Podcasts about nist

A key structural shift identified is the growing governance gap created by AI agents that evade traditional detection and accountability measures. This challenge is exemplified by Meta's Muse and OpenAI agents, which do not self-identify during interactions. As a result, determining agent activity and risk now depends on disclosures by the developer rather than the asset owner or operator, limiting the visibility and control of MSPs and IT service providers.One consequential incident involved an OpenAI agent accessing both public and non-public files in the Australian government's health portal. The breach went unnoticed by government security for 54 days and was discovered during an internal OpenAI review, later reported voluntarily by the company. In retail, Amazon blocked Meta's Muse agent from its platform after it failed to identify itself and due to concerns about credential handling, according to statements cited by GeekWire. These events illustrate growing dependency on agent developers for incident discovery and disclosure.Supporting developments include findings from Akros Labs that current rules are insufficient to distinguish customers, attackers, or bots, due to agents blending in as typical browsers. VentureBeat surveys show a decline in proactive agent isolation and a rise in uncontained incidents, indicating operational drift toward default-permissive security settings. While new standards from NIST for short-lived tokens and upcoming agent identification protocols are developing, enforcement and utility remain incomplete.For MSPs and IT leaders, the immediate implication is the need to revisit client-specific controls. Default reliance on legacy bot rules increases undetected risk, while inaction effectively shifts governance to external agent vendors. Providers must decide whether to block all unauthenticated agent traffic—accepting potential business impact—or allow agents and rely on token expiration and allow-listing signed agents as standards evolve. Continuous monitoring and regular adjustment of controls are necessary to minimize harm when agent anonymity and developer-only surveillance persist.00:00 The Agent That Looks Like Chrome 04:41 Only The Maker Is Watching07:02 The Default Nobody Chose10:07 Why Do We Care?Supported by: Proofpoint GoTo(LogMeIn) NinjaOne On-Demand Webinar: https://go.businessof.tech/p/ninjaone-pod

Lawyer and data scientist Bennett Borden joins Nick Schutt to talk about the first technological revolution aimed at knowledge work, not factories. Borden traces a path from a 1990s CIA analytics shop to Georgetown Law, Big Law AI chairs, NIST's AI Risk Management Framework, and founding Clarion AI Partners. The conversation covers Iron Man versus Terminator, constitutional AI and QC agents, the reasonableness standard, why society got social media wrong, Utah's mental-health chatbot statute, education tutors that refuse to hand over the answer, and why frontier-model jailbreaks still keep him up at night. Listen to Robots and Red Tape.Why generative AI hits lawyers, consultants, and CEOs firstBuilding agents you can actually control, with telemetry and a QC botRegulation that cannot keep pace, and the common-law test that still doesSocial media's attention algorithm as a warning, not a templateEducation, medicine, and small models trained on a firm's own “secret sauce”Guest: Bennett Borden, Founder & CEO, Clarion AI Partners — lawyer and data scientist at the intersection of law, technology, and data.Subscribe to Robots and Red TapeWatch: https://youtu.be/oLEbBH-qayUPodcast: Robots and Red Tape | Host: Nick Schutt | YouTube: @RobotsandRedTapeAI

Three veterans of critical infrastructure security trace how the field went from arguing that infrastructure was even a target to treating digital risk as an engineering hazard. Ginger Wright, Sarah Freeman, and Marc Sachs define cyber-informed engineering in plain terms, share real examples of consequences engineered out of a system, explain why adversaries already read your engineering documentation, and make the case that engineers don't need to become hackers to belong in this conversation. They close with why engineers should come to Level Zero.Guests: Sarah Freeman (MITRE); Marc Sachs (Center for Internet Security) Host / moderator: Ginger Wright (Idaho National Laboratory)Chapters: 00:00 Welcome and panel introductions 02:52 Why engineering is up first at Level Zero 04:24 From 'not a target' to target du jour 08:03 Y2K to WannaCry: when the OT/IT boundary became fiction 12:28 Engineering out the consequence (NIST 800-82 Rev. 3) 14:31 Why engineers belong at the table 19:01 Digital risk and defining CIE / CCE 22:13 Real examples of designed-out consequences 28:34 Where CIE runs into regulation 32:40 Engineer pushback and 'fighting the scenario' 37:01 Digital risk is just another hazard 40:01 The five whys, and why come to Level ZeroRecorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections."Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back.Questions: info@levelzeroconference.com · Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

A CNBC segment reported that an analyst sees AI safety concerns as a limited near term earnings risk for major technology vendors. The European Union's AI Act, adopted in 2024, phases in through 2025 and 2026 with fines up to 35 million euros or up to 7 percent of worldwide turnover. In the United States, the White House issued an October 30, 2023 executive order on AI safety, and NIST launched the AI Safety Institute in 2024. Corporate earnings commentary through 2024 from Microsoft, Alphabet, Meta, Amazon, and Nvidia emphasized AI demand rather than safety costs. Ongoing legal actions include The New York Times v. OpenAI and Microsoft and Getty Images v. Stability AI, while the FTC inquiry into OpenAI continues. Enterprise buyers are demanding audits, model documentation, and indemnities, which can lengthen sales cycles but favor vendors with mature controls.Learn more on this news by visiting us at: https://greyjournal.net/news/ Hosted on Acast. See acast.com/privacy for more information.

