magic" Trap: Why AI Doesn't Know Your Security Context (28:30) Top 3 Priorities for Security Leaders (Infra, LLM, Shadow AI) (30:40) Future Predictions: Why Predicting 12 Months Out is Impossible
How Attackers Bypass AI Guardrails with Natural Language
In the world of Generative AI, natural language has become the new executable. Attackers no longer need complex code to breach your systems, sometimes, asking for a "poem" is enough to steal your passwords .In …
Notas del episodio
In the world of Generative AI, natural language has become the new executable. Attackers no longer need complex code to breach your systems, sometimes, asking for a "poem" is enough to steal your passwords .
In this episode, Eduardo Garcia (Global Head of Cloud Security Architecture at Check Point) joins Ashish to explain the paradigm shift in AI security. He shares his experience building AI-powered fraud detection systems and why traditional security controls fail against intent-based attacks like prompt injection and data poisoning .
We dive deep into the reality of Shadow AI, where employees unknowingly train public models with sensitive corporate data , and the sophisticated world of Deepfakes, where attackers can bypass biometric security using AI-generated images unless you're tracking micro-movements of the eye .
Guest Socials - Eduardo's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
(00:00) Introduction(01:55) Who is Eduardo Garcia? (Check Point)(03:00) Defining Security for GenAI: The Focus on Prompts (05:20) Why Natural Language is the New Executable (08:50) Multilingual Attacks: Bypassing Filters with Mandarin (12:00) Shift Left vs. Shift Right: The 70/30 Rule for AI Security (15:30) The "Poem Hack": Stealing Passwords with Creative Prompts (21:00) Shadow AI: The "HR Spreadsheet" Leak Scenario (25:40) Security vs. Compliance in a Blurring World (28:00) The Conflict: "My Budget Doesn't Include Security" (34:00) The 5 V's of AI Data: Volume, Veracity, Velocity (40:00) Deepfakes & Biometrics: Detecting Micro-Movements (43:40) Fun Questions: Soccer, Family, and Honduran Tacos
Vulnerability Management vs. Exposure Management
In this episode, Brad Hibbert (COO & Chief Strategy Officer at Brinqa) joins Ashish to explain why traditional risk-based vulnerability management (RBVM) is no longer enough in a cloud-first world .We explore …
Notas del episodio
In this episode, Brad Hibbert (COO & Chief Strategy Officer at Brinqa) joins Ashish to explain why traditional risk-based vulnerability management (RBVM) is no longer enough in a cloud-first world .
We explore the evolution from simple patch management to Exposure Management a holistic approach that sits above your security tools to connect infrastructure, code, and cloud risks to actual business impact . Brad breaks down the critical difference between a "Risk Owner" (the service owner) and a "Remediation Owner" (the team fixing the bug) and why this distinction solves the "who fixes this?" problem .
This conversation covers practical steps to uplift your VM program, how AI is helping prioritize the noise , and why compliance often just "proves activity" rather than reducing real risk . Whether you're drowning in Jira tickets or trying to automate remediation, this episode provides a roadmap for modernizing your security posture
Guest Socials - Brad's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:50) Who is Brad Hibbert? (Brinqa)(04:55) The Evolution: From Scanning Servers to Cloud Complexity (06:50) What is Risk-Based Vulnerability Management? (08:50) Risk Owners vs. Remediation Owners: Who Fixes What? (12:00) How AI is Changing Vulnerability Management (15:20) Defining Exposure Management: Moving Beyond the Tools (18:30) The Challenge of "Data Inconsistency" Between Tools (22:30) Readiness Check: Are You Ready for Exposure Management? (25:10) Automated Remediation: Is "Zero Tickets" Possible? (28:40) Compliance vs. Risk: Why "Activity" isn't "Impact" (31:30) Maturity Milestones for Exposure Management (36:50) Fun Questions: Golf, Turkish Kebabs & Friendships
Is Developer Friendly AI Security Possible with MCP & Shadow AI
Is "developer-friendly" AI security actually possible? In this episode, Bryan Woolgar-O'Neil (CTO & Co-founder of Harmonic Security) joins Ashish to dismantle the traditional "block everything" approach to …
Notas del episodio
Is "developer-friendly" AI security actually possible? In this episode, Bryan Woolgar-O'Neil (CTO & Co-founder of Harmonic Security) joins Ashish to dismantle the traditional "block everything" approach to security.
