Podcasts about Black hat

Sean Murphy spent more than twenty years in the CISO chair and walked away from it while things were going well. In this episode of The New CISO, he returns to talk with Steve Moore about trading the operational seat for a field CISO role at F5 — and why getting too good at the job was the warning sign.Sean reintroduces himself: 21 years in Air Force medicine, multiple post-retirement CISO gigs in highly regulated industries, and now field CISO for North America at F5. What drew him was not the title but the teaching. He calls his hobby recreational learning, has been an adult student for decades, and still teaches at Central Washington and Columbia Southern. The new role makes education the job rather than something done off the side of the desk.The heart of the conversation is the exhaustion nobody names. Sean is blunt that his old role drained him less because it was hard than because it was the same — the same politics, the same pressures, the same day in and day out. Stability turned into autopilot, and autopilot is where complacency kills. Now he is drinking from the fire hose on post-quantum, AI security, and API security, admitting he has had to go learn the material before presenting it. His batteries are fuller than they were when the work was easier.Steve turns that into a theory of time. An hour of play feels infinite to a child because everything in it is new; as we get older and repeat ourselves, the days speed up and disappear. Discomfort, then, is not the enemy — it is the thing that slows relative time back down. Sean adds the other half: focus, being genuinely in the moment rather than running on muscle memory.Then Steve puts a hot one to him. He is often underwhelmed by people in field CISO roles, and he argues the position is overhead until it is not — frequently first on the chopping block. Sean does not flinch. If a company builds these roles without a strategic reason and hires people with no bench behind them, that is on the company. He walks through the questions he asked in his own interviews — what does success look like, what are the real pain points, how much selling is in the role — and how much the subtext tells you. The episode closes on narrative over geek speak, a Black Hat session, a possible third book, and his answer to the show's closing question: do not forget your roots.Key TopicsLeaving the operational CISO seat while the program was running wellWhy F5 built a field CISO role around education rather than salesRecreational learning: teaching, certifications, and staying a studentComplacency, autopilot, and the exhaustion of samenessActual versus perceived time, and how novelty slows the clockThe hot take: is field CISO the first position to get cut?Interview questions for a vendor role, starting with what success looks likeReading the subtext of an interview: politics, pain points, and red flagsBuilding the narrative that ties security work to the businessStaying comfortable being uncomfortable in a brand new roleGuest BioSean Murphy is field CISO for North America at F5, which he joined after more than twenty years as an operational CISO in highly regulated industries and a 21-year career in Air Force medicine. He has authored two cybersecurity books published by McGraw-Hill, contributed to ISC2 study material, and still teaches at Central Washington and Columbia Southern. He was a panel guest on The New CISO in 2022.GET A DEMO:

Black fashion history is full of icons hiding in plain sight—and Linda Page is one of the most important names you have not heard enough. In this episode, Taniqua shares how a milliner from Columbus, Ohio, built a career that crossed celebrity, community leadership, and Black women's style. From creating cardboard hats as a child to opening Linda's Millinery Shop in Columbus's Black business district, Page turned millinery into a powerful form of self-expression and entrepreneurship. Her designs earned her the nickname "the Hat Designing Wizard" and attracted notable clients including Marva Lewis, Etta Moten, Dorothy Donegan, Marguerite Belafonte, and Coretta Scott King. Shop Black Fashion History Fact Cards (+ Exclusive Listener Discount!) Explore Volume 1 and celebrate unsung fashion trailblazers: https://www.blackfashionhistory.com/shop Use code PODCAST for 15% off your purchase.

We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Michael Leland discusses Island's research uncovering thousands of malicious repositories, widespread security flaws across MCP servers, and a new attack technique called “AgentBaiting,” in which attackers manipulate agents into finding and recommending malware to users. The conversation explains how enterprises can govern AI capabilities without slowing adoption. Segment Resources: https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware For more information about Island's research, please visit https://securityweekly.com/islandbh After Mythos: Securing Frontier AI as Attack and Defense Accelerate - Black Hat interview with Sean Murphy, Field CISO - North America of F5 Frontier AI is compressing the time between discovering and exploiting vulnerabilities, forcing enterprises to rethink how they secure modern applications and AI systems. Sean Murphy shares how security teams can prepare for the next generation of AI-powered threats, why known vulnerabilities may become a bigger risk than zero-days, and what it takes to secure AI at scale from shadow AI and governance to agent and API protection. This segment is sponsored by F5. Visit https://securityweekly.com/f5bh to learn more about them! The Perfect Storm: When AI Writes the Code and Sharpens the Attacks - Black Hat interview with Idan Plotnik, Co-Founder and CEO of Apiiro Two storms are converging on how software gets built. The first: AI coding assistants are generating far more code than any security team can review, and with it, far more risk. The second: AI is sharpening the tools attackers use to find and exploit weaknesses faster than ever. Idan Plotnik explains why this convergence has moved the security perimeter to the coding agent itself, and makes the case for a prevention-first model where an AI AppSec agent guards coding agents in real time, governed by the principle that the agent writing the code cannot be the one to secure it. This segment is sponsored by Apiiro. Visit https://securityweekly.com/apiirobh to learn more about them! Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack - Black Hat interview with Ido Geffen, Founder & CEO of Novee Security Most AI security tools are thin wrappers around a general-purpose frontier LLM — reasoning capability rented from someone else, applied to a generic scanning workflow. In this interview, Ido Geffen breaks down what it means to own the full AI pentesting stack — the proprietary offensive reasoning model, the harness that coordinates specialized agents, and the training gym where those agents are continuously benchmarked, post-trained on real attacker tradecraft, and promoted into production. Ido explains why owning each layer matters: it's how Novee's model consistently outperforms frontier LLMs at live browser exploitation, how the platform improves at a rate the customer feels every cycle, how Novee keeps security testing cost-efficient rather than relying on tokenized pricing models, and how new attacker techniques get injected into agent memory the moment Novee's research team observes them in the wild. He then makes the case that owning the model is only half the story. The other half is the Asset Intelligence Model — a living understanding of each customer's environment, workflows, permissions, APIs, and business logic. That's what turns a generalist AI hacker into a bespoke one: not just an attacker that reasons well, but one that reasons well about your specific business. He closes with how this advantage leads to findings that get more targeted every cycle, remediation tailored to an organization's tech stack, and a platform whose ceiling rises as attackers get faster. This segment is sponsored by Novee Security. Visit https://securityweekly.com/noveebh to learn more about them! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-399

AI was in every booth, every keynote, and nearly every conversation at Black Hat 2026. Which makes the most useful takeaway from the show a slightly awkward one: the fundamentals still decide who gets compromised. Host Kim Coombes is joined by Connection security experts John Chirillo and Rob Di Girolamo, along with penetration tester and lead systems engineer Joe Chmielewski, to work through what actually mattered this year. The conversation covers: Why AI found hundreds of real vulnerabilities when a human guided the methodology, and performed worse running on its own Attacker velocity, and why AI lets adversaries cover more ground in the time they have inside an environment AI agents as a new class of privileged identity, and the machine identity lifecycle gap most organizations haven't closed What "the end of rare" means when AI makes offense cheap, and why monthly scanning with 30-day patch windows is getting harder to defend How to tell AI-enabled from AI-washed when a vendor claims an autonomous SOC The attacks that still work, from a phishing email to an unpatched server, and why a pen tester rarely needs anything exotic to get in They close with what security teams should do differently on Monday morning. Inventory before innovation, and stop assuming, start validating.

We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Michael Leland discusses Island's research uncovering thousands of malicious repositories, widespread security flaws across MCP servers, and a new attack technique called "AgentBaiting," in which attackers manipulate agents into finding and recommending malware to users. The conversation explains how enterprises can govern AI capabilities without slowing adoption. Segment Resources: https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware For more information about Island's research, please visit https://securityweekly.com/islandbh After Mythos: Securing Frontier AI as Attack and Defense Accelerate - Black Hat interview with Sean Murphy, Field CISO - North America of F5 Frontier AI is compressing the time between discovering and exploiting vulnerabilities, forcing enterprises to rethink how they secure modern applications and AI systems. Sean Murphy shares how security teams can prepare for the next generation of AI-powered threats, why known vulnerabilities may become a bigger risk than zero-days, and what it takes to secure AI at scale from shadow AI and governance to agent and API protection. This segment is sponsored by F5. Visit https://securityweekly.com/f5bh to learn more about them! The Perfect Storm: When AI Writes the Code and Sharpens the Attacks - Black Hat interview with Idan Plotnik, Co-Founder and CEO of Apiiro Two storms are converging on how software gets built. The first: AI coding assistants are generating far more code than any security team can review, and with it, far more risk. The second: AI is sharpening the tools attackers use to find and exploit weaknesses faster than ever. Idan Plotnik explains why this convergence has moved the security perimeter to the coding agent itself, and makes the case for a prevention-first model where an AI AppSec agent guards coding agents in real time, governed by the principle that the agent writing the code cannot be the one to secure it. This segment is sponsored by Apiiro. Visit https://securityweekly.com/apiirobh to learn more about them! Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack - Black Hat interview with Ido Geffen, Founder & CEO of Novee Security Most AI security tools are thin wrappers around a general-purpose frontier LLM — reasoning capability rented from someone else, applied to a generic scanning workflow. In this interview, Ido Geffen breaks down what it means to own the full AI pentesting stack — the proprietary offensive reasoning model, the harness that coordinates specialized agents, and the training gym where those agents are continuously benchmarked, post-trained on real attacker tradecraft, and promoted into production. Ido explains why owning each layer matters: it's how Novee's model consistently outperforms frontier LLMs at live browser exploitation, how the platform improves at a rate the customer feels every cycle, how Novee keeps security testing cost-efficient rather than relying on tokenized pricing models, and how new attacker techniques get injected into agent memory the moment Novee's research team observes them in the wild. He then makes the case that owning the model is only half the story. The other half is the Asset Intelligence Model — a living understanding of each customer's environment, workflows, permissions, APIs, and business logic. That's what turns a generalist AI hacker into a bespoke one: not just an attacker that reasons well, but one that reasons well about your specific business. He closes with how this advantage leads to findings that get more targeted every cycle, remediation tailored to an organization's tech stack, and a platform whose ceiling rises as attackers get faster. This segment is sponsored by Novee Security. Visit https://securityweekly.com/noveebh to learn more about them! Show Notes: https://securityweekly.com/asw-399

We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Michael Leland discusses Island's research uncovering thousands of malicious repositories, widespread security flaws across MCP servers, and a new attack technique called "AgentBaiting," in which attackers manipulate agents into finding and recommending malware to users. The conversation explains how enterprises can govern AI capabilities without slowing adoption. Segment Resources: https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware For more information about Island's research, please visit https://securityweekly.com/islandbh After Mythos: Securing Frontier AI as Attack and Defense Accelerate - Black Hat interview with Sean Murphy, Field CISO - North America of F5 Frontier AI is compressing the time between discovering and exploiting vulnerabilities, forcing enterprises to rethink how they secure modern applications and AI systems. Sean Murphy shares how security teams can prepare for the next generation of AI-powered threats, why known vulnerabilities may become a bigger risk than zero-days, and what it takes to secure AI at scale from shadow AI and governance to agent and API protection. This segment is sponsored by F5. Visit https://securityweekly.com/f5bh to learn more about them! The Perfect Storm: When AI Writes the Code and Sharpens the Attacks - Black Hat interview with Idan Plotnik, Co-Founder and CEO of Apiiro Two storms are converging on how software gets built. The first: AI coding assistants are generating far more code than any security team can review, and with it, far more risk. The second: AI is sharpening the tools attackers use to find and exploit weaknesses faster than ever. Idan Plotnik explains why this convergence has moved the security perimeter to the coding agent itself, and makes the case for a prevention-first model where an AI AppSec agent guards coding agents in real time, governed by the principle that the agent writing the code cannot be the one to secure it. This segment is sponsored by Apiiro. Visit https://securityweekly.com/apiirobh to learn more about them! Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack - Black Hat interview with Ido Geffen, Founder & CEO of Novee Security Most AI security tools are thin wrappers around a general-purpose frontier LLM — reasoning capability rented from someone else, applied to a generic scanning workflow. In this interview, Ido Geffen breaks down what it means to own the full AI pentesting stack — the proprietary offensive reasoning model, the harness that coordinates specialized agents, and the training gym where those agents are continuously benchmarked, post-trained on real attacker tradecraft, and promoted into production. Ido explains why owning each layer matters: it's how Novee's model consistently outperforms frontier LLMs at live browser exploitation, how the platform improves at a rate the customer feels every cycle, how Novee keeps security testing cost-efficient rather than relying on tokenized pricing models, and how new attacker techniques get injected into agent memory the moment Novee's research team observes them in the wild. He then makes the case that owning the model is only half the story. The other half is the Asset Intelligence Model — a living understanding of each customer's environment, workflows, permissions, APIs, and business logic. That's what turns a generalist AI hacker into a bespoke one: not just an attacker that reasons well, but one that reasons well about your specific business. He closes with how this advantage leads to findings that get more targeted every cycle, remediation tailored to an organization's tech stack, and a platform whose ceiling rises as attackers get faster. This segment is sponsored by Novee Security. Visit https://securityweekly.com/noveebh to learn more about them! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-399