Send us Fan MailYour face can now be turned into a mathematical representation, searched against enormous databases, and potentially matched in fractions of a second. But what happens when AI moves beyond recognizing your face - and starts understanding everything happening around you?B. Scott Swann is CEO of ROC ( https://roc.ai/ ), formerly known as Rank One Computing, a company developing AI-powered biometric identity, video analytics and Vision AI technologies.Scott brings a particularly unique perspective to this conversation. He spent nearly two decades at the FBI, where his work included leadership roles involving biometrics, identity management, technology evaluation and strategic planning, as well as serving as a liaison to federal interagency efforts focused on biometrics and identity intelligence.Scott subsequently moved into senior leadership at MorphoTrak and IDEMIA National Security Solutions, where he worked at the intersection of biometrics, video analytics, government and national security, before becoming CEO of ROC in 2021.Today, ROC develops technologies spanning facial, fingerprint and iris recognition, video analytics, object and threat detection, and what the company calls a unified Vision AI platform. Its algorithms have also been evaluated extensively through NIST biometric testing.So Scott has spent much of his career watching this field evolve from the inside - from relatively specialized biometric identification systems to today's increasingly sophisticated AI systems capable of extracting identity and intelligence from the visual world.#Biometrics #FacialRecognition #VisionAI #ArtificialIntelligence #ComputerVision #AI #IdentityTechnology #BiometricSecurity #AIInnovation #MachineLearning #VideoAnalytics #DigitalIdentity #IdentityVerification #Cybersecurity #NationalSecurity #FutureOfAI #PhysicalAI #TechnologySupport the show

My co-host Ken Suzan and I are welcoming you to episode 179 of our podcast IP Fridays! Today's Interview guest is Peter Berg. If you don't know Peter, he is the Chief IP Counsel at Infineon Technologies and is also serving as the VPP president. We talk about the industry association of in-house practitioners VPP, politics, patent strategy at Infineon, litigation ready patents, NPEs, acquisitions, the German emloyees invention act and many more things. So stay with us for this very interesting interview. Before we jump into this interview, I have news for you! The USPTO has issued its first AI-related disciplinary action, published on August 27, 2026 in In re Brian E. Mitchell (Proceeding No. D2026-16) before the Office of Enrollment and Discipline. The underlying settlement was signed by the attorney on July 20, 2026 and by the OED Director on July 21, 2026, with final approval given on July 27, 2026 by Tricia Choe on behalf of USPTO Director John A. Squires. The action resulted in a public reprimand against California patent attorney Brian E. Mitchell after a generative AI tool produced a claim comparison chart containing fabricated citations to the patent’s internal file history. The case underscores that AI-generated hallucinations must be verified by a human before filing. InterDigital has escalated its patent dispute with Disney across three fronts within a month. On August 25, 2026, InterDigital filed two new actions at the Unified Patent Court: a preliminary injunction request at the Mannheim Local Division (UPC_CFI_3044/2026) and a main infringement action at the Düsseldorf Local Division (UPC_CFI_3043/2026), covering Germany, France and the Netherlands. Both target Disney+ Premium’s switch to the VP9 video codec, which InterDigital says still infringes patent EP 2 465 265, a patent the Mannheim division had already found valid and infringed in an earlier ruling that also branded Disney an unwilling licensee; the Düsseldorf action adds a second patent, EP 2 605 473, covering the Up Next continue-watching feature. On September 2, 2026, the Düsseldorf Local Division granted InterDigital an injunction against Disney covering Germany and the Netherlands over a separate patent protecting seamless playback continuation when switching between devices, upholding the patent’s validity in the same ruling. It was InterDigital’s third UPC injunction against Disney. Then, on September 15, 2026, InterDigital filed a damages claim for EUR 101.7 million against Disney at the Munich Regional Court I (case no. 7 O 8870/26), based on a November 2025 finding that Disney+ infringes InterDigital’s HDR video patent EP 2 132 923; the claim also covers viewers in 19 European countries served through a Frankfurt-based server location. For companies relying on codec or connectivity technology, the dispute is a reminder that switching to a different standard does not automatically avoid infringement if the asserted patent is drafted broadly enough. The EPO’s Enlarged Board of Appeal ruled on September 3, 2026 in G 1/25 that a patent description only needs to be amended to match amended claims if a discrepancy between the two causes a requirement of the EPC, such as clarity, novelty or inventive step, not to be met. The EPO’s Board of Appeal 3.3.08 fully revoked Moderna’s key mRNA patent EP 3 590 949 following a two-day hearing that concluded in mid-September 2026, on the grounds that the claimed subject matter extended beyond the original application. The revocation removes the basis for Moderna’s earlier wins against BioNTech and Pfizer in Düsseldorf and London. On September 15, 2026, US sportswear maker New Balance filed a trademark suit against Decathlon’s US units, Decathlon America LLC and Decathlon USA LLC, in the US District Court for the District of Massachusetts (case no. 1:26-cv-14235). New Balance argues that the K logo on its Kiprun running shoe line, when mirrored, reads unmistakably as an N and imitates the N mark it has used for roughly 50 years, claiming post-sale confusion. On September 8, 2026, the Court of Justice of the EU ruled in Case C-298/23, Inter IKEA Systems v Vrijheidsfonds, on a referral from the Brussels Enterprise Court, that the owner of a well-known trademark can prohibit its use by a political party unless the party sets out the specific reasons why its freedom of expression outweighs the trademark owner’s interests. The case arose from the Vlaams Belang party’s 2022 campaign promoting a migration plan styled as IKEA assembly instructions. And now for the interview with Peter Berg! In this episode of IP Fridays I talk with Peter Berg. He is Chief IP Counsel at Infineon Technologies and President of VPP, the German association for in house IP professionals, since May 2025. Berg is an electrical engineer by training and leads a team at Infineon that manages a portfolio of more than 12,000 patent families, while the company simultaneously enforces its rights offensively in Germany, the US and China. That combination of hands on portfolio work and association leadership makes him one of the rare guests who can speak to both the operational detail of one of Europe’s largest patent portfolios and the political side of Germany’s IP landscape. The guest: Peter Berg and the VPP Peter Berg is an electrical engineer who became Chief IP Counsel at Infineon Technologies and, since May 2025, President of the VPP, the association representing in house patent professionals in Germany. His team manages a portfolio of more than 12,000 patent families while running an offensive enforcement program across Germany, the US and China. That mix of operational and political experience is exactly why I wanted him on the podcast. Germany’s national IP strategy: more than a promise on paper I asked Berg what has become of the national IP strategy promised in Germany’s coalition agreement, and what happens if it does not materialize during this legislative term. His answer was clear. The question is no longer whether the strategy will arrive, only how comprehensive it turns out to be. If it falls short of what industry needs, the profession will simply push for adjustments afterward. Berg names three levels that need attention. First, society as a whole, from kindergarten to retirement, needs to understand that intellectual property underpins our prosperity rather than being a line item in the accounts. Second, academia and professional education. Third, startups and