Bryan explains why 70% of Model Context Protocol (MCP) servers are running locally on developer laptops and why trying to block them is a losing battle . Instead, he advocates for a "coaching" approach, intervening in real-time to guide engineers rather than stopping their flow .
We dive deep into the technical realities of MCP (Model Context Protocol), why it's becoming the standard for connecting AI to data, and the security risks of connecting it to production environments . Bryan also shares his prediction that Small Language Models (SLMs) will eventually outperform general giants like ChatGPT for specific business tasks .
Guest Socials - Bryan's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(01:55) Who is Bryan Woolgar-O'Neil?(03:00) Why AI Adoption Stops at Experimentation(05:15) The "Shadow AI" Blind Spot: Firewall Stats vs. Reality (08:00) Is AI Security Fundamentally Different? (Speed & Scale) (10:45) Can Security Ever Be "Developer Friendly"? (14:30) What is MCP (Model Context Protocol)? (17:20) Why 70% of MCP Usage is Local (and the Risks) (21:30) The "Coaching" Approach: Don't Just Block, Educate (25:40) Developer First: Permissive vs. Blocking Cultures (30:20) The Rise of the "Head of AI" Role (34:30) Use Cases: Workforce Productivity vs. Product Integration (41:00) An AI Security Maturity Model (Visibility -> Access -> Coaching) (46:00) Future Prediction: Agentic Flows & Urgent Tasks (49:30) Why Small Language Models (SLMs) Will Win (53:30) Fun Questions: Feature Films & Pork Dumplings
Why AI Can't Replace Detection Engineers: Build vs. Buy & The Future of SOC
Is the AI SOC a reality, or just vendor hype? In this episode, Antoinette Stevens (Principal Security Engineer at Ramp) joins Ashish to dissect the true state of AI in detection engineering.Antoinette shares …
Notas del episodio
Is the AI SOC a reality, or just vendor hype? In this episode, Antoinette Stevens (Principal Security Engineer at Ramp) joins Ashish to dissect the true state of AI in detection engineering.
Antoinette shares her experience building detection program from scratch, explaining why she doesn't trust AI to close alerts due to hallucinations and faulty logic . We explore the "engineering-led" approach to detection, moving beyond simple hunting to building rigorous testing suites for detection-as-code .
We discuss the shrinking entry-level job market for security roles , why software engineering skills are becoming non-negotiable , and the critical importance of treating AI as a "force multiplier, not your brain".
Guest Socials - Antoinette's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
If you are interested in AI Security
, you can check out our sister podcast - AI Security Podcast
Questions asked:
(00:00) Introduction(02:25) Who is Antoinette Stevens?(04:10) What is an "Engineering-Led" Approach to Detection? (06:00) Moving from Hunting to Automated Testing Suites (09:30) Build vs. Buy: Is AI Making it Easier to Build Your Own Tools? (11:30) Using AI for Documentation & Playbook Updates (14:30) Why Software Engineers Still Need to Learn Detection Domain Knowledge (17:50) The Problem with AI SOC: Why ChatGPT Lies During Triage (23:30) Defining AI Concepts: Memory, Evals, and Inference (26:30) Multi-Agent Architectures: Using Specialized "Persona" Agents (28:40) Advice for Building a Detection Program in 2025 (Back to Basics) (33:00) Measuring Success: Noise Reduction vs. False Positive Rates (36:30) Building an Alerting Data Lake for Metrics (40:00) The Disappearing Entry-Level Security Job & Career Advice (44:20) Why Junior Roles are Becoming "Personality Hires" (48:20) Fun Questions: Wine Certification, Side Quests, and Georgian Food
Aquí están los 40 episodios más recientes de 366. Los anteriores están en el feed del podcast.
Podcasts similares
Más podcasts de Tecnología
¿Es tu podcast?
Confírmalo con una entrada en tu feed: aquí recibes un código, lo añades como podcast:txt en el canal de tu feed y nosotros lo comprobamos. Después tu podcast aparecerá como «verificado» en SoundNode.