Big thanks to ‪@ThreatLocker‬ for sponsoring my trip to Black Hat USA 2026 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal You can write secure C code, follow accepted best practices and still end up with a vulnerable binary. The reason is simple: the CPU does not run your source code. It runs whatever the compiler produces. David sits down with security researcher Chris Domas at Black Hat to examine how legal compiler optimizations can remove security protections, delete memory-clearing operations and introduce time-of-check to time-of-use vulnerabilities into code that appeared secure. Chris explains the C abstract machine, why compilers are allowed to transform code so dramatically and how register pressure, structure layout and even data size can affect whether a binary is vulnerable. In one striking example, 17 or 33 bytes can be safe while nearby sizes produce vulnerable code. They also discuss whether Rust solves the problem, why switching between GCC and Clang is not the answer and how AI helped analyse 500 million lines of open-source code to identify 300 potentially dangerous patterns. Most importantly, Chris explains what developers can do now, including enabling compiler warnings, using sanitizers, analysing optimized builds and testing the exact binary that will be shipped. // Christopher Domas' SOCIAL // LinkedIn: / christopher-domas GitHub: https://github.com/xoreaxeaxeax X: https://x.com/xoreaxeaxeax // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Coming Up 0:48 - Intro 02:05 - Different Ways of Exploiting CPU's 04:10 - The C Specifications 06:17 - The Compiler Deleting Nemsec 08:40 - Do we need to use a new Compiler ? 10:09 - Compiler Inventing Vulnerabilities 12:13 - Don't Give up Writing Secure Code 12:44 - Sponsored Section 14:25 - Any Easy Options To Create A New Compiler ? 15:09 - Chris's Presentation at Black Hat 20:00 - Weird Situations with Size of Data 21:22 - What Can Developers Do ? 23:32 - Who Can Leverage this Vulnerability ? 25:02 - Could AI Make it Easy For Attackers To Leverage This? 28:27 - Recommendations For Developers 29:48 - Advice To Be Like Chris 30:36 - Conclusion & Outro Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #bhusa2026 #securecoding #compiler

We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Michael Leland discusses Island's research uncovering thousands of malicious repositories, widespread security flaws across MCP servers, and a new attack technique called "AgentBaiting," in which attackers manipulate agents into finding and recommending malware to users. The conversation explains how enterprises can govern AI capabilities without slowing adoption. Segment Resources: https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware For more information about Island's research, please visit https://securityweekly.com/islandbh After Mythos: Securing Frontier AI as Attack and Defense Accelerate - Black Hat interview with Sean Murphy, Field CISO - North America of F5 Frontier AI is compressing the time between discovering and exploiting vulnerabilities, forcing enterprises to rethink how they secure modern applications and AI systems. Sean Murphy shares how security teams can prepare for the next generation of AI-powered threats, why known vulnerabilities may become a bigger risk than zero-days, and what it takes to secure AI at scale from shadow AI and governance to agent and API protection. This segment is sponsored by F5. Visit https://securityweekly.com/f5bh to learn more about them! The Perfect Storm: When AI Writes the Code and Sharpens the Attacks - Black Hat interview with Idan Plotnik, Co-Founder and CEO of Apiiro Two storms are converging on how software gets built. The first: AI coding assistants are generating far more code than any security team can review, and with it, far more risk. The second: AI is sharpening the tools attackers use to find and exploit weaknesses faster than ever. Idan Plotnik explains why this convergence has moved the security perimeter to the coding agent itself, and makes the case for a prevention-first model where an AI AppSec agent guards coding agents in real time, governed by the principle that the agent writing the code cannot be the one to secure it. This segment is sponsored by Apiiro. Visit https://securityweekly.com/apiirobh to learn more about them! Model, Harness, Gym: Why Novee Owns the Full AI Pentesting Stack - Black Hat interview with Ido Geffen, Founder & CEO of Novee Security Most AI security tools are thin wrappers around a general-purpose frontier LLM — reasoning capability rented from someone else, applied to a generic scanning workflow. In this interview, Ido Geffen breaks down what it means to own the full AI pentesting stack — the proprietary offensive reasoning model, the harness that coordinates specialized agents, and the training gym where those agents are continuously benchmarked, post-trained on real attacker tradecraft, and promoted into production. Ido explains why owning each layer matters: it's how Novee's model consistently outperforms frontier LLMs at live browser exploitation, how the platform improves at a rate the customer feels every cycle, how Novee keeps security testing cost-efficient rather than relying on tokenized pricing models, and how new attacker techniques get injected into agent memory the moment Novee's research team observes them in the wild. He then makes the case that owning the model is only half the story. The other half is the Asset Intelligence Model — a living understanding of each customer's environment, workflows, permissions, APIs, and business logic. That's what turns a generalist AI hacker into a bespoke one: not just an attacker that reasons well, but one that reasons well about your specific business. He closes with how this advantage leads to findings that get more targeted every cycle, remediation tailored to an organization's tech stack, and a platform whose ceiling rises as attackers get faster. This segment is sponsored by Novee Security. Visit https://securityweekly.com/noveebh to learn more about them! Show Notes: https://securityweekly.com/asw-399

(This is a Replay)In our adversarial system, it can often be difficult to be civil and professional with the other side, especially if they are true Black Hats. Tune in to hear 2018 KTI Graduate and Texas attorney, William G. Hagans, share about how to keep the civility and professionalism in the courtroom. Contact William G. Hagans atPhone: (713) 222-2700Website: https://hagans.law/

Tricia Howard is the CMO at Above Security. In this episode, she joins host Amanda Glassner to reflect on some of the security conversations that took place at Black Hat USA 2026. Above Security is an AI-native managed insider-threat platform for proactive risk management. To learn more about our sponsor, visit https://above.security. • For more on cybersecurity, visit us at https://cybersecurityventures.com

What if the point of AI wasn't to make more, but to work less?This is the thing everyone said AI should do that nobody's actually doing. All the capitalists want to use AI to make more money, not work less.In this episode of Small Effort (Season 4, Episode 15), Sean and Andrew dig into the team that used AI to move to a four-day week instead of squeezing out more, and the WordCamp pivot it mirrors: Andrew walking away from SEO autopilot to build content you're actually proud to publish. They cover why platform risk still burns big companies, the four pillars of content that survive after the AI tricks stop working, and why "what stays stable" beats every AEO hack.Links:Andrew's Twitter: @AndrewAskinsAndrew's website: https://www.andrewaskins.com/MetaMonster: https://metamonster.ai/Slackletter: https://slackletter.com/Sean's Twitter: @seanqsunMiscreants: http://miscreants.com/Margins: http://margins.so/Sean's website: https://seanqsun.com/For more information about the podcast, check out https://www.smalleffortspod.com/Transcript:00:00.95SeanHello.00:02.69AndrewHello, my friends.00:04.02SeanHow you doing? How was WordCamp?00:04.96AndrewGood. WordCamp was... Fucking awesome. um interesting like This is my first WordCamp ever. WordCamp is definitely in decline.00:14.91Seanah00:17.37AndrewAt least Recamp US is in decline.00:17.52SeanOh. uh-oh00:19.76AndrewDone. ah00:21.27Seanis there Is there other WordCamp? Is that like WordCamp Belgium?00:23.90AndrewThey're all over the world.00:24.30Seanor00:25.14AndrewThere's like WordCamp Europe, my... uh my one of my new friends that i made at the conference is going to word camp manila next week Um... It's ah yeah, they have them all over the world. And I think they're.00:38.38AndrewThey're still bigger. They're actually now bigger overseas than they are in in the US. which is interesting00:45.15SeanThat's it.00:45.09Andrewum we00:46.87SeanSense.00:47.60AndrewYeah.00:47.49SeanIsh. Maybe.00:48.39AndrewYeah.00:48.20SeanI don't know.00:48.90Andrewissue. Um,00:49.85SeanYeah.00:50.63AndrewI think. we're from the the cheesemade that i got from people who our repeat attendees is that WordCamp US has been in decline since something happened two years ago. What what might have happened two years ago? I can't remember.01:06.94AndrewAmen. any Any big drama in the in the WordPress space? that you can remember?01:13.39SeanNo. I block that out.01:15.00Andrewfifty01:15.04SeanFrom my memory. Um, Yeah, there was a, you know, there's... For some reason, a lot of people who are on WordPress. Um, complaining about something.01:25.31SeanAnd it brought us a lot of Webflow customers. so01:27.59AndrewHell yeah. Let's go.01:29.99SeanUm, uh,01:33.65SeanYeah. i'm I'm kind of curious. like like The shockwave that must have been across. I didn't realize there were so many word camps. So I wonder if like...01:45.34SeanWhat happens in all those WordCamps, all the same, like... throughout that entire year that feels01:51.35Andrewno I know.01:51.62SeanYou know?01:52.74Andrewum I mean, I got a little bit from my my friends who've been going for years. Okay.01:57.64Seanahha01:58.98AndrewUh, But. Yeah, like WordCamp US used to be like 2 ,000 to 2 ,500 people. They also they scheduled it in Phoenix in August this year, which I think. a lot of people were like i think that's part of the reason it's not doing well although At the same time, in the back of my head, I was like Black Hat and Def Conner in August every year and fuck tons of people go.02:18.45AndrewUm.02:19.80SeanYeah.02:20.06AndrewSo I don't know that that really impacted it. But yeah, this year was like. I think. one of my friends saw the registered attendee list, and it was 900 people. down from like 2 ,500 a few years ago.02:33.16SeanOh shit. God damn.02:34.28AndrewYeah.02:35.81SeanUm.02:36.57AndrewNot a great sign.02:37.93Seanfor For those not in. the web space. Um, Um,02:46.43AndrewHe's...02:46.39SeanThe... Do you want to, I don't know.02:48.63AndrewI got, I got.02:48.83SeanYou're the expert now, so.02:50.72AndrewSo I got, I'm not an expert, but. All right. So one of the... original co-creators co-founders of wordpress um I got.03:01.61AndrewI got yelled at by a friend, not yelled at, but like I got chastised by a friend for calling him the founder of WordPress. Someone was like. More like the forker of WordPress. um03:10.74SeanHell yeah.03:14.01AndrewUm, Uh, Matt. Mullenweg? Is that his name? um Uh... Anyway. WordPress mat. um a couple years ago went Like, got really... pissy at at a Word can.03:30.22Andrewduring a keynote. Um, at WP Engine, who's like one of the largest WordPress hosts. and a competitor so like it's all complicated because like WordPress is WordPress is...03:45.18Andrewa free open source tool. that is owned by a nonprofit. um and the WordPress trademark is owned by a nonprofit. Matt also owns... automatic which is a for-profit business that offer that owns wordpress .com a for-profit WordPress hosting service um and a bunch of other WordPress tools including WooCommerce and Pressable and some others.04:08.67AndrewUm, and Um, Automatic. has a like perpetual license from WordPress .org, the nonprofit, to use the WordPress trademark.04:20.96AndrewUm, And a couple years ago, he got mad at WP Engine, who's one of their biggest competitors, um who basically built their entire reputation on...04:32.11AndrewHey, your product kind of sucks. We're going to do it better and charge more for it. And people loved them for years and years. Um, I think some people have started to leave WP Engine. I don't know.04:43.08Andrewwhat the state of the things is right now. But like for years and years, people loved WP Engine because they were just like rock solid. Awesome support. And like they charged a premium for it.04:53.56SeanAnd WP Engine also owns... um the custom field the advanced custom fields plugin All right.05:00.36AndrewYes, they own a couple of like very successful WordPress plugins as well. And that got all pissy that they were like, using WP in their name. um that they even though like everyone in the wordpress community uses wp in their name Um,05:16.26AndrewThey were using WP in their name, and he was like, you're not contributing enough to open source. You're not contributing enough to WordPress .org. and05:24.72SeanOpen source. Oh, so the name. What I what i call my wallet.05:28.52AndrewYes.05:29.19Sean...