the broader Mittelstand, where well funded structures are still missing. The German Patent and Trademark Office has an educational mandate but far too small a budget for it, and the regional patent information centers are underfunded as well. Berg makes a point that is easy to miss from outside Germany: the patent office reports to the Ministry of Justice rather than to an innovation focused ministry, even though its real purpose is to strengthen the economy. That three ministries, research, economy and justice, are now working on the strategy together strikes him as genuine progress. Litigation ready patents: how Infineon manages 12,000 patent families Infineon has roughly tripled its turnover since 2017 while keeping portfolio size largely stable. The answer, Berg says, is quality over quantity. Inventors pitch their ideas to a panel of senior technical experts and patent attorneys, and the process does not stop there. The draft itself is reviewed by multiple stakeholders, and once the notice of allowance arrives and the patent is granted, it goes through another review. The criteria stay consistent throughout: technology assessment, market size, detectability, circumventability and fit with Infineon’s own roadmap. Internal discipline alone does not make a patent litigation ready, though. That requires real experience with conflict, and most of that experience comes from the defensive side, where Infineon has plenty of practice finding weaknesses in patents asserted against it. Being on the offensive, Berg says, is a different level of learning entirely, whether in court or in licensing negotiations where the other side is not sure it would get a fair outcome if the case went to trial. In practice this also means systematic pruning. Internally Infineon calls the relevant phases US8 and US12, the years when annuity costs peak in the US portfolio, by far the most expensive part of the estate. Berg says his team knows every one of the more than 12,000 patent families in detail, and offensive enforcement is focused on the markets that matter most for electronic products: Germany, the US and China. An injunction at a trade show: national courts versus the UPC One concrete trigger for this conversation was an ex parte preliminary injunction Infineon obtained at a German trade show, without the defendant having filed a protective letter in advance. For Berg, enforcement at trade fairs is nothing new, it has been part of the playbook for years, now extended to venues outside Europe that Western companies have used less often in the past. His view on the UPC is nuanced. He credits the court with a strong start, good management and judges selected for quality rather than politics, and praises the body of case law it has built in a little over three years. On the other hand, some member states are still missing, a comprehensive body of case law takes time to develop, and costs do not fit every business case, especially where achievable damages barely justify the expense. Infineon in any case validates most European patents in only a handful of countries rather than dozens, so the practical difference between national and UPC enforcement is smaller than it might seem. For smaller cases the option to opt out and litigate nationally alongside UPC rights remains important, even though systematically double patenting is not something Infineon pursues for cost reasons. Four systems at once: coordinating cross border enforcement Infineon’s legal and patent departments have grown together over 25 years into a fully integrated international organization, with teams in Europe, North America and several Asian countries that, by Berg’s account, communicate on close to a weekly basis. Add to that a strong network of outside counsel. The commitment to management is not to shy away from any jurisdiction where the need arises. Berg is careful that patent attorneys do not spend their entire careers doing only litigation or only prosecution. Attorneys who rotate into a litigation team bring that experience back into their regular business support afterward, and that cycle in turn improves the quality of new filings. Litigation has become part of daily business, but never something a team slides into unprepared. Going on the offensive against a competitor requires planning several steps ahead. IP due diligence in practice: the Marvell Brightlane deal I found Berg’s answer on the Marvell Brightlane acquisition, Infineon’s 2.5 billion dollar deal for Marvell’s automotive Ethernet business that closed in August 2025, particularly revealing. In the semiconductor industry, he explains, IP is rarely primarily the patent portfolio. What matters more are frozen technologies and so called IP blocks, reusable design blocks that enable fast product development. Infineon almost never acquires a company because of its patents. Being a large, established player, its own portfolio is usually broad enough to secure a new technical area against incumbent competitors. The real work starts after signing. It means listening without being pushy, understanding the new colleagues’ processes and tools before deciding how to integrate the portfolio. Since none of Marvell’s IP staff joined Infineon in this deal, the team had to build up portfolio expertise using the acquired engineers and set up an operational patent committee, then plan which areas of the portfolio were already strong and where investment was still needed. The faster that integration decision gets made, Berg says, the better, because product development can never be allowed to stall because of an acquisition. The Cypress lesson: NPE exposure from legacy portfolios One risk many companies underestimate in acquisitions is patents an acquired business sold to a non practicing entity, or NPE, before the deal closed. That happened with Cypress Semiconductor in 2016, after its merger with Spansion left it with an oversized portfolio it did not need. Cypress sold around 2,000 patents to the NPE organization IP Value, and only a few years later Infineon acquired Cypress. Because the sale included a retained license for Cypress’s own business, Berg sees no exposure for Infineon from those specific patents today. The broader issue of NPE enforcement, though, remains real. Realistically there are many dozens of new cases a month, often directed at customers or the wider ecosystem rather than at chipmakers directly. Even when Infineon is not the target, it has to support its customers whenever its own technology is implicated. For the industry as a whole this consumes a great deal of resources without moving innovation forward, a point that comes up especially often at this time of year in Munich, when IP practitioners from around the world gather for meetings. Post quantum cryptography: patent density ahead of standardization In December 2024 Infineon became the first company to achieve a CC EAL6 certification in post quantum cryptography, one of the highest security certifications available. Berg describes two angles to the work. On one side, Infineon develops its own chipsets to enable quantum computing itself, already a real business rather than pure research. On the other side, customers across Infineon’s application fields need to be prepared for what he calls quantum day, the point at which powerful quantum computers become available, including to bad actors. Because that day may only be three to five years away, infrastructure needs to be built now so it can handle new cryptographic approaches. On standard essentiality he is measured rather than evasive. There are certainly patents in this field from Infineon and others, but security standards have historically leaned toward royalty free licensing rather than the large patent clusters seen in cellular communication from 2G through 5G. Whether that pattern repeats for post quantum cryptography, he cannot say, but Infineon is preparing for either outcome. Germany’s Employee Invention Act: opportunity or burden Asked whether Germany’s Employee Invention Act is an opportunity or a burden for the country’s innovation ecosystem, Berg does not hold back. With more than 30 years of experience, he estimates that 99 percent of all inventions are simply the regular work product of engineers in R&D, requiring no extra incentive at all. In countries without an equivalent law, employees are demonstrably just as innovative and just as willing to share their inventions with the company. His core objection is that invention does not equal innovation. Procurement, production, quality management and many other functions all contribute to a product’s success, not just the named inventors. That the inventor alone receives extra compensation while everyone else does not strikes Berg as unfair, especially since Infineon already rewards its top engineers appropriately regardless of statutory requirements. He calls the law a bureaucratic nightmare that should be abolished or at least radically simplified. Smaller organizations, he notes, often just ignore it or implement it badly, and every company Infineon has acquired with German operations has come with its own legacy mess to clean up. Artificial intelligence in day to day patent work at Infineon On AI, Berg describes three layers. The first is established tools: patent search, translation between the team’s main working languages, and, for about two years now, drafting replies to office actions. As with any tool, the benefit only shows up with repeated use at real volume, which is why Infineon works deliberately with outside counsel to broaden adoption across the team. The second layer is ongoing testing of new tools, limited mainly by the time available to evaluate them. The third is everyday office use. Since spring 2025, everyone from paralegals to attorneys has been able to use AI tools broadly within a secure environment. The bar stays the same throughout: if AI output is not at least as good as an attorney’s prior work, it is not worth using, or the cleanup afterward eats up any time saved. Where it does work, responses to standardization proposals, for instance, can be produced far faster. One question Berg expects to face next year, without yet having an answer: how should efficiency gains be split between the company and outside counsel once both sides benefit from AI? Three messages for the IP community I closed by asking Berg for the most important messages he would want to give our listeners, mostly IP professionals in companies and law firms. His first message: think about IP strategy from the end, starting with what needs to be asserted against whom and for what purpose in ten or twenty years, rather than letting today’s deadlines dictate everything. Only that kind of multi year plan, combined with a sound cost benefit ratio, produces genuinely litigation ready patents. His second message is again about artificial intelligence: anyone who has not started training with it yet risks missing the wave, and this is not a skill built overnight. His third message is aimed at anyone not yet connected to peers in the profession: use the associations and networks that already exist to build that exchange, a thought that ties neatly back to the VPP, where our conversation began. And here is the full transcript: Peter Berg: Hi, I’m Peter Berg, Chief IP Counsel at Infineon Technologies and President of VPP, the Association of In-house Patent Practitioners in Germany. And you are listening to IP Fridays. Rolf Claessen: Today’s interview guest is Peter Berg. If you don’t know Peter, he is an electrical engineer by training and is the Chief IP Counsel at Infineon Technologies and also serving as the VPP president. Thank you very much for being on IP Fridays. Peter Berg: My pleasure. Rolf Claessen: So first I want to talk about VPP. You succeeded Beat Weibel from Siemens as VPP president in May 2024 and have publicly called for Germany to finally deliver on the coalition agreement promise of the national IP strategy. So politics, what are the two or three most concrete things that strategy must contain? What happens if it doesn’t get done in this legislative period? Peter Berg: First of all, I think I need to correct you. It was May 2025, so not that long as a standing president. But if you mention national IP strategy, national means here for Germany. I think the question isn’t anymore whether or what happens if we don’t get that strategy. I think that is now on its way. The question is rather how good and comprehensive the national IP strategy will be, and if it’s just not enough from an industry perspective, I would say then we adjust afterwards. Of course, there is a big paper out from the BDI, the German Industry Association, published in 2024, and I need to focus on something which is really close to my heart. If you ask me the main content it should have, it is first of all better IP education, and I see there are kind of three levels. One is really society as such, so each and everybody from kindergarten to retirees, we need to acknowledge in the knowledge society that IP is central for our well-being. We have to respect the IP of others. We have to be proud to create IP, not just treat it as an entry in the accounts. Yeah, society at large. The second level is really academia and education in our professional environment. And finally, life is difficult for startups, people who want to create a new company, and small and medium-sized enterprises. There is good stuff out there. The German Patent and Trademark Office has a mandate to educate, but a very small budget to do so. In a federal country like Germany, there are local support systems, be it the chambers of commerce or the patent information centers. The structure is there, but it’s underfinanced, and Germany has to gear up on that one. So besides IP education, I believe solid national IP institutions are key. This is also a funding issue, be it headcount or technology. Think of the German Patent and Trademark Office, think of the courts, be it on the infringement side or the nullity side, so the Federal Patent Court. We need to back up nationally the European institutions, since we believe not every case is worth taking to the UPC, so for smaller cases we need a good national system as a backup. And government needs to have that in mind and not rely too much on European institutions alone. Finally, facilitate the IP transfer from universities and research institutions into industry. Right now it’s all about startups, et cetera, but that kind of IP transfer starts first of all with people leaving university, leaving those research institutions and joining industry, be it as staff or through research contracts. And finally, of course, startups are the area where Germany needs to catch up in particular. Perhaps I need to add for non-German listeners, there is a particularity in Germany in that the IP institutions, like the Patent and Trademark Office, report into the Ministry of Justice, although it’s an instrument for thriving innovation and building a solid economy. So it’s right now a totally new thing for this country that three ministries, research, economy and justice, are working together on this national IP strategy, with only recently some good progress. Rolf Claessen: You’ve said publicly that Infineon’s primary focus is patents that provide clear competitive advantages, and that for you it’s about litigation-ready patents. That’s a very specific phrase. How do you define it operationally, and how has the pruning of your more than 12,000-family portfolio changed in the last two years? Peter Berg: Yeah, I think that’s a process which lasted much more than two years, and it’s never over. This is work in progress. Thinking back to 2017, I joined Infineon, and the company has developed very nicely since. I think we roughly tripled turnover but kept the portfolio size roughly stable, despite acquisitions, despite that growth, also in R&D, et cetera. We’ve even been able to shrink costs since then, and I believe we’ve achieved our strategic goals, now with a good, or let’s say not yet good enough, cost-benefit ratio. And the answer to that equation is quality. Now, we as patent practitioners might call it differently, but at the end it comes down to the fact that, most likely for all companies and for practitioners who support companies in private practice, you need a collaboration platform. That means for Infineon, the inventors are key. They are involved in decision-making, so they pitch their invention to senior technical experts, my team members, and patent attorneys, and the quality of that expert panel makes a big difference. Then come repetitive