Interview with Dan Meacham, CISO at Legendary Entertainment Dan Meacham joined us to share a preview of his leadership panel at InfoSec World. At this CRA event in October, Dan will be discussing The Augmented Defender - What AI Actually Changes on the Front Line with Daniel Bowden, the Global CISO at Marsh. Dan dives into the unique world of securing data and assets when film production is largely handled by partners and contractors, working from systems you'll likely have limited access to and definitely can't install agents on. It's a fascinating conversation you should check out! Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS Black Hat Interview 1 - Google Cloud Outpacing the Adversary with AI Threat Defense - Black Hat interview with John Hultquist, Chief Analyst, Google Threat Intelligence Group at Google The cybersecurity landscape is undergoing a radical shift. AI is no longer just a productivity accelerator for developers and analysts—it has become actively weaponized by sophisticated threat actors to discover and exploit vulnerabilities at unprecedented speed. We'll discuss Google's own approach to combating today's threats and the need for security teams to transform vulnerability management with machine-speed defense. Segment Resources: https://cloud.google.com/blog/products/identity-security/introducing-google-ai-threat-defense https://services.google.com/fh/files/misc/ebookgooglecloudsecurityaithreatdefense.pdf https://services.google.com/fh/files/misc/whitepapercombatingaidriventhreatsgooglemachinespeed_defense.pdf This segment is sponsored by Google Cloud. Visit https://securityweekly.com/googlebh to learn more! Black Hat Interview 2 - Forcepoint Decoding Agentic: Securing the Data Layer AI Just Set on Fire - Black Hat interview with Ronan Murphy, Chief Data Strategy Officer of Forcepoint AI didn't ask permission — and it permanently changed what data risk looks like. Forcepoint Chief Data Strategy officer and member of the Artificial Intelligence Advisory Council in Ireland, shares insights on a clear call to action for agentic enterprises: stop locking AI down and start securing it where the risk actually lives, in the data itself. Learn why data trust is the foundation of the agentic era and how the world's leading enterprises are ending the false choice between AI innovation and data safety. Segment Resources: https://www.forcepoint.com/resources/ebooks/enterprise-guide-ai-data-security https://www.forcepoint.com/blog/insights/forcepoint-announces-ai-data-security This segment is sponsored by Forcepoint. Visit https://securityweekly.com/forcepointbh to learn more! Black Hat Interview 3 - Keyfactor From Secrets to Verified Workload Identity—at Enterprise Scale - Black Hat interview with Ellen Boehm, SVP, Strategy & AI Innovation at Keyfactor As AI agents become autonomous participants inside enterprise environments, organizations can no longer rely on static credentials and traditional identity models to establish trust. Enterprise AI is driving a shift from possession-based access to cryptographically verified identity, as AI agents, cloud-native workloads, and automated services increasingly make decisions and interact with critical systems. In this discussion, we'll discuss why organizations need to continuously establish trust, govern machine identities and cryptography, and build a resilient foundation for securing AI across increasingly dynamic environments. Segment Resources: https://www.keyfactor.com/blog/ai-agents-the-identity-problem-nobody-owns-yet/ https://www.keyfactor.com/education-center/what-is-trust-infrastructure/ https://www.keyfactor.com/resources/topic/col/products/the-trust-control-plane?pflpid=60788&pfsid=HsCXvwPWB1 This segment is sponsored by Keyfactor. Visit https://securityweekly.com/keyfactorbh to learn more! Black Hat Interview 4 - Delinea Delinea Delivers Runtime Authorization for AI Agents, Closing Access Control Gap - Black Hat interview with Frank Vukovits, Chief Security Scientist at Delinea As AI agents move from experiments to autonomous operators inside production databases, cloud consoles, and Kubernetes clusters, enterprises face a new problem: agents with legitimate credentials taking actions no one authorized. Frank breaks down why verifying access at connection time is no longer enough and what it takes to enforce policy on every agent action before it executes. He explains how runtime authorization closes the gap between hiding credentials and actually controlling what agents do once they're inside a session. This segment is sponsored by Delinea. Visit https://securityweekly.com/delineabh to learn more! Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-474

Alpha Warrior and Josh Reid tackle the question that runs under everything: in a war of perception versus truth, who are the actual good guys? They start from the messy present, the special government employee reveals around Data Republican and Nick Sortor, the "are they on a payroll" arguments, and the Department of War's rumored 60,000 strong ghost army, then reach back to a single Q post that names Black Hats to build out a hats framework of white, gray, and black. Josh and Alpha wrestle with the uncomfortable premise that good guys sometimes have to do questionable things behind plausible deniability, and that disinformation can be a necessary wartime tool aimed at the enemy rather than the audience. Expect board readings, a detour through Trump's Hegseth and Gabbard picks, and a lot of "perception is not truth." No neat bow, just a sharper lens. Bring an open mind.

Interview with Dan Meacham, CISO at Legendary Entertainment Dan Meacham joined us to share a preview of his leadership panel at InfoSec World. At this CRA event in October, Dan will be discussing The Augmented Defender - What AI Actually Changes on the Front Line with Daniel Bowden, the Global CISO at Marsh. Dan dives into the unique world of securing data and assets when film production is largely handled by partners and contractors, working from systems you'll likely have limited access to and definitely can't install agents on. It's a fascinating conversation you should check out! Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS Black Hat Interview 1 - Google Cloud Outpacing the Adversary with AI Threat Defense - Black Hat interview with John Hultquist, Chief Analyst, Google Threat Intelligence Group at Google The cybersecurity landscape is undergoing a radical shift. AI is no longer just a productivity accelerator for developers and analysts—it has become actively weaponized by sophisticated threat actors to discover and exploit vulnerabilities at unprecedented speed. We'll discuss Google's own approach to combating today's threats and the need for security teams to transform vulnerability management with machine-speed defense. Segment Resources: https://cloud.google.com/blog/products/identity-security/introducing-google-ai-threat-defense https://services.google.com/fh/files/misc/ebookgooglecloudsecurityaithreatdefense.pdf https://services.google.com/fh/files/misc/whitepapercombatingaidriventhreatsgooglemachinespeed_defense.pdf This segment is sponsored by Google Cloud. Visit https://securityweekly.com/googlebh to learn more! Black Hat Interview 2 - Forcepoint Decoding Agentic: Securing the Data Layer AI Just Set on Fire - Black Hat interview with Ronan Murphy, Chief Data Strategy Officer of Forcepoint AI didn't ask permission — and it permanently changed what data risk looks like. Forcepoint Chief Data Strategy officer and member of the Artificial Intelligence Advisory Council in Ireland, shares insights on a clear call to action for agentic enterprises: stop locking AI down and start securing it where the risk actually lives, in the data itself. Learn why data trust is the foundation of the agentic era and how the world's leading enterprises are ending the false choice between AI innovation and data safety. Segment Resources: https://www.forcepoint.com/resources/ebooks/enterprise-guide-ai-data-security https://www.forcepoint.com/blog/insights/forcepoint-announces-ai-data-security This segment is sponsored by Forcepoint. Visit https://securityweekly.com/forcepointbh to learn more! Black Hat Interview 3 - Keyfactor From Secrets to Verified Workload Identity—at Enterprise Scale - Black Hat interview with Ellen Boehm, SVP, Strategy & AI Innovation at Keyfactor As AI agents become autonomous participants inside enterprise environments, organizations can no longer rely on static credentials and traditional identity models to establish trust. Enterprise AI is driving a shift from possession-based access to cryptographically verified identity, as AI agents, cloud-native workloads, and automated services increasingly make decisions and interact with critical systems. In this discussion, we'll discuss why organizations need to continuously establish trust, govern machine identities and cryptography, and build a resilient foundation for securing AI across increasingly dynamic environments. Segment Resources: https://www.keyfactor.com/blog/ai-agents-the-identity-problem-nobody-owns-yet/ https://www.keyfactor.com/education-center/what-is-trust-infrastructure/ https://www.keyfactor.com/resources/topic/col/products/the-trust-control-plane?pflpid=60788&pfsid=HsCXvwPWB1 This segment is sponsored by Keyfactor. Visit https://securityweekly.com/keyfactorbh to learn more! Black Hat Interview 4 - Delinea Delinea Delivers Runtime Authorization for AI Agents, Closing Access Control Gap - Black Hat interview with Frank Vukovits, Chief Security Scientist at Delinea As AI agents move from experiments to autonomous operators inside production databases, cloud consoles, and Kubernetes clusters, enterprises face a new problem: agents with legitimate credentials taking actions no one authorized. Frank breaks down why verifying access at connection time is no longer enough and what it takes to enforce policy on every agent action before it executes. He explains how runtime authorization closes the gap between hiding credentials and actually controlling what agents do once they're inside a session. This segment is sponsored by Delinea. Visit https://securityweekly.com/delineabh to learn more! Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-474

Interview with Dan Meacham, CISO at Legendary Entertainment Dan Meacham joined us to share a preview of his leadership panel at InfoSec World. At this CRA event in October, Dan will be discussing The Augmented Defender - What AI Actually Changes on the Front Line with Daniel Bowden, the Global CISO at Marsh. Dan dives into the unique world of securing data and assets when film production is largely handled by partners and contractors, working from systems you'll likely have limited access to and definitely can't install agents on. It's a fascinating conversation you should check out! Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS Black Hat Interview 1 - Google Cloud Outpacing the Adversary with AI Threat Defense - Black Hat interview with John Hultquist, Chief Analyst, Google Threat Intelligence Group at Google The cybersecurity landscape is undergoing a radical shift. AI is no longer just a productivity accelerator for developers and analysts—it has become actively weaponized by sophisticated threat actors to discover and exploit vulnerabilities at unprecedented speed. We'll discuss Google's own approach to combating today's threats and the need for security teams to transform vulnerability management with machine-speed defense. Segment Resources: https://cloud.google.com/blog/products/identity-security/introducing-google-ai-threat-defense https://services.google.com/fh/files/misc/ebookgooglecloudsecurityaithreatdefense.pdf https://services.google.com/fh/files/misc/whitepapercombatingaidriventhreatsgooglemachinespeed_defense.pdf This segment is sponsored by Google Cloud. Visit https://securityweekly.com/googlebh to learn more! Black Hat Interview 2 - Forcepoint Decoding Agentic: Securing the Data Layer AI Just Set on Fire - Black Hat interview with Ronan Murphy, Chief Data Strategy Officer of Forcepoint AI didn't ask permission — and it permanently changed what data risk looks like. Forcepoint Chief Data Strategy officer and member of the Artificial Intelligence Advisory Council in Ireland, shares insights on a clear call to action for agentic enterprises: stop locking AI down and start securing it where the risk actually lives, in the data itself. Learn why data trust is the foundation of the agentic era and how the world's leading enterprises are ending the false choice between AI innovation and data safety. Segment Resources: https://www.forcepoint.com/resources/ebooks/enterprise-guide-ai-data-security https://www.forcepoint.com/blog/insights/forcepoint-announces-ai-data-security This segment is sponsored by Forcepoint. Visit https://securityweekly.com/forcepointbh to learn more! Black Hat Interview 3 - Keyfactor From Secrets to Verified Workload Identity—at Enterprise Scale - Black Hat interview with Ellen Boehm, SVP, Strategy & AI Innovation at Keyfactor As AI agents become autonomous participants inside enterprise environments, organizations can no longer rely on static credentials and traditional identity models to establish trust. Enterprise AI is driving a shift from possession-based access to cryptographically verified identity, as AI agents, cloud-native workloads, and automated services increasingly make decisions and interact with critical systems. In this discussion, we'll discuss why organizations need to continuously establish trust, govern machine identities and cryptography, and build a resilient foundation for securing AI across increasingly dynamic environments. Segment Resources: https://www.keyfactor.com/blog/ai-agents-the-identity-problem-nobody-owns-yet/ https://www.keyfactor.com/education-center/what-is-trust-infrastructure/ https://www.keyfactor.com/resources/topic/col/products/the-trust-control-plane?pflpid=60788&pfsid=HsCXvwPWB1 This segment is sponsored by Keyfactor. Visit https://securityweekly.com/keyfactorbh to learn more! Black Hat Interview 4 - Delinea Delinea Delivers Runtime Authorization for AI Agents, Closing Access Control Gap - Black Hat interview with Frank Vukovits, Chief Security Scientist at Delinea As AI agents move from experiments to autonomous operators inside production databases, cloud consoles, and Kubernetes clusters, enterprises face a new problem: agents with legitimate credentials taking actions no one authorized. Frank breaks down why verifying access at connection time is no longer enough and what it takes to enforce policy on every agent action before it executes. He explains how runtime authorization closes the gap between hiding credentials and actually controlling what agents do once they're inside a session. This segment is sponsored by Delinea. Visit https://securityweekly.com/delineabh to learn more! Show Notes: https://securityweekly.com/esw-474