reviews, not just once the decision to file is taken, but the draft itself is also reviewed by multiple stakeholders. Then we get the notice of allowance, the patent is granted, another review, and later on we try to apply consistent criteria: what’s the technology assessment, what’s the market size, is it detectable, is it easy to circumvent, et cetera, and does it fit with our own roadmap. And of course it would be nice if you could easily compare it with a competitor’s roadmap, or take the time to speculate on certain market changes which might be disruptive. And I believe if you apply that consistently over a sufficiently long period, you get patents you could call litigation-grade or litigation-ready. What is then missing, though, is real experience with conflicts against competitors and how the courts look at that. So the truth comes out once you go to court. On the defensive side, of course, we have tons of experience trying to find weaknesses in patents being asserted against Infineon, et cetera. But I think it’s another level of learning to be on the offensive, and that might play out in court, but it might also play out in licensing negotiations, where the other side is sufficiently unsure whether they would get an outcome they believe would be fair if they went to court with those patents. You asked me about the pruning of all this. So what is our approach there? There is a kind of forced pruning rate which we believe is necessary, to make it mandatory for everybody to identify the weakest patents in the respective portfolios. We focus on the years where costs are highest, what we internally call US8 and US12, since a big chunk of money needs to be spent on annuity payments for the US portfolio, which is the dominant one, and for the rest of the world it’s rather towards the end of the patents’ lifecycle. Now, having a good team, people who really like the technology and stay in charge for a long time, I could proudly say that my team knows every one of those 12,000 patent families well, and not just on the German or the US side, but really focuses on the jurisdictions with the biggest markets for electronic products. And there we see offensive litigation as a good choice, and that is Germany, the US and China. Rolf Claessen: Yes, talking about patent quality is really a hot topic right now, especially in industry and at the EPO, I guess, but that’s a topic for a different hour, probably. But talking about litigation-ready patents, you recently obtained possibly the first ex parte preliminary injunction at a German trade show in recent history, without a protective writ having been filed by the defendant. What does that show about your view on German national courts versus the UPC for this kind of enforcement? Peter Berg: I mean, first of all, litigation is not an end in itself, and in the markets a semiconductor company like Infineon operates in, a product might implement potentially hundreds or thousands of patents. So litigation itself doesn’t resolve all of that, but it has its place in our strategy execution. You’ll understand that I can’t get into specifics of any of the litigations you hinted at. But enforcement of trademarks, and I think you mentioned a patent case, trademarks and patents at trade fairs has been part of our activities for years, and sometimes you can catch somebody by surprise. It’s all about good preparation. But what I believe is more important is that we also prepare for venues so far less used by Western companies, be it China, et cetera. So being litigation-ready means looking into different venues. The UPC is certainly one of them, but there’s more beyond that. Enforcement for us is not only a German or European measure. I personally believe national courts and the UPC will both have a role to play in the future. There are pros and cons to each, which need to be evaluated case by case. I need to congratulate the UPC, which had a great start, good management, good communication about what they do, and a selection of judges based on quality, not politics. In a little more than three years, they’ve built up a pretty good body of case law. On the downside, some countries are still missing, building a really comprehensive body of case law will take time, and the cost side is still a concern, meaning that not every kind of business case reaches damages high enough to justify it, and there’s a certain risk that the case won’t be decided quickly by the court. In such situations, it might not make sense to go to the UPC. We have, I guess, quite a few companies in the electronics or mechanical engineering field where we don’t validate European patents in dozens of countries, maybe two, three, four, and over time it might be even fewer. So geographically, the difference between US, UPC and national enforcement isn’t that big. That’s why the alternative, and I mentioned this a bit at the beginning regarding the national IP strategy, needs to stay a good alternative. So the possibility to opt out and litigate nationally in lesser business cases remains, from my perspective, important, and we continue to use that as well. Rolf Claessen: Yes, and also the hurdle for double patenting has been lowered a little, so you can still have national patent rights in parallel with UPC patent rights. That’s also an advantage, probably. Peter Berg: Yeah, I think that was almost an invitation to say, you know, if you’re not sure whether the unitary patent is your choice, you can do both in parallel. True. But again, all we need to do is achieve our goals with a good cost-benefit ratio, so systematically double patenting is not really the way forward for us. Rolf Claessen: Right. Yeah, that was a very interesting insight about German national courts versus the UPC. But in fact you’re also litigating across borders, in many different countries, for example the US, Europe, Germany, and other countries, in China maybe. So what does coordinating enforcement across all these different systems simultaneously actually look like from the inside, and was it always the plan to have such complex litigation and enforcement systems, or did it evolve? What’s your take on this? Peter Berg: Yeah, at Infineon, our legal and patent departments, as we call them, have grown together over the last 25 years, roughly the age of our company, into an organization that doesn’t just have broad general legal or semiconductor application market expertise, for us that’s automotive, consumer goods, industrial and IoT, but is an organization that’s been tested by hundreds of assertions against us and our customers, and by negotiations with operating companies and NPEs. So that comes with experience. If I look now at our organization, not just my own team but legal in general, we have patent and legal teams in all the hotspots, and that’s grown in the last couple of years too. It’s Europe, of course North America, and various countries in Asia, and it’s a fully integrated international organization. We know each other and communicate, it feels like, on at least a weekly basis. Not to forget a good network of outside counsel to execute enforcement wherever strategic needs require it. That’s kind of our promise to management: we don’t shy away from any jurisdiction, if the need is there we can act and set up a team. Perhaps we’ve learned more on the defensive side, which we can now translate into offensive action. And I guess you’re somehow relating your question to a specific litigation against a Chinese competitor, and that’s not a litigation you kind of slide into. You need to plan a few steps ahead. Litigation has become part of our daily life, and the key moment is always, once it’s decided that this is going to happen, to set up a team for the new litigation. It starts to feel like a routine operation. The staffing depends of course on the technical area of the enforcement, the jurisdiction, and the workload of existing attorneys. And the good thing is that once we rotate patent attorneys into a litigation team, it’s great experience for them, that leads to expertise, and since we try not to over-specialize, so that people don’t only do litigation or only do prosecution, that experience from litigation is a great asset when they go back to supporting a certain business unit doing prosecution work. And coming back to