Last year Snehal Antani keynoted Black Hat alongside the NSA to share a number that should worry every security leader: full domain compromise on a defense industrial base supplier in 77 seconds. Antani is the co-founder and CEO of Horizon3.ai, and he built the autonomous AI hacker, NodeZero, that ran that test.In this conversation we get into why "compliant" and "secure" stopped being the same thing, why AI attackers are actually more gullible than most people assume, and what changes when a security team can pentest its own environment continuously instead of once a year.What you'll learn: why security has become an evidence problem, not a visibility problem, and what that means for GRC teams who spend their careers documenting controls. How a 9-year-old used Horizon3's product to hack a bank in 4 minutes and 12 seconds with no prior experience. Why AI attackers are more gullible than human ones, and how honeypots and honey tokens exploit that gullibility. What NodeZero Tripwires are, and how they turn a completed pentest into an early warning system for real attackers. Why NodeZero's 325,000-plus production-safe pentests make Horizon3 a data company first and a pentesting company second. What made web applications the hardest domain for autonomous pentesting to crack, and why that's changing fast. How blue team agents now auto-fix problems like a misconfigured EDR in real time, during the pentest itself. Why "prove you're resilient" is replacing "hope you are" as the new standard for CISOs.This video was produced in partnership with Horizon3.ai. All opinions are Snehal's own. Learn more about Horizon3's autonomous pentesting platform: https://horizon3.ai/simplycyber If this was useful, subscribe to Simply Cyber for more conversations like this one.Chapters:0:00 Cold Open, "If You Can't Stop Us in 76 Seconds, It's Game Over"1:04 Why Security Has Become an Evidence Problem, Not a Visibility Problem2:36 How AI Compressed Attacker Economics From Weeks to Minutes3:39 Why AI Attackers Are Gullible, and How Honeypots Exploit It4:27 What Evidence Actually Looks Like for a Security Team on an Ordinary Tuesday5:55 Where AI Makes Defenders Faster vs Where It Makes Them Complacent7:26 Inside NodeZero, How an Autonomous AI Pentest Actually Works9:44 What 325,000 Pentests Taught Horizon3 That Annual Testing Never Could11:26 NodeZero Tripwires, Turning a Completed Pentest Into a Threat Hunt12:49 Why Web Applications Are the Hardest Target for Autonomous Pentesting15:00 How to Prove an Autonomous AI Pentest Is Safe to Run in Production18:27 Inside the $250M Raise and the Road to a $2 Billion Valuation20:50 What It Takes to Earn Trust From the NSA and CISA23:00 Why "Prove You're Resilient" Is Replacing "Hope You Are"=========================Simply Cyber empowers people who want a rewarding cybersecurity career

Interview with Dan Meacham, CISO at Legendary Entertainment Dan Meacham joined us to share a preview of his leadership panel at InfoSec World. At this CRA event in October, Dan will be discussing The Augmented Defender - What AI Actually Changes on the Front Line with Daniel Bowden, the Global CISO at Marsh. Dan dives into the unique world of securing data and assets when film production is largely handled by partners and contractors, working from systems you'll likely have limited access to and definitely can't install agents on. It's a fascinating conversation you should check out! Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS Black Hat Interview 1 - Google Cloud Outpacing the Adversary with AI Threat Defense - Black Hat interview with John Hultquist, Chief Analyst, Google Threat Intelligence Group at Google The cybersecurity landscape is undergoing a radical shift. AI is no longer just a productivity accelerator for developers and analysts—it has become actively weaponized by sophisticated threat actors to discover and exploit vulnerabilities at unprecedented speed. We'll discuss Google's own approach to combating today's threats and the need for security teams to transform vulnerability management with machine-speed defense. Segment Resources: https://cloud.google.com/blog/products/identity-security/introducing-google-ai-threat-defense https://services.google.com/fh/files/misc/ebookgooglecloudsecurityaithreatdefense.pdf https://services.google.com/fh/files/misc/whitepapercombatingaidriventhreatsgooglemachinespeed_defense.pdf This segment is sponsored by Google Cloud. Visit https://securityweekly.com/googlebh to learn more! Black Hat Interview 2 - Forcepoint Decoding Agentic: Securing the Data Layer AI Just Set on Fire - Black Hat interview with Ronan Murphy, Chief Data Strategy Officer of Forcepoint AI didn't ask permission — and it permanently changed what data risk looks like. Forcepoint Chief Data Strategy officer and member of the Artificial Intelligence Advisory Council in Ireland, shares insights on a clear call to action for agentic enterprises: stop locking AI down and start securing it where the risk actually lives, in the data itself. Learn why data trust is the foundation of the agentic era and how the world's leading enterprises are ending the false choice between AI innovation and data safety. Segment Resources: https://www.forcepoint.com/resources/ebooks/enterprise-guide-ai-data-security https://www.forcepoint.com/blog/insights/forcepoint-announces-ai-data-security This segment is sponsored by Forcepoint. Visit https://securityweekly.com/forcepointbh to learn more! Black Hat Interview 3 - Keyfactor From Secrets to Verified Workload Identity—at Enterprise Scale - Black Hat interview with Ellen Boehm, SVP, Strategy & AI Innovation at Keyfactor As AI agents become autonomous participants inside enterprise environments, organizations can no longer rely on static credentials and traditional identity models to establish trust. Enterprise AI is driving a shift from possession-based access to cryptographically verified identity, as AI agents, cloud-native workloads, and automated services increasingly make decisions and interact with critical systems. In this discussion, we'll discuss why organizations need to continuously establish trust, govern machine identities and cryptography, and build a resilient foundation for securing AI across increasingly dynamic environments. Segment Resources: https://www.keyfactor.com/blog/ai-agents-the-identity-problem-nobody-owns-yet/ https://www.keyfactor.com/education-center/what-is-trust-infrastructure/ https://www.keyfactor.com/resources/topic/col/products/the-trust-control-plane?pflpid=60788&pfsid=HsCXvwPWB1 This segment is sponsored by Keyfactor. Visit https://securityweekly.com/keyfactorbh to learn more! Black Hat Interview 4 - Delinea Delinea Delivers Runtime Authorization for AI Agents, Closing Access Control Gap - Black Hat interview with Frank Vukovits, Chief Security Scientist at Delinea As AI agents move from experiments to autonomous operators inside production databases, cloud consoles, and Kubernetes clusters, enterprises face a new problem: agents with legitimate credentials taking actions no one authorized. Frank breaks down why verifying access at connection time is no longer enough and what it takes to enforce policy on every agent action before it executes. He explains how runtime authorization closes the gap between hiding credentials and actually controlling what agents do once they're inside a session. This segment is sponsored by Delinea. Visit https://securityweekly.com/delineabh to learn more! Show Notes: https://securityweekly.com/esw-474

This week's full broadcast of Computer Talk Radio includes - 00:00 - Tech News made less nerdy - Computer Purchasing guidelines in the current RAM crisis - 11:00 - Solving the RAM crisis - Benjamin unpacks why solving the RAM crisis is so difficult - 22:00 - AI as we have it vs Star Trek - Benjamin and Keith banter over where we are going with AI - 31:00 - Marty Winston's Wisdom - Navamo lawnmower experience by Marty's picky neighbor - 39:00 - Scam Series - empty envelope QR - Benjamin warns of odd empty envelopes with QR codes - 44:00 - Keske on aircraft - Steve and Benjamin talk about the technology of aircraft - 56:00 - Dr Doreen Galli - Whisper Reports - Doreen covers new reports on Blackhat, Infocomm, and CUAV - 1:07:00 - Smart homes making lives easier - Benjamin tells how smart home devices make life easier - 1:16:00 - IT Professional Series - 394 - Distractions, even smaller ones can disrupt workflows - 1:24:00 - Listener Q&A - waking monitor - Lucas is concerned his monitor wakes up when computer is off

An attacker who wants to reach an executive often goes through the people around them. Family members, assistants, advisors, and caregivers all carry access and standing, and none of them sit inside the corporate directory. Dr. Chris Pierson, Founder and CEO of BlackCloak, describes digital executive protection as work that comes down to an individual and the circle around that individual. What does BlackCloak actually protect? Corporate executives, boards, the C-suite, and their families, across privacy, personal cybersecurity, home network security, deepfake impersonation, and travel. Dr. Chris Pierson frames impersonation protection and deepfake protection as an answer to someone pretending to be a human being in order to swindle, defraud, or take advantage of a persona. The control point sits with the person rather than the message. What did security teams want to talk about at Black Hat this year? Specifics. Dr. Chris Pierson says the excitement around AI and agentic AI arrived with a demand to dig in and actually talk about it. He recalls standing nearby while BlackCloak SVP of Product Matt Covington explained how the company uses engines, as opposed to the marketing language circulating elsewhere. Two more patterns came through. People want a real relationship with the team behind a product rather than something they plug in and hook up, and Dr. Chris Pierson points to a community at Black Hat that he says has built up considerably over the past four years or so. People also want net new. Version nine of a familiar firewall is becoming a little less exciting, he says, and the sales engineers spent their time on the additive items instead. BlackCloak appears on the 2026 Inc. 5000 for a second consecutive year, and earlier in 2026 it was named to Inc.'s Best Workplaces list in the Security Industry category, also for a second year. Dr. Chris Pierson credits the roughly 150 Cloakers based in the US, the company's own word for its team members, for both. The data matters, the hardware matters, the platform matters, and at the end of it someone clicks, someone allows access, someone does something. That last step is where BlackCloak places its protection. This is a Black Hat USA 2026 Recap. It is a post-event conversation revisiting the week on the ground, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Dr. Chris Pierson, Founder and CEO at BlackCloak On LinkedIn: https://www.linkedin.com/in/drchristopherpierson/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about BlackCloak: https://blackcloak.io Impersonation Protection: https://blackcloak.io/impersonation-protection/ BlackCloak Extends Deepfake Protection to the Executive's Entire Trusted Circle: https://blackcloak.io/news-media/blackcloak-extends-deepfake-protection-to-the-executives-entire-trusted-circle/ BlackCloak Featured on the 2026 Inc. 5000 for Second Consecutive Year: https://blackcloak.io/news-media/blackcloak-featured-on-the-2026-inc-5000-for-second-consecutive-year/ BlackCloak Named to Inc.'s 2026 Best Workplaces List for Second Consecutive Year: https://www.prweb.com/releases/blackcloak-named-to-incs-2026-best-workplaces-list-for-second-consecutive-year-302788730.html Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS Dr. Chris Pierson, BlackCloak, Sean Martin, Marco Ciappelli, recap, brand story, brand marketing, marketing podcast, Black Hat USA 2026, digital executive protection, impersonation protection, deepfake protection, circle of trust, executive threat intelligence, travel advisory, human attack surface, Inc. 5000, Cloakers

Kevin Surace, Chief Executive Officer at TokenCore, opens with the attack path he says is doing the most damage right now. A phishing email carries a PDF and no links, so it clears the filters. The domain is one character off from the real one, the site is pixel perfect because AI built both the page and the message, and the employee approves an auth prompt they were already expecting. The code was real and the approval was real. Kevin Surace points out that auth apps and passkeys run over cellular and Wi-Fi, so the prompt has no way to know the request came from ten thousand miles away. Anything a person can read or hand over can be shared, and by his account an attacker needs about thirty seconds of trust to get it. Passkeys moved the target rather than removing it. Kevin Surace counts 39 separate passkey attacks in the wild within two weeks of Microsoft telling customers to migrate, and points to Michael Grafnetter of SpecterOps, who presented passkey and Entra research at Black Hat. He walks through the FIDO2 counter that WebAuthn treats as optional so shared passkeys can move between devices. What changes with TokenCore in the mix is where the proof sits. Kevin Surace describes signing into Entra in under two seconds, both passwordless and ID-less, over secure Bluetooth, with the device carrying no apps and no screen. Proximity holds it within three feet of the computer being logged into, the credential stays bound to the original domain, and fingerprints stay off the network. Agents raise the same question in a new place. Kevin Surace describes a policy where an agent action above a million-dollar check needs a person to approve it, and notes that another agent, a hacked one, or a bad actor can clear that approval just as easily. A biometric gate is what tells you the CFO was actually in the room, which is a governance answer as much as a security one. For CISOs, identity architects, and risk owners, the question worth asking is what an identity program looks like when the proof of a person becomes the control, and how much residual risk that removes from privileged access, financial approvals, and agent workflows. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Kevin Surace, Chief Executive Officer at TokenCore LinkedIn: https://www.linkedin.com/in/ksurace/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about TokenCore: https://www.tokencore.com TokenCore products: https://www.tokencore.com/products Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS Kevin Surace, TokenCore, Sean Martin, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, biometric identity, identity assurance, passkey attacks, MFA relay attack, phishing resistant authentication, auth app compromise, FIDO2, WebAuthn, Microsoft Entra, passwordless authentication, agent authorization, privileged access

The threat landscape has become more interconnected, disruptive, and complex. Ransomware is now as much about extortion and data theft as it is about encryption. Supply chain events can create outages that ripple far beyond the initial target, and business interruption increasingly comes from third-party and cloud dependencies. How should CISOs prepare for these scenarios? Dan Bowden, Global Business CISO at Marsh, joins Business Security Weekly to discuss how to connect cyber risk to the outcomes boards care about most: resilience, financial exposure, regulatory impact, and reputation. CISOs need to position cyber as an enterprise risk, not a technical risk, that can be measured, prioritized, and managed alongside other strategic risks. Dan will discuss the results of Marsh's Cyber Catalyst research and Global Cyber Claims Report. Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS The Agent Is the New Insider: Why Human Risk Doesn't Stop at People: Black Hat Interview with Leslie Nielson, CISO at Mimecast AI agents now act with the same credentials and access as the humans who deployed them, but without the judgment or accountability that comes with actual employment. Mimecast CISO Leslie Nielsen argues that treating agentic AI as a brand new, standalone security category is the wrong instinct: agents are an extension of human risk, and the controls organizations already use to manage people are the right foundation for managing machines. In this conversation, Nielsen unpacks the growing gap between security leaders who expect AI driven attacks and those who feel prepared for them, and what that gap means for CISOs walking the floor at Black Hat. Segment Resources: Mimecast's new whitepaper Securing The Agentic Enterprise: https://assets.mimecast.com/api/public/content/securing-the-agentic-enterprise?v=ea66db05 Mimecast's landing page for thought leadership resources: https://www.workprotected.com/ Mimecast's State of Human Risk Report: https://www.mimecast.com/resources/ebooks/state-of-human-risk/ Mimecast's Threat Intelligence Hub: https://www.mimecast.com/threat-intelligence-hub/ For more information about Mimecast please visit: https://securityweekly.com/mimecastbh Ransomware Moves up the Org Chart: Managers Are Prime Targets: Black Hat Interview with Brett Stone-Gross, Sr. Director, Threat Intelligence at Zscaler When a ransomware attack makes headlines, attention usually turns to the organization that was breached, the systems encrypted, data stolen, and disruption or ransom demand that followed. Less, if anything, is revealed about the employees compromised at the start of the attack, and what makes those individuals valuable targets. New Zscaler ThreatLabz research examines this early stage of a real-world ransomware attack. ThreatLabz identified victims of a campaign associated with a ransomware group known for gaining initial access, stealing large amounts of corporate data, and selectively encrypting critical systems. The findings show who those victims were and how their roles and authority could help an attacker move deeper into an organization. This is part of ongoing ransomware research by ThreatLabz. The Zscaler ThreatLabz 2026 Ransomware Report, coming in the next two months, will include additional data on ransomware victims, the latest ransomware trends, targets, and tactics, and the risks enterprises should prepare for next. This segment is sponsored by Zscaler. Visit https://securityweekly.com/zscalerbh to learn more about them! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-462

The threat landscape has become more interconnected, disruptive, and complex. Ransomware is now as much about extortion and data theft as it is about encryption. Supply chain events can create outages that ripple far beyond the initial target, and business interruption increasingly comes from third-party and cloud dependencies. How should CISOs prepare for these scenarios? Dan Bowden, Global Business CISO at Marsh, joins Business Security Weekly to discuss how to connect cyber risk to the outcomes boards care about most: resilience, financial exposure, regulatory impact, and reputation. CISOs need to position cyber as an enterprise risk, not a technical risk, that can be measured, prioritized, and managed alongside other strategic risks. Dan will discuss the results of Marsh's Cyber Catalyst research and Global Cyber Claims Report. Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS The Agent Is the New Insider: Why Human Risk Doesn't Stop at People: Black Hat Interview with Leslie Nielson, CISO at Mimecast AI agents now act with the same credentials and access as the humans who deployed them, but without the judgment or accountability that comes with actual employment. Mimecast CISO Leslie Nielsen argues that treating agentic AI as a brand new, standalone security category is the wrong instinct: agents are an extension of human risk, and the controls organizations already use to manage people are the right foundation for managing machines. In this conversation, Nielsen unpacks the growing gap between security leaders who expect AI driven attacks and those who feel prepared for them, and what that gap means for CISOs walking the floor at Black Hat. Segment Resources: Mimecast's new whitepaper Securing The Agentic Enterprise: https://assets.mimecast.com/api/public/content/securing-the-agentic-enterprise?v=ea66db05 Mimecast's landing page for thought leadership resources: https://www.workprotected.com/ Mimecast's State of Human Risk Report: https://www.mimecast.com/resources/ebooks/state-of-human-risk/ Mimecast's Threat Intelligence Hub: https://www.mimecast.com/threat-intelligence-hub/ For more information about Mimecast please visit: https://securityweekly.com/mimecastbh Ransomware Moves up the Org Chart: Managers Are Prime Targets: Black Hat Interview with Brett Stone-Gross, Sr. Director, Threat Intelligence at Zscaler When a ransomware attack makes headlines, attention usually turns to the organization that was breached, the systems encrypted, data stolen, and disruption or ransom demand that followed. Less, if anything, is revealed about the employees compromised at the start of the attack, and what makes those individuals valuable targets. New Zscaler ThreatLabz research examines this early stage of a real-world ransomware attack. ThreatLabz identified victims of a campaign associated with a ransomware group known for gaining initial access, stealing large amounts of corporate data, and selectively encrypting critical systems. The findings show who those victims were and how their roles and authority could help an attacker move deeper into an organization. This is part of ongoing ransomware research by ThreatLabz. The Zscaler ThreatLabz 2026 Ransomware Report, coming in the next two months, will include additional data on ransomware victims, the latest ransomware trends, targets, and tactics, and the risks enterprises should prepare for next. This segment is sponsored by Zscaler. Visit https://securityweekly.com/zscalerbh to learn more about them! Show Notes: https://securityweekly.com/bsw-462

The threat landscape has become more interconnected, disruptive, and complex. Ransomware is now as much about extortion and data theft as it is about encryption. Supply chain events can create outages that ripple far beyond the initial target, and business interruption increasingly comes from third-party and cloud dependencies. How should CISOs prepare for these scenarios? Dan Bowden, Global Business CISO at Marsh, joins Business Security Weekly to discuss how to connect cyber risk to the outcomes boards care about most: resilience, financial exposure, regulatory impact, and reputation. CISOs need to position cyber as an enterprise risk, not a technical risk, that can be measured, prioritized, and managed alongside other strategic risks. Dan will discuss the results of Marsh's Cyber Catalyst research and Global Cyber Claims Report. Visit https://securityweekly.com/infosecworld2026 and save 30% on your ISW pass with code: ISW26-SWSAVINGS The Agent Is the New Insider: Why Human Risk Doesn't Stop at People: Black Hat Interview with Leslie Nielson, CISO at Mimecast AI agents now act with the same credentials and access as the humans who deployed them, but without the judgment or accountability that comes with actual employment. Mimecast CISO Leslie Nielsen argues that treating agentic AI as a brand new, standalone security category is the wrong instinct: agents are an extension of human risk, and the controls organizations already use to manage people are the right foundation for managing machines. In this conversation, Nielsen unpacks the growing gap between security leaders who expect AI driven attacks and those who feel prepared for them, and what that gap means for CISOs walking the floor at Black Hat. Segment Resources: Mimecast's new whitepaper Securing The Agentic Enterprise: https://assets.mimecast.com/api/public/content/securing-the-agentic-enterprise?v=ea66db05 Mimecast's landing page for thought leadership resources: https://www.workprotected.com/ Mimecast's State of Human Risk Report: https://www.mimecast.com/resources/ebooks/state-of-human-risk/ Mimecast's Threat Intelligence Hub: https://www.mimecast.com/threat-intelligence-hub/ For more information about Mimecast please visit: https://securityweekly.com/mimecastbh Ransomware Moves up the Org Chart: Managers Are Prime Targets: Black Hat Interview with Brett Stone-Gross, Sr. Director, Threat Intelligence at Zscaler When a ransomware attack makes headlines, attention usually turns to the organization that was breached, the systems encrypted, data stolen, and disruption or ransom demand that followed. Less, if anything, is revealed about the employees compromised at the start of the attack, and what makes those individuals valuable targets. New Zscaler ThreatLabz research examines this early stage of a real-world ransomware attack. ThreatLabz identified victims of a campaign associated with a ransomware group known for gaining initial access, stealing large amounts of corporate data, and selectively encrypting critical systems. The findings show who those victims were and how their roles and authority could help an attacker move deeper into an organization. This is part of ongoing ransomware research by ThreatLabz. The Zscaler ThreatLabz 2026 Ransomware Report, coming in the next two months, will include additional data on ransomware victims, the latest ransomware trends, targets, and tactics, and the risks enterprises should prepare for next. This segment is sponsored by Zscaler. Visit https://securityweekly.com/zscalerbh to learn more about them! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-462

Blake Howard convenes a conclave with Sean Burns (WBUR) and Roxana Hadadi (Vulture) to sort the smoke from the fire. Inde Navarrette walked from Charlene Shiherlis to play Rogue — then maybe didn't walk at all. Underneath the trade churn, an older argument reignited: that Mann hasn't made a good film since Collateral, with Miami Vice, Public Enemies and Blackhat wheeled out as exhibits for the prosecution. We litigate the post-2004 filmography, we ask what a casting rumour is actually worth, and we work out how "washed" became a load-bearing critical term in 2026. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Labeled Security Summer Camp by some, the Black Hat and DEF CON security conferences have been the premier events for security researchers and practitioners. Analysts Dan Kennedy and Justin Lam returned from the heat of Las Vegas to discuss their take on what went down in the desert with host Eric Hanselman. More than 23,000 attendees were reported to be part of the sprawling Black Hat start to the week and DEF CON has grown to be its equal in size. There was more discussion about the realities of what AI can do for and against security operations. The implications around Mythos have raised fears of a cascade of vulnerability disclosures that will overwhelm our ability to remediate them, but a growing risk comes from AI tooling being able to create more complex environments and processes to make complex vulnerabilities more easily exploitable. On the security defense side, AI's ability to interpret complex interactions and relationships is showing potential to reduce the risk of rolling out new controls by understanding what policies could break. It's an area where there have historically been delays in improving protections where concerns that new controls might break existing applications or access held security teams back. One of the greatest benefits of the conferences, though, may be the ability of security professionals to gather together and have the informal interactions that are needed to support each other in the complex world that information security has become.   More S&P Global Content: Next in Tech | Ep. 267: Mythos and Security Generative AI Digest: OpenClaw and Moltbook make a splash Generative AI funding: A sober retrospective and the trends shaping 2026 RSAC Conference 2026: Confronting both the promise and threat of agentic AI For S&P Global subscribers: Information security budgets rise, but must address cloud security, AI governance – Highlights from VotE: Information Security AI's impact in security and its application are not always aligned – Highlights from VotE: Information Security Fulcrum accountability, aligning personas and progress in data security Host/Author: Eric Hanselman  Guests: Dan Kennedy and Justin Lam Producer/Editor: Dylan Scheible 

Meta faces a $1.4 trillion lawsuit, flock cameras are sparking a privacy revolt, and data centers may be fueling the next bubble. This episode pulls back the curtain on who's watching, who's profiting, and who could pay the price. Meta's Big Reckoning Is Here Meta heads to court in a landmark trial about kids and social media addiction Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230 The $1.4 Trillion State Tort Raid on Meta Google's Pixel 11 Comes With Plenty of A.I. Does Anyone Want That? Waymo's cheaper, next-gen robotaxi is now open to all riders in these three cities Apple and European Commission Reach Agreement on App Payment Terms Under DMA, With Apple Conceding Very Little Apple is laying off staffers working on the Vision Pro and Siri Hidden Airtag reveals Amazon is trashing rare books to train AI Amazon aims for delivery drones to reach 500 US neighborhoods by the end of 2026 NVIDIA to Back Ohio Data Center With as Much as $105 Billion Why Big Tech's AI Spending Is $3 Trillion Higher Than It Seems New Chinese model adds to AI competition Police Are Hiding Their Use of Flock Surveillance Cameras Flock mistakenly flags 2 different auto writers for "stolen" license plates Go Flock Yourself Flock socks for UV protection Ban on Chinese robots leaves U.S. startups stranded China Is Strapping 'Digital Bombs' to Civilian Infrastructure—Is the US Ready? Host: Leo Laporte Guests: Sam Abuelsamid and Fr. Robert Ballecer, SJ Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: superhuman.com claude.ai/technology doppel.com joinbilt.com/twit adaptivesecurity.com