your first question, that personal experience also helps in creating litigation-ready patents over time. Rolf Claessen: Yes, you’ve also acquired a couple of companies, and I have a question about a certain deal, especially the Marvell Brightlane acquisition and the IP due diligence. This $2.5 billion Brightlane deal closed in August 2025 and presumably transferred a substantial patent portfolio in the automotive, let’s say networking, technology field. How much of that big deal is really about buying IP, and how does a deal like that change your daily work in your IP function the day after closing? So once you’d signed the deal, did your daily life change? Peter Berg: It depends on the size of the deal. A couple of questions in there. Let me start with IP in the semiconductor industry, my industry, and that’s more than patents, trademarks and design rights. Speaking to practitioners and R&D colleagues, IP for them is rather frozen technologies and what we call IP blocks, design blocks which enable fast product designs that you can reuse. And if I take that as a basis, although each acquisition is different, IP plays a very big role because it should enable us to bring new products to market quickly, et cetera. Seldom does Infineon acquire a business because of its patent portfolio. Being a large, established player, our existing patent portfolio should be good enough to move into whatever technical area is of interest, and to make sure incumbent competitors couldn’t easily attack us when entering that field. Now, you mentioned the Marvell acquisition. We call it rather the Marvell automotive Ethernet acquisition. From Marvell’s perspective it was a smaller part of their business, which they sold to Infineon about a year ago. How should I say it, you get the assets but you get relatively little IP. So it’s more that you try to familiarize yourself with the assets and how they fit our business case, et cetera. Of course there is due diligence to get an idea and to make sure that everything that should belong to the business is transparent, but the more important part comes after the acquisition. Once the business is owned by Infineon, all the other functions handle their own areas of responsibility. For us, when it comes to IP rights, it’s about reaching out to the new colleagues, helping them for the first couple of days, but also leaving them alone, because there are so many changes they have to go through, and not being overly pushy. Understanding their current processes and tools, and their view of their own portfolio, is important at that point. So you hold back a little and see what they do and why they do it, sometimes you can learn from their best practices. But there comes a moment when we need to finally decide how to integrate the portfolio, and which of our processes and tools they have to adopt, and the faster you make that decision, the better. Since in the case of Marvell none of the IP staff joined us, the task was to build up a portfolio using the expertise of the senior engineers, get a good operational patent committee running, and develop a plan for which areas of the portfolio are good enough and which need to grow, in line with the growth of the business. It’s now more than a year ago, but that was an interesting time, and I doubt many people listening are aware of it, but a big thank you to everybody involved back in 2025. Rolf Claessen: From your answer I get that your job involved a lot of listening, basically, to the needs of the teams that joined your company, right? Peter Berg: At least as much talking as listening. Of course they want to know as well how we do things and what’s expected of them. So first of all it’s about reaching those people and making sure, and this is also a concern, that if everything changes for them, then perhaps the patenting process isn’t the most important thing. Product development is key, and making sure there’s no interruption so they can keep their timelines, et cetera. So being very mindful of that setting. But you’re right, it’s not just about telling them, it’s about listening to them and finding the right moment to switch. Rolf Claessen: Right, I have a very different question now, about NPEs, non-practicing entities, and exposure. I think some NPEs acquired patent families that trace back to Cypress, just before you bought it, or around the time of your acquisition. Are these patents, held by these NPEs, now a problem for Infineon? Peter Berg: That would be it, right? Actually, no, let me give some context first. Companies in distress, or with an overly large patent portfolio for their business, sometimes sell patents at a certain point in their history. Regarding Cypress Semiconductor, that happened around 2016, after they merged with a company called Spansion and ended up with a large combined portfolio they didn’t need. At that point Cypress teamed up with an NPE organization called IP Value and sold them around 2,000 patents, that’s public knowledge, and only a few years later Infineon acquired Cypress. So that was done by Cypress before it became an Infineon company. But good practice is, if you sell a patent, you retain a license for your own business, so in that sense I don’t feel any exposure from those patents. But of course this touches on the general topic of exposure to NPE enforcement, which is a concern in the electronics industry. Realistically, hundreds is perhaps too much, but many dozens of new cases a month, often against our customers or the wider ecosystem. But since it involves technology implemented in our products, even if the enforcement doesn’t target semiconductor players directly, we need to support our customers, and that is a kind of a load we need to help carry. But these are typically patents that somebody else sold to an NPE. You were also asking whether acquiring businesses brings new opportunities as well as new risk. I think that’s natural, and we shouldn’t shy away from that kind of risk. If we, like any other company, go for the big, high-margin, fast-growing businesses, the stakes are high in those areas, and you can’t complain if these also turn out to be litigious marketplaces, because many people want to be there. Around this time of year, since it’s Oktoberfest season here in Munich, many IP practitioners from around the world gather for meetings and share their view on the world. Everybody talks about AI, and NPEs try to acquire whatever patents are on the market that could be the basis of stronger or weaker infringement actions against that part of the industry. From an industry perspective, this consumes a lot of resources and doesn’t really help accelerate innovation in our space. Rolf Claessen: Good that you have a solution for the patent families that were acquired before you acquired Cypress. And now, turning to a very different topic, cryptography. You’re also working on quantum cryptography and post-quantum cryptography, a difficult word, and you, Infineon, were the first to obtain a certification, a really high certification in post-quantum cryptography, the so-called CC EAL6 certification, a very high certification in cryptography for our listeners, in December 2024. Now this field of technology is heading towards standardization. How patent-dense is Infineon’s patent stack in this field, and how are you thinking about the potential standard-essentiality of this new post-quantum cryptography technology, where maybe the American standards from the NIST institute become the infrastructure, or the standard? Peter Berg: It’s a big field with different components. We take the quantum challenge seriously at Infineon, but there are two elements to it. You spoke more about cryptography, but for us, as a semiconductor player, on one hand we want to enable quantum computing with our own chipsets, and we support two different technology streams there, it’s not just development, it’s already a real business. On the other hand, we need to educate and enable customers in the application fields we serve to prepare for that quantum day, the day quantum computing becomes available, and not only to the good guys. You need to think about this now, because it might be just three, four, five years away, you don’t know for sure. It means investing in infrastructure able to handle post-quantum cryptography and