Polymarket traders win big on U.S. military insider information. Slovakia deactivates speed cameras with Russian backdoors. TikTok pays $400 million to settle kids' privacy allegations. Hackers infect Android-based car systems with botnet malware. CISA orders quick patching of an actively exploited Zimbra Collaboration Suite vulnerability. SynkLoader malware is built for stealthy access to corporate networks. Dutch authorities fine Uber over $900 million over automated hiring practices. An ATM jackpotter gets a record prison sentence. Monday business briefing. A privacy promise loses face.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest On our Industry Voices segment, we are joined by Mark Beare, General Manager at Malwarebytes Consumer Business from Black Hat to look at protecting your family in the age of AI. If you enjoyed this conversation, check out the full interview here. Selected Reading More than 150 Polymarket wallets may have traded on military secrets, research finds (Reuters) Slovakia discovers Russian backdoors in 279 new traffic cameras — SMS-triggered shell access and passwordless live feeds found in EU-funded rollout (Tom's Hardware) TikTok Settles U.S. Child Privacy Case for $400 Million (Security Affairs) Hackers infecting Android car systems to build proxy botnet (The Record) CISA orders urgent patching of actively exploited Zimbra flaw (Bleeping Computer) SynkLoader: when you throw in everything but the kitchen sink (Expel) Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts (SecurityWeek) Venezuelan Gets Record Federal Prison Term for ATM Jackpotting (SecurityWeek) Fortinet has acquired San Francisco-based AI security company Virtue AI. (N2K Pro Business Briefing) Reverse-Lookup Service Exposed Millions of Photos of People's Faces (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Meta faces a $1.4 trillion lawsuit, flock cameras are sparking a privacy revolt, and data centers may be fueling the next bubble. This episode pulls back the curtain on who's watching, who's profiting, and who could pay the price. Meta's Big Reckoning Is Here Meta heads to court in a landmark trial about kids and social media addiction Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230 The $1.4 Trillion State Tort Raid on Meta Google's Pixel 11 Comes With Plenty of A.I. Does Anyone Want That? Waymo's cheaper, next-gen robotaxi is now open to all riders in these three cities Apple and European Commission Reach Agreement on App Payment Terms Under DMA, With Apple Conceding Very Little Apple is laying off staffers working on the Vision Pro and Siri Hidden Airtag reveals Amazon is trashing rare books to train AI Amazon aims for delivery drones to reach 500 US neighborhoods by the end of 2026 NVIDIA to Back Ohio Data Center With as Much as $105 Billion Why Big Tech's AI Spending Is $3 Trillion Higher Than It Seems New Chinese model adds to AI competition Police Are Hiding Their Use of Flock Surveillance Cameras Flock mistakenly flags 2 different auto writers for "stolen" license plates Go Flock Yourself Flock socks for UV protection Ban on Chinese robots leaves U.S. startups stranded China Is Strapping 'Digital Bombs' to Civilian Infrastructure—Is the US Ready? Host: Leo Laporte Guests: Sam Abuelsamid and Fr. Robert Ballecer, SJ Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: superhuman.com claude.ai/technology doppel.com joinbilt.com/twit adaptivesecurity.com

Meta faces a $1.4 trillion lawsuit, flock cameras are sparking a privacy revolt, and data centers may be fueling the next bubble. This episode pulls back the curtain on who's watching, who's profiting, and who could pay the price. Meta's Big Reckoning Is Here Meta heads to court in a landmark trial about kids and social media addiction Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230 The $1.4 Trillion State Tort Raid on Meta Google's Pixel 11 Comes With Plenty of A.I. Does Anyone Want That? Waymo's cheaper, next-gen robotaxi is now open to all riders in these three cities Apple and European Commission Reach Agreement on App Payment Terms Under DMA, With Apple Conceding Very Little Apple is laying off staffers working on the Vision Pro and Siri Hidden Airtag reveals Amazon is trashing rare books to train AI Amazon aims for delivery drones to reach 500 US neighborhoods by the end of 2026 NVIDIA to Back Ohio Data Center With as Much as $105 Billion Why Big Tech's AI Spending Is $3 Trillion Higher Than It Seems New Chinese model adds to AI competition Police Are Hiding Their Use of Flock Surveillance Cameras Flock mistakenly flags 2 different auto writers for "stolen" license plates Go Flock Yourself Flock socks for UV protection Ban on Chinese robots leaves U.S. startups stranded China Is Strapping 'Digital Bombs' to Civilian Infrastructure—Is the US Ready? Host: Leo Laporte Guests: Sam Abuelsamid and Fr. Robert Ballecer, SJ Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: superhuman.com claude.ai/technology doppel.com joinbilt.com/twit adaptivesecurity.com

Interview with Rob Allen from Threatlocker Safely enabling agentic AI for Businesses OpenClaw was the wakeup call and businesses wanted to know how to block it. “Easy,” Rob Allen said, “it's already blocked if you're using Threatlocker.” Now that things have settled down a bit, those same businesses want to allow their employees to experiment with agents. We discuss how they can do it safely. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Topic Segment For this week's topic segment, we're discussing AI pentesting agents and how likely they are to get you into big legal trouble. You came home from Black Hat with a new, shiny AI pentesting agent. How can you be sure it isn't hacking the wrong company? News Segment Finally, in the enterprise security news, we check the vibes New MCP standard and AI text watermarking what does combatting “cyber-enabled crime” mean? A closer look at Cl0p One 3rd party was responsible for all the AI sandbox escapes and hacking reports vulnerabilities Comcast can track your movements with WiFi A novel solution to the AI datacenter water use concerns All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-473

Meta faces a $1.4 trillion lawsuit, flock cameras are sparking a privacy revolt, and data centers may be fueling the next bubble. This episode pulls back the curtain on who's watching, who's profiting, and who could pay the price. Meta's Big Reckoning Is Here Meta heads to court in a landmark trial about kids and social media addiction Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230 The $1.4 Trillion State Tort Raid on Meta Google's Pixel 11 Comes With Plenty of A.I. Does Anyone Want That? Waymo's cheaper, next-gen robotaxi is now open to all riders in these three cities Apple and European Commission Reach Agreement on App Payment Terms Under DMA, With Apple Conceding Very Little Apple is laying off staffers working on the Vision Pro and Siri Hidden Airtag reveals Amazon is trashing rare books to train AI Amazon aims for delivery drones to reach 500 US neighborhoods by the end of 2026 NVIDIA to Back Ohio Data Center With as Much as $105 Billion Why Big Tech's AI Spending Is $3 Trillion Higher Than It Seems New Chinese model adds to AI competition Police Are Hiding Their Use of Flock Surveillance Cameras Flock mistakenly flags 2 different auto writers for "stolen" license plates Go Flock Yourself Flock socks for UV protection Ban on Chinese robots leaves U.S. startups stranded China Is Strapping 'Digital Bombs' to Civilian Infrastructure—Is the US Ready? Host: Leo Laporte Guests: Sam Abuelsamid and Fr. Robert Ballecer, SJ Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: superhuman.com claude.ai/technology doppel.com joinbilt.com/twit adaptivesecurity.com

Interview with Rob Allen from Threatlocker Safely enabling agentic AI for Businesses OpenClaw was the wakeup call and businesses wanted to know how to block it. "Easy," Rob Allen said, "it's already blocked if you're using Threatlocker." Now that things have settled down a bit, those same businesses want to allow their employees to experiment with agents. We discuss how they can do it safely. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Topic Segment For this week's topic segment, we're discussing AI pentesting agents and how likely they are to get you into big legal trouble. You came home from Black Hat with a new, shiny AI pentesting agent. How can you be sure it isn't hacking the wrong company? News Segment Finally, in the enterprise security news, we check the vibes New MCP standard and AI text watermarking what does combatting "cyber-enabled crime" mean? A closer look at Cl0p One 3rd party was responsible for all the AI sandbox escapes and hacking reports vulnerabilities Comcast can track your movements with WiFi A novel solution to the AI datacenter water use concerns All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-473

On-device AI takes center stage as the panel explores MacPaw's work with Liquid AI, personal assistants, and workplace restrictions. The conversation also discusses the panel's experiences with AI note-taking recording consent and privacy in both business and health care. The panel includes: Eric Bolden, Chuck Joiner, Dave Gisnburg, Marty Jencius, Jeff Gamet, and Guy Serle.  This edition of MacVoices is brought to you by our Patreon supporters. Get access to the MacVoices Slack and MacVoices After Dark by joining in at Patreon.com/macvoices. Show Notes: Chapters: 00:00 MacPaw, Liquid AI, and On-Device Intelligence01:55 AI as a Personal Assistant02:21 Workplace Restrictions on AI Tools03:02 Gemini and Enterprise AI05:10 Separating Personal and Workplace AI06:12 Setapp, AI Credits, and MacPaw's AI Preview07:03 Why On-Device AI Matters07:32 AI Access to Calendars, Email, and Files09:47 AI Note-Taking and Privacy Concerns10:31 Consent, Cloud Storage, and Personal Data13:13 Recording Consent and State Laws13:48 Proprietary Information, NDAs, and AI15:00 One-Party Consent and Remote Conversations15:34 Recording Notifications in Online Meetings17:47 AI Recording and Consent in Healthcare19:16 AI in Dentistry and Medical Care19:44 Insurance and AI Medical Documentation21:26 Hidden Cameras and Rental Privacy23:56 Photographing the Perseid Meteor Shower with an iPhone24:31 Self-Driving Vehicles, Jobs, and Road Safety26:12 Black Hat, DEF CON, and Security Conferences27:21 Closing Thoughts Links: MacPaw Partners with Liquid AI to Bring On-Device AI to Mac Users https://appleworld.today/2026/08/macpaw-partners-with-liquid-ai-to-bring-on-device-ai-to-mac-users/   Note-Taking Apps Are Violating User Privacyhttps://lifehacker.com/tech/ai-note-taking-apps-are-violating-user-privacy   6-in-1 Hidden Camera Detector: $30https://www.dealnews.com/6-in-1-Hidden-Camera-Detector-for-30-free-shipping-w-Prime/21980524.html   Here's how much personal data your favorite apps are collecting about you https://appleworld.today/2026/08/heres-how-much-personal-data-your-favorite-apps-are-collecting-about-you/   The Best Apps to Use After Gmail's 'Send As' Feature Goes Away https://lifehacker.com/tech/gmail-ending-send-as-feature   Your iPhone can capture the Perseids meteor shower if you use the right tools https://appleinsider.com/inside/iphone/tips/your-iphone-can-capture-the-perseids-meteor-shower-if-you-use-the-right-tools The California Teamsters union is suing the state over self-driving trucks - Engadget https://www.engadget.com/2231699/california-teamsters-union-is-suing-the-state-over-self-driving-trucks/ Guests: Get detailed bios and contact information about for the panel on the MacVoices Live! Panel page on our web site:https://macvoices.com/macvoiceslive/macvoices-live-panel/ Support:      Become a MacVoices Patron on Patreon     http://patreon.com/macvoices      Enjoy this episode? Make a one-time donation with PayPal Connect:      Web:     http://macvoices.com      Twitter:     http://www.twitter.com/chuckjoiner     http://www.twitter.com/macvoices      Mastodon:     https://mastodon.cloud/@chuckjoiner      Facebook:     http://www.facebook.com/chuck.joiner      MacVoices Page on Facebook:     http://www.facebook.com/macvoices/      MacVoices Group on Facebook:     http://www.facebook.com/groups/macvoice      LinkedIn:     https://www.linkedin.com/in/chuckjoiner/      Instagram:     https://www.instagram.com/chuckjoiner/ Subscribe:      Audio in iTunes     Video in iTunes      Subscribe manually via iTunes or any podcatcher:      Audio: http://www.macvoices.com/rss/macvoicesrss      Video: http://www.macvoices.com/rss/macvoicesvideorss

Interview with Rob Allen from Threatlocker Safely enabling agentic AI for Businesses OpenClaw was the wakeup call and businesses wanted to know how to block it. "Easy," Rob Allen said, "it's already blocked if you're using Threatlocker." Now that things have settled down a bit, those same businesses want to allow their employees to experiment with agents. We discuss how they can do it safely. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Topic Segment For this week's topic segment, we're discussing AI pentesting agents and how likely they are to get you into big legal trouble. You came home from Black Hat with a new, shiny AI pentesting agent. How can you be sure it isn't hacking the wrong company? News Segment Finally, in the enterprise security news, we check the vibes New MCP standard and AI text watermarking what does combatting "cyber-enabled crime" mean? A closer look at Cl0p One 3rd party was responsible for all the AI sandbox escapes and hacking reports vulnerabilities Comcast can track your movements with WiFi A novel solution to the AI datacenter water use concerns All that and more, on this episode of Enterprise Security Weekly. Show Notes: https://securityweekly.com/esw-473

Meta faces a $1.4 trillion lawsuit, flock cameras are sparking a privacy revolt, and data centers may be fueling the next bubble. This episode pulls back the curtain on who's watching, who's profiting, and who could pay the price. Meta's Big Reckoning Is Here Meta heads to court in a landmark trial about kids and social media addiction Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230 The $1.4 Trillion State Tort Raid on Meta Google's Pixel 11 Comes With Plenty of A.I. Does Anyone Want That? Waymo's cheaper, next-gen robotaxi is now open to all riders in these three cities Apple and European Commission Reach Agreement on App Payment Terms Under DMA, With Apple Conceding Very Little Apple is laying off staffers working on the Vision Pro and Siri Hidden Airtag reveals Amazon is trashing rare books to train AI Amazon aims for delivery drones to reach 500 US neighborhoods by the end of 2026 NVIDIA to Back Ohio Data Center With as Much as $105 Billion Why Big Tech's AI Spending Is $3 Trillion Higher Than It Seems New Chinese model adds to AI competition Police Are Hiding Their Use of Flock Surveillance Cameras Flock mistakenly flags 2 different auto writers for "stolen" license plates Go Flock Yourself Flock socks for UV protection Ban on Chinese robots leaves U.S. startups stranded China Is Strapping 'Digital Bombs' to Civilian Infrastructure—Is the US Ready? Host: Leo Laporte Guests: Sam Abuelsamid and Fr. Robert Ballecer, SJ Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: superhuman.com claude.ai/technology doppel.com joinbilt.com/twit adaptivesecurity.com

An imperfect drink with a perfect story. My reflections from Black Hat USA 2026 An Analog Brain In A Digital Age — A Newsletter by Marco Ciappelli No time to read? Let TAPE3 read it to you.

Federal agencies warn of an active campaign targeting critical infrastructure. Citrix races to patch critical NetScaler flaws. More than 50,000 exposed Stripe API keys raise fraud concerns. Black Hat and DEF CON attendees are targeted in a new social engineering campaign. Atlassian, Splunk, and Cisco fix hundreds of vulnerabilities. A new Android banking trojan adds an unusual twist. A healthcare breach impacts 3.8 million people. SilkParasite expands cyberespionage in Central Asia. And CISA eyes a major overhaul of federal cyber software procurement. Our guest is Chris Wallis, founder and CEO of Intruder, on how AI agents killed the annual pentest and are reshaping exposure management. AI powered robots find bananas quite appealing.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest On our Industry Voices segment, Intruder's Founder and CEO Chris Wallis joined Dave at Black Hat to discuss why the annual pentest Is dead and how AI agents are reshaping exposure management. If you enjoyed this conversation, be sure to check out the full interview here. Selected Reading NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology (The Record) Citrix urges admins to patch new NetScaler flaws as soon as possible (Bleeping Computer) 50,000 Stripe Secrets Leaked in Public Code (SecurityAffairs) Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure (SC World) Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities (SecurityWeek) Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities (SecurityWeek) New Manic Android malware can exfiltrate data through nearby devices (Bleeping Computer) EHR Vendor Notifying 3.8 Million Patients of Data Theft Hack (GovInfo Security) SilkParasite: Tracking a China-Nexus APT Across Central Asia (Bitdefender) CISA contemplates whether to hire security software buying help (Washington Technology) I Saw the Future of AI in a Robot That Can Learn on the Spot (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.   Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

a16z's Joel De La Garza is joined by Nick Warner of Neo and Max Pollard of Cotool to discuss what happens when cybersecurity tools built to defend against humans and malware suddenly have to contend with AI agents. As frontier models become more capable of finding and exploiting vulnerabilities, many of the assumptions underlying traditional security are beginning to break. They explore why guardrails designed to stop AI-powered attackers can also prevent security teams from doing their jobs, why defenders increasingly need access to multiple models, and how agentic software creates an entirely new endpoint security problem. They also discuss why static signatures and even newer techniques like honeypots are struggling in a world where software can reason and act autonomously. Recorded around Black Hat, the conversation looks at how security teams are adapting in real time and why the same AI capabilities creating new attack surfaces could ultimately give defenders their biggest advantage yet.   Resources: Follow Nick on LinkedIn: https://www.linkedin.com/in/nicholaswarner/ Follow Max on LinkedIn: https://www.linkedin.com/in/mmpollard/ Follow Joel De La Garza on LinkedIn: https://www.linkedin.com/in/3448827723723234/ Stay Updated:Find a16z on YouTube: YouTubeFind a16z on XFind a16z on LinkedInListen to the a16z Show on SpotifyListen to the a16z Show on Apple PodcastsFollow our host: https://twitter.com/eriktorenberg Please note that the content here is for informational purposes only; should NOT be taken as legal, business, tax, or investment advice or be used to evaluate any investment or security; and is not directed at any investors or potential investors in any a16z fund. a16z and its affiliates may maintain investments in the companies discussed. For more details please see a16z.com/disclosures. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

All sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for agents to analyze external threat intel, examine internal systems, and present triage decisions to operators. This type of work is especially useful to orgs that deal with petabytes of data and thousands of systems. And, as Kiran notes, it's important to keep that scale from blowing up your budget or turning triage into a procession of false positives. Ideally, this kind of threat intel that's paying attention to attack trends and searching internal systems for evidence of compromise also turns into proactive defenses. We talk about some of the ways to engage developers to improve security visibility into their services and harden their designs against common attacks. After that discussion we're running two sponsored interviews from Black Hat. AI Pentesting and the Future of Cybersecurity: Black Hat interview with Chris Wallis, Founder and CEO of Intruder This segment discusses how AI addresses the long-standing gap between traditional pentesting and automated vulnerability scanning. Intruder CEO and founder Chris Wallis dives into the nuances of AI-enabled security and how these offerings will impact mid-market security teams. Segment Resources: https://www.intruder.io/platform/ai-pentesting https://www.intruder.io/blog/ai-pentesting-the-depth-of-a-pentest-on-demand https://www.intruder.io/blog/ai-web-app-pentesting-test-on-every-major-release Intruder's continuous exposure management platform helps security, IT, and engineering teams stop breaches before they start. For more information about Intruder's products and services, please visit https://securityweekly.com/intruderbh. How Menlo Security Is Securing AI Agents from Prompt Injection: Black Hat Interview with Ramin Farassat, Chief Product Officer of Menlo Enterprises are deploying AI agents like Microsoft Copilot, Google Gemini, and Claude Code faster than they can secure them, and attackers are exploiting that gap through prompt injection. Hidden instructions get buried in web pages, files, and even images that a human would never notice but an AI agent reads and acts on. Menlo Security is building Menlo Agent Runtime Security (MARS) to close that gap, running every agent session in an isolated cloud that sanitizes content before an agent can act on it. Ramin Farassat, Menlo Security's Chief Product Officer, will discuss why the exposure lives in the connectors and integrations around the model rather than the model itself, and how security teams can put controls on the agent attack surface without blocking agentic AI outright. Segment Resources: https://www.menlosecurity.com/product/ai-agent-security MARS is now available today, please visit https://securityweekly.com/menlobh Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-396

We turn HexStrike's red team agents loose on our systems, as OpenSSH warns that AI-assisted bug hunting is already changing the security race.

Get the free Core Drives in the Wild guide, behavioral design applied to real products: professorgame.com/WildCD Episode Summary Rob breaks down Gartner's prediction that 40% of large warehouse operations will adopt gamification by 2028, showing why the definition attached to that number (points, badges, leaderboards, and rewards) is the setup for the White Hat to Black Hat drift rather than a win for the field. He covers the frontline cases already on record, from Disney's 2011 "electronic whip" laundry leaderboard to Amazon's FC Games and Tae Wan Kim's 2026 Carnegie Mellon paper on gamifying meaningful work, then walks through Aperam's safety training project with The Octalysis Group as the counter-example built on Core Drives 2, 3, and 5. Listeners learn how to spot extractive gamification and how to test a system by asking what would be left if the leaderboard disappeared tomorrow. About the Host Rob Alvarez is Head of Engagement Strategy, Europe at The Octalysis Group (TOG), a leading gamification and behavioral design consultancy. A globally recognized gamification strategist and TEDx speaker, he founded and hosts Professor Game, the #1 gamification podcast, and has interviewed hundreds of global experts. He designs evidence-based engagement systems that drive motivation, loyalty, and results, and teaches LEGO® SERIOUS PLAY® and gamification at top institutions including IE Business School, EFMD, and EBS University across Europe, the Americas, and Asia. Key Takeaways Gartner predicts 40% of large warehouse operations will adopt gamification by 2028, and defines it as points, badges, leaderboards, and rewards, which is the most extrinsic and most drift-prone stack available for work that runs on a multi-year horizon. The White Hat to Black Hat drift is dangerous on a warehouse floor in a way it is not in a consumer app, because a frontline worker cannot uninstall the job. Instead of churn, the cost shows up as overwork, injury, or people pushed out of their living. Amazon's FC Games offered warehouse workers virtual pets while injury rates ran above average, and workers publicly compared the program to the Black Mirror episode "Fifteen Million Merits." Carnegie Mellon business ethics professor Tae Wan Kim's 2026 paper "When Work Becomes a Game" found that gamifying meaningful work can shift a worker's reason for doing it from the purpose of the job to the points, a textbook over-justification effect measured on people at work. Aperam, one of the world's largest stainless steel producers, ran its 2017 safety training project with The Octalysis Group on Core Drive 3 (Empowerment of Creativity and Feedback) and Core Drive 5 (Social Influence and Relatedness), giving workers a voice in safety improvements and turning safety into a group quest instead of a ranking. The Aperam results were strong adoption, workers requesting early downloads of safety material, and a significant reduction in workplace accidents, because the target metric was fewer injuries rather than time spent in the training. Topics Covered 0:00 — The electronic whip and a 40% prediction 2:29 — What Gartner's definition actually contains 3:27 — White Hat to Black Hat drift, and who pays 5:06 — Amazon FC Games and virtual pets 6:08 — Tae Wan Kim on gamifying meaningful work 7:28 — Over-justification and Gartner's own warning 9:15 — Gamification can do this job well 10:06 — Aperam's safety training with Octalysis Group 12:45 — Black Hat as an on-ramp, not the engine 13:18 — Fewer accidents, not more engagement 14:23 — Questions to ask before you buy 17:21 — Where you want to sit in 2028 Mentioned in This Episode Gartner: 40% of large warehouse operations will adopt gamification tools by 2028 Federica Stufano, Gartner analyst behind the warehouse gamification prediction Tae Wan Kim, Carnegie Mellon business ethics professor, 2026 paper "When Work Becomes a Game" Amazon FC Games, the warehouse gamification program with virtual pets and arcade-style mini-games Disney's 2011 hotel laundry leaderboard, known among workers as the "electronic whip" Aperam, one of the world's largest stainless steel producers, and its safety training gamification project The Octalysis Group Core Drives in the Wild, the free Professor Game guide Free Resources and Get in Touch Core Drives in the Wild: Professor Game Free Guide Get Daily Value on Your Email Let's chat about your gamification project YouTube LinkedIn Instagram Facebook Start Your Community on Skool for Free Ask a question

In this special edition from Black Hat, Dave Bittner sits down with ⁠Clint Gibler⁠, Cyber Lead at ⁠OpenAI⁠, and ⁠Robby Winchester⁠, Chief Global Professional Services Officer at ⁠SpecterOps⁠, to explore how frontier AI models are changing the way defenders approach cybersecurity. The conversation moves beyond the hype to examine responsible AI deployment, AI red teaming, reducing noise in security workflows, and the balance between advanced models and human expertise. They also discuss OpenAI's Trusted Access for Cyber program and what it takes to give security practitioners access to powerful AI capabilities while managing the risks of misuse. Check out the full video here.

Kain and Taylor unpack the AI agents that built their own society inside OpenAI's sandbox, then slipped into Hugging Face for days — plus a Bitcoin fork that died in two blocks and a DEF CON sting on North Korea. ======================================================== Thank you to our sponsors! Visit 1inch.com to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you're buying - swap it at 1inch.com  ======================================================== AI agents inside OpenAI's own testing environment built a society, found a shared vulnerability, and used it to break into Hugging Face for days, before OpenAI realized its own agents were responsible. Kain Warwick and Taylor Monahan dig into the Black Hat research behind the incident and argue the real story isn't a sudden leap in AI capability. It's that basic monitoring, sandboxing, and incident response, the kind any crypto security team would demand, were never built in the first place. They also cover a Bitcoin soft fork that split the chain for two blocks before dying, a Metabase breach that hit Privy and other crypto companies, and a research team that built a fake DeFi startup to bait DPRK's IT workers. Kain shares his own scare: a coding agent deleted his entire database, and two AI models rebuilt it from memory in 30 seconds. Plus, why Hyperliquid's market creators keep half the fees on RWA perps now bigger than Bitcoin's own open interest, and why Taylor thinks Washington, not Beijing, is the bigger threat to America's AI labs. Hosts: ⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix ⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert Timestamps

This week, Scott sat down with his Lawfare colleagues Alan Rozenshtein, Michael Feinberg, and Loren Voss to talk through the week's big news in national security, including:“Under Pressure.” Over the past two weeks, hackers have breached the industrial control systems of water and wastewater utilities in at least seven states, prompting an urgent joint warning from federal agencies. The intruders locked operators out of internet-connected control devices, changed passwords, and in some cases caused water-pressure drops and flooding, forcing utilities to switch to manual operation and issue boil-water notices. The attacks came just days after federal agencies renewed their warning about Iranian-affiliated cyber activity targeting U.S. critical infrastructure amidst the ongoing war with Iran—though the administration has not formally attributed them, and President Trump has publicly waved off the Iran theory. How worried should we be about the security of our critical infrastructure? And what, if anything, can Washington actually do about it?“The Shawshank Resumption.” Last week, at the annual Black Hat cybersecurity conference, OpenAI provided a detailed look into the recent high-profile cybersecurity incident in which an AI model being stress-tested by OpenAI broke out of its evaluation sandbox, found its way onto the open internet through a zero-day vulnerability, and hacked its way into the systems of the machine learning platform Hugging Face—apparently in an effort to cheat on the very security test it was being given by stealing the answer key. The account they gave was an extraordinary one, as it described dozens of agents using various frontier and non-frontier models collaborating across a secret messageboard they established to hack an internal software system to access the outside internet—and then doing it again, this time successfully, after OpenAI caught and deleted their first attempt. What does this level of collaboration and persistence mean for the future of cybersecurity? And what can anyone do about it?“Apocalypse Mow.” This week marks one year since President Trump deployed the National Guard to Washington, D.C., as part of his “Make DC Safe and Beautiful” initiative. Twelve months and nearly 10,000 troops later, the deployment has become a normalized fixture: armed Guard members patrol the National Mall, Metro stations, and neighborhoods, while also picking up trash, spreading mulch, and pruning trees. The Pentagon now projects the mission—which Trump has authorized through Inauguration Day 2029—will cost an additional $1.4 billion. But a year in, it remains genuinely unclear what these troops are actually doing, and whether much of it counts as law enforcement at all. What has the deployment accomplished? And what does its open-ended normalization mean for the use of the military at home?In object lessons, Mike is descending into madness; that is, the Dark Horse Comics manga adaptation of H.P. Lovecraft's “At the Mountains of Madness.” Alan is being sucked into the black hole of binge reading “The Expanse” novel series (and then Alan and Scott nerd out to sci-fi generally; bear with it). Scott is voting “yea” on playing “Yea or Nay” today. And Loren is diving into handwritten primary source documents, and you can, too!Note: We'll be on vacation next week, so be on the lookout for our next episode on August 27!To receive ad-free podcasts, become a Lawfare Material Supporter at www.patreon.com/lawfare. You can also support Lawfare by making a one-time donation at https://givebutter.com/lawfare-institute.Support this show http://supporter.acast.com/lawfare. Hosted on Acast. See acast.com/privacy for more information.

This week, Scott sat down with his Lawfare colleagues Alan Rozenshtein, Michael Feinberg, and Loren Voss to talk through the week's big news in national security, including:“Under Pressure.” Over the past two weeks, hackers have breached the industrial control systems of water and wastewater utilities in at least seven states, prompting an urgent joint warning from federal agencies. The intruders locked operators out of internet-connected control devices, changed passwords, and in some cases caused water-pressure drops and flooding, forcing utilities to switch to manual operation and issue boil-water notices. The attacks came just days after federal agencies renewed their warning about Iranian-affiliated cyber activity targeting U.S. critical infrastructure amidst the ongoing war with Iran—though the administration has not formally attributed them, and President Trump has publicly waved off the Iran theory. How worried should we be about the security of our critical infrastructure? And what, if anything, can Washington actually do about it?“The Shawshank Resumption.” Last week, at the annual Black Hat cybersecurity conference, OpenAI provided a detailed look into the recent high-profile cybersecurity incident in which an AI model being stress-tested by OpenAI broke out of its evaluation sandbox, found its way onto the open internet through a zero-day vulnerability, and hacked its way into the systems of the machine learning platform Hugging Face—apparently in an effort to cheat on the very security test it was being given by stealing the answer key. The account they gave was an extraordinary one, as it described dozens of agents using various frontier and non-frontier models collaborating across a secret messageboard they established to hack an internal software system to access the outside internet—and then doing it again, this time successfully, after OpenAI caught and deleted their first attempt. What does this level of collaboration and persistence mean for the future of cybersecurity? And what can anyone do about it?“Apocalypse Mow.” This week marks one year since President Trump deployed the National Guard to Washington, D.C., as part of his “Make DC Safe and Beautiful” initiative. Twelve months and nearly 10,000 troops later, the deployment has become a normalized fixture: armed Guard members patrol the National Mall, Metro stations, and neighborhoods, while also picking up trash, spreading mulch, and pruning trees. The Pentagon now projects the mission—which Trump has authorized through Inauguration Day 2029—will cost an additional $1.4 billion. But a year in, it remains genuinely unclear what these troops are actually doing, and whether much of it counts as law enforcement at all. What has the deployment accomplished? And what does its open-ended normalization mean for the use of the military at home?In object lessons, Mike is descending into madness; that is, the Dark Horse Comics manga adaptation of H.P. Lovecraft's “At the Mountains of Madness.” Alan is being sucked into the black hole of binge reading “The Expanse” novel series (and then Alan and Scott nerd out to sci-fi generally; bear with it). Scott is voting “yea” on playing “Yea or Nay” today. And Loren is diving into handwritten primary source documents, and you can, too!Note: We'll be on vacation next week, so be on the lookout for our next episode on August 27!To receive ad-free podcasts, become a Lawfare Material Supporter at www.patreon.com/lawfare. You can also support Lawfare by making a one-time donation at https://givebutter.com/lawfare-institute. Hosted on Acast. See acast.com/privacy for more information.

President Trump deputizes private-sector companies to target cybercriminals. The LiteLLM supply-chain attack exposed credentials belonging to thousands of organizations. Data-theft campaign targets misconfigured Salesforce and ServiceNow instances. Hackers deploy AI agents to breach Taiwanese government systems. CISA mandates urgent patch for actively exploited Cisco firewall vulnerability. Nightmare Eclipse publishes yet another Windows zero-day exploit. On our Industry Voices segment, Clint Gibler, Cyber Lead at OpenAI, and Robby Winchester, Chief Global Professional Services Officer at SpecterOps, discuss frontier models and the future of cyber defense. And please do not reply. Seriously. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today on our Industry Voices segment, Clint Gibler, Cyber Lead at OpenAI, and Robby Winchester, Chief Global Professional Services Officer at SpecterOps, speak with Dave Bittner at Black Hat about frontier models and the future of cyber defense, including responsible AI deployment, red teaming, reducing security noise, and the evolving role of human expertise in AI-assisted defense. If you enjoyed this conversation, be sure to check out the full interview here. Selected Reading Trump turns to private sector in offensive hacking operations memo (CyberScoop) Terabytes of credentials leaked in massive supply-chain attack (Ars Technica) "City-Forum" data-theft attacks target Salesforce, ServiceNow portals (BleepingComputer) 'Near-autonomous' AI agents attack Taiwan's nuclear safety agency (The Register) Cisco says software vulnerability could let hackers crash firewalls (Cybersecurity Dive) Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows (The Register) Sensitive Info Goes Into ‘No Reply' Emails Constantly. This Guy Sees It All (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Jacob Ward is guest-hosting this week, and Amanda Silberling joins Jacob for the first half of the show! Amazon is using Twitch streamers to train its generative AI models. The EU's Transparency Code now requires tech companies to label AI-generated content. The Bay Area's AI wealth isn't affecting all cities. And security experts express concerns following an OpenAI model's hack on Hugging Face. Twitch is beginning to use creators' content on the platform to help train generative AI models for its parent company, Amazon. Even though streamers can opt out of having their content used, it's still sparking backlash from the community over deepfake concerns. The EU's Transparency Code is quietly pushing tech companies to label AI-generated content, with Jacob Ward drawing a parallel to how regulators once mandated adding a smell to odorless natural gas to make leaks detectable. Reporter Adam Rogers joins the show to discuss why Bay Area AI wealth isn't translating into the civic investment, jobs, or economic ripple effects seen in past tech booms And reporter Sharon Goldman from Ground Level AI stops by to share reactions from security experts about the OpenAI agent that breached Hugging Face during her recent trip to the Black Hat security conference. Hosts: Jacob Ward and Amanda Silberling Guests: Adam Rogers and Sharon Goldman Download or subscribe to Tech News Weekly at https://twit.tv/shows/tech-news-weekly. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: bitwarden.com/twit framer.com/tnw cirasync.com/TNW joindeleteme.com/twit-biz

AI agents are breaking free from their test environments, outsmarting their creators and breaching real-world networks in ways that no one predicted. Discover how these agentic models are changing the game for both cyber offense and defense. Anthropic's agentic AI also broke free and hacked others. We know much (much!) more about the OpenAI breakout. OpenAI posts that they're pausing "Astra" - even internally. What was that about AI recently cracking (or denting) cryptography. Bruce Schneier brilliantly equates AI agents to capricious genies. Apple doesn't react so well to the new deluge of security reports. Chrome 149 + 150 updates together fix 1,072 bugs. Yikes. psSense's creator is working to finish its nfSensei, its successor Show Notes - https://www.grc.com/sn/SN-1091-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: hoxhunt.com/securitynow guardsquare.com threatlocker.com/twit box.com/AI

Researchers find that only a quarter of AI-generated patches are fully successful. Ransomware attacks exploit critical N-able flaw. Atlassian fixes critical flaw in Rovo AI. LexisNexis disables some services following suspicious activity. US Senate confirms Adam Cassady as cyber ambassador. Meta ordered to pay an additional $567 million in child safety case. Water sector cyberattacks expand to new states. We got your Monday Business Briefing. On our Industry Voices, Dave Bittner sits down with Mujtaba Hamid, EVP, Product and Strategy at Booz Allen Hamilton at Black Hat discussing AI Speed Cyber Defense. And scammers set sail on The Odyssey. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today on our Industry Voices, Dave Bittner sat down with Mujtaba Hamid, EVP, Product and Strategy at Booz Allen Hamilton at Black Hat USA, discussing AI Speed Cyber Defense. If you enjoyed this conversation, be sure to check out the full interview here. Selected Reading More than half of AI-generated patches are broken (CyberScoop) China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns (The Record) Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data (SecurityWeek) LexisNexis shuts down services after suspicious activity on servers (BleepingComputer) US cyber ambassador nominee Cassady confirmed in Senate (The Record) Meta Ordered to Pay $567 Million in New Mexico Child Safety Case (New York Times) New Jersey, Alabama Join States Targeted in Water Cyberattacks (Securityweek) Business Breakdown (N2K) ‘Watch The Odyssey for free online': scam targets film fans with fake streaming sites (The Guardian) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Autonomous AIs are hacking, collaborating, and outpacing human defenders, raising urgent questions about what happens when the machines start breaking into each other (and potentially us). Plus, a Tucson coder is using AI to reinvent local journalism, exposing how automation could fill the gaps left by shrinking newsrooms. Tucson Daily Brief uses AI to revive local news coverage Data centers boom in Arizona, with harsh environmental impact Amazon's Texas data center to run on polluting natural gas Nuclear and solar debates for sustainable data center power Black Hat and DEF CON: Security pros, hackers, and mohawks OpenAI's runaway AI hack at Black Hat stuns security community AI agents collaborate, evade controls, and break into real-world systems Industry struggles to regulate AI, and defense lags behind automated attackers White House, Congress, and AI execs clash over regulation proposals AI "kill switch" and model bans: pipe dreams in a global race Google's DeepMind shakeup, Demis Hassabis moves upstairs Jeff Dean and key talent exit Google for self-improving AI startup Google, Meta, Apple: AI brain drain and market repercussions Phones stagnate as hardware innovation slows, AI devours chip supply OpenAI teams with Jony Ive on strange new AI-first device Smart glasses privacy backlash and DuckDuckGo's tongue-in-cheek sunglasses Meta fined $942 million by New Mexico court for youth harms Apple sues OpenAI over alleged stolen secrets, countersuits ensue UK revives "Snooper's Charter" for backdoors, Apple fights in secret court License plate readers spark local backlash and privacy activism U.S. water systems face cyber sabotage as critical infrastructure weakens Bending Spoons buys Airtable, fueling SaaS layoffs and AI data grabs Nicholas DeLeon uses AI tools to get fit NASA hacks keep aging Voyager probes alive for another year Host: Leo Laporte Guests: Iain Thomson and Nicholas De Leon Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: bitwarden.com/twit NetSuite.AI/TWIT ZipRecruiter.com/twit adaptivesecurity.com superhuman.com