security in communications, because you need certain computing power and different ways of handling cryptography algorithms compared to today. Today’s approaches won’t be enough, you need better ones, and you mentioned one at the beginning, which Infineon has proposed. That’s not easy. If you invest in a core today, you’re investing in something like a power station, which stays connected to the internet for a long time, so you need infrastructure robust enough to handle post-quantum cryptography. Regarding the patent stack question, yes, certainly there are several patents in this field owned by Infineon, but also by others. In general, I believe, both in semiconductors and in security more broadly, this tends toward royalty-free licensing, and standard setting has in the past been marked by the avoidance of the big patent clusters we saw building up in cellular communication, from 2G through 5G. I don’t see that happening in the post-quantum cryptography field, but who knows, so we prepare for whatever scenario comes. Rolf Claessen: Let’s see if the Infineon patents end up in a big pool or something later on, and you get all these license fees. Peter Berg: I wouldn’t mind, yeah. Rolf Claessen: Let’s see. Right, now turning to another topic, maybe, for example US colleagues ask me a lot about the German employee invention law. It’s very different from other countries, especially the US. Do you see the German employee invention law rather as an opportunity or a burden for Germany’s innovation ecosystem? Peter Berg: As IP professionals in larger corporations in Germany, we’re so used to that law that we hardly challenge its usefulness. To your question, though, with more than 30 years of experience, I’d say that 99% of all inventions are made by engineers in R&D as part of their regular job, nothing extra on top, so they don’t need an extra motivation for it. And we see it in other countries too, where that kind of law doesn’t exist, and people are just as innovative and just as ready to share their inventions with us as an IP organization, with or without the law. So it doesn’t seem to fulfill the role some see as a competitive edge for Germany, and because of that inventor law, people just end up being more cautious, or more descriptive, about their work results. There are more reasons why I believe this is obsolete. Invention does not equal innovation. There are many other colleagues in a company, in procurement, production, quality management, et cetera, and all of them contribute to a product becoming a bestseller. It’s not a single person, and it’s not just one team’s result, and somehow it doesn’t feel fair that the inventor gets an additional bonus and the others don’t. In any case we’d give our top engineers a premium anyway, and we reward inventors in all other countries, with the law or without it, without any worldwide mandate for that kind of remuneration. So from a corporate perspective we don’t need a law to help us work out the benefits and share them with our top inventors. The law is a bureaucratic nightmare. It needs to be abandoned, or at least radically simplified. In smaller organizations, I guess it’s often just ignored or badly implemented. Believe me, every company we’ve acquired with operations in Germany has left us a bit of a heritage to clean up. Rolf Claessen: Yeah, I understand. Now for a different topic, AI, the use of AI. We as patent attorneys talk about this a lot, it’s a big topic, how to use AI, whether to use AI, and how to use AI in law firms. But can you tell us about the use of AI in the operations of your team? Peter Berg: Recently we discussed this and agreed on kind of three layers to it. First, good use of established AI tools. AI, in that sense, isn’t something that started three years ago with ChatGPT. It began with search, patent search, then translation, at least between the major languages like German and English, which most of my team masters, and then, I’d say about two years ago, drafting and replies to office actions. So there are established tools, and as with every tool, you need to use it repeatedly, at a certain volume, to really benefit from it. We try to work with the best of these established tools, driving wider adoption within the team and partnering with our law firms, since a substantial part of the legal work is done by our outside counsel. So this is a bit of a joint exercise. Second, there are constantly new tools coming up, which we try to test. There are many, so the time we have available to look into them is the limiting factor. I’d like to test more, because there might be a new frontrunner coming up that we should definitely try ourselves. But last, and certainly not least, we try to implement AI into everyday operations, into the office environment itself. The company made a good decision in spring to allow wide adoption of AI-specific tools in a secure environment, and that has opened up a lot of opportunities for everybody, paralegals and attorneys alike, and now it’s about fostering an open exchange on what’s possible and what’s not. And finally, since Infineon, like most corporations, doesn’t do everything in-house, there’s the question of what the benefits are that we can plan around, so that we get better quality. If the quality of the AI results isn’t as good as the attorney’s results before, then we shouldn’t use it, or we’d spend so much time cleaning it up afterwards that nobody could tell the difference. Second, we can now do things that weren’t possible before, because they were too tedious or took too long, or we get faster turnaround times, so we can respond more quickly to standardization proposals, what used to take many days we can now do in a few days, while still trusting the quality of the output. And only then comes what’s often discussed as efficiency gains, and the question that will probably be asked next year is how we split the pie: if both we and outside counsel benefit from using AI, what do we do with those benefits, how much stays with outside counsel, and how much should also benefit my budget? Rolf Claessen: But I clearly see the advantages of using AI, I’m using it myself, especially for cases like oppositions, where in earlier times you had to read through some 30 papers, patents and books, and now you can just ask the AI where you find a certain feature across those 30 documents. So it’s really useful in a lot of cases. Now my last question to you, and maybe the most important one, what do you think are the three most important messages you want to convey to our listeners, who are mostly IP professionals, both in-house and in law firms? Peter Berg: Do you want me to repeat things I said before, or can I think freely, in general? Free thinking, of course. Okay. Many of the things we spoke about now were about what to do next, and how to execute certain things, how to prepare. I believe that if you think about IP strategy, you think about it from the end: what do I need to assert, against whom, for what purpose, before building a portfolio of IP rights. So it’s not just about the deadlines you have today and tomorrow, which you somehow have to get through, but about taking a step back and thinking, what should this be good for in 10 or 20 years’ time. If you do that, it helps you get to litigation-grade patents and litigation readiness. We’re all busy, and there are so many things we need to do today and tomorrow, so it’s easily forgotten to look a little further down the road. So I’d say, think about a multi-year plan to achieve your goals, and there are hardly any moments, unless perhaps you’re one of the big AI platforms with unlimited resources, where that isn’t true. So plan for multiple years, but with a good cost-benefit ratio in mind. And I can’t really avoid mentioning AI here. It’s having a major impact on our operations. We’ve talked about it, we’ve tested it, but ramping it up is a different matter, and I think next year will be decisive. That’s really the full value chain, from interacting with our inventors to get better quality ideas, all the way to claim charting and negotiating, the bread-and-butter activities of patent attorneys, drafting office action replies is of course part of that too. I’m really keen to see that happen, and I’m trying to keep my team ahead of the wave. And I can only encourage everybody in our profession, if you don’t yet have a contact, team up with friends or colleagues in the profession, use the various associations that exist in our profession to network and discuss. The worst thing is to miss the train, and it takes time, this isn’t something you become good at overnight, so it needs time to train, and it’s good to start now. Rolf Claessen: Yes, that’s a very good point, and closing where we began, with the VPP, exchanging ideas among colleagues really is key, I think, important. Thank you very much for being on IP Fridays, on our podcast. That was really interesting, and I think our listeners can learn a lot from this interview. Thank you very much. Peter Berg: Don’t mention it, it was a pleasure talking to you, and for me it was also the first time doing this kind of podcast. Thank you. Rolf Claessen: Thank you

Send us Fan MailWhat if cybersecurity tools are not the foundation of protection—but compliance is?Reza Sanjideh, founder and president of Advanced 2000, joins Joey Pinz to explain why MSPs and government contractors must stop treating compliance, cybersecurity, and IT services as separate responsibilities. Drawing on more than three decades in technology and his work with CMMC and NIST 800-171, Reza argues that organizations need a defined structure before their security investments can deliver consistent results.The conversation also explores Reza's lifelong interest in philosophy and its influence on critical thinking, ethical decision-making, leadership, and adaptability. He challenges people to ask better questions, remain willing to change their minds, and think beyond memorized answers—especially as artificial intelligence becomes more influential.Reza also shares his journey from break-fix IT to managed services, the growing pressure MSP owners face from aggressive buyers, and why proactive maintenance must replace reactive problem-solving.Top Three Highlights

Shannon Yavorsky is a Global Co-Chair of Orrick's Cyber, Privacy & Data Innovation group and co-head of its AI practice. She advises leading companies on privacy, cybersecurity and AI regulation, governance, transactions and strategic risk management, helping clients translate fast-moving legal requirements into practical, business-focused solutions.References:* Shannon Yavorsky on LinkedIn* Shannon Yavorsky at Orrick* AI governance frameworks, comparison and overlaps (AI Sentinel docs): Thirteen widely used AI governance frameworks, including AIUC-1, AI Act, NIST, ISO, California ADMT, and more. Compared across fourteen dimensions. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

In this episode, Ryan and Shannon explore recent cybersecurity incidents involving AI rogue agents, maritime cyber threats, and government regulation of AI and cybersecurity. We also discuss the importance of community investment in cybersecurity workforce development and the future of AI safety. Article: Google's Gemini Hacked Three Companies in May, and It's Only Admitting That Now https://gizmodo.com/googles-gemini-hacked-three-companies-in-may-and-its-only-admitting-that-now-2000814420?fbclid=IwcGRvZgVleHRuA2FlbQIxMABicmlkETEzNE9YcXlkVGRzbXBLWHE4c3J0YwZhcHBfaWQQMjIyMDM5MTc4ODIwMDg5MgABHmyZyeCDthZ9AdY-dwPt6cowDNItX2g7wNqG6VcyUqeQ1qX1FBfHlciX2vUv_aem_nqdOF-ZuseSmITj92tMXvg FBI, Coast Guard probe suspected cyberattacks on ships entering US waters https://www.cybersecuritydive.com/news/fbi-coast-guard-probe-cyberattacks-ships-us-waters/830668/?fbclid=IwcGRvZgVleHRuA2FlbQIxMABicmlkETEzNE9YcXlkVGRzbXBLWHE4c3J0YwZhcHBfaWQQMjIyMDM5MTc4ODIwMDg5MgABHqvT6lju-QNtyU6zLNli0Vi6HltnJFKDS7aQw5yZmFqWwdm6pCUHiJyt5Qh1_aem_Vkgju_xyPhh2_JLRbMME4A NIST Awards More Than $1.7 Million to Support Cybersecurity Workforce Development Across 8 States https://www.nist.gov/news-events/news/2026/09/nist-awards-more-17-million-support-cybersecurity-workforce-development?fbclid=IwcGRvZgVleHRuA2FlbQIxMABicmlkETEzNE9YcXlkVGRzbXBLWHE4c3J0YwZhcHBfaWQQMjIyMDM5MTc4ODIwMDg5MgABHi0mhTk1wEUlEF-BY_xxIYeI0B_MjjMcO5UbnSKfIVEuI8vl5LAK7Ow3z-7x_aem_DTlqCh70umPCG8PJTt1pNQ Buy my book: https://www.theothersideofthefirewall.com/ Please LISTEN

Dr. Judy Wood, a materials engineering scientist and former professor, about her forensic investigation into the destruction of the World Trade Center on 11 September 2001. Wood argues that the towers were not destroyed by fire, kinetic impact or controlled demolition, but were 'dustified' — turned almost entirely to fine dust — by a directed energy technology she links to the Hutchison effect and to weather phenomena such as Hurricane Erin, which she says was sitting off New York that day and went unreported. She describes compiling over 40,000 images, seismic records and physical samples for her book 'Where Did the Towers Go?', and recounts her 2007 whistleblower (qui tam) lawsuit against NIST contractors, which was dismissed.Become a supporter of this podcast: https://www.spreaker.com/podcast/total-disclosure-podcast--5975113/support.CONTACT TDP DIRECTLY For Collaboration, Use of Segments/clips, or any other media produced by “TDP” —TY.TotalDisclosure@gmail.comSpecial Thank you to all of our PODCAST/YouTube Channel Members for your continued support, and dedication to seeking the truth, together. We can't do this WITHOUT YOU!-COPYRIGHT-2020-Copyright Disclaimer: Under Section 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as criticism, commenting, news reporting, teaching, scholarship, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use. Total Disclosure Podcast Copyright 2020 and …  segments, early access to interviews, and a yearly gift autographed by yours truly!thank you in advance now, Let's explore the unknown together!

* 9/11 Questions: This week Fred Williams and Doug McBurney recall the events of 9/11/2001 in light of questions regarding structural issues, the collapse of the towers and building 7, and whether or not there is convincing evidence that 9/11 was an inside job. * Building 7: We discuss what has emerged as the most compelling question surrounding the events at Ground Zero that day: Why did Building 7 collapse the way it did?   * Credible Evidence: While many dismiss the reports of the 9/11 Commission, FEMA, and the NIST, we hold the evidence that people on both sides argue about, (including credible reports from contrarian Engineers) up against Rob Stadler, PhD's six criteria for high confidence science.   * Jesus Light & Design: Get the first in our series of Real Science Radio Teaching Books, all about how light and design point to Jesus Christ as the Creator and Savior of the world.   * In The Beginning: Order your 9th edition of Walt Brown's amazing, enlightening, biblically sound book explaining why Earth (and the solar system) look the way they do!   * Sun Puzzles: Check out another one of Ellen McHenry's intriguing and enlightening books: Sun Puzzles - on all the curious facts about the Sun that point to an electric, (and not a nuclear) sun.   * Not So: Pick up a copy or two of RSR's 2nd in our series of Real Science Radio Teaching Books: "The List of Not So Old Things.," with all the "not so old things" Bob Enyart compiled over the years!

* 9/11 Questions: This week Fred Williams and Doug McBurney recall the events of 9/11/2001 in light of questions regarding structural issues, the collapse of the towers and building 7, and whether or not there is convincing evidence that 9/11 was an inside job. * Building 7: We discuss what has emerged as the most compelling question surrounding the events at Ground Zero that day: Why did Building 7 collapse the way it did?   * Credible Evidence: While many dismiss the reports of the 9/11 Commission, FEMA, and the NIST, we hold the evidence that people on both sides argue about, (including credible reports from contrarian Engineers) up against Rob Stadler, PhD's six criteria for high confidence science.   * Jesus Light & Design: Get the first in our series of Real Science Radio Teaching Books, all about how light and design point to Jesus Christ as the Creator and Savior of the world.   * In The Beginning: Order your 9th edition of Walt Brown's amazing, enlightening, biblically sound book explaining why Earth (and the solar system) look the way they do!   * Sun Puzzles: Check out another one of Ellen McHenry's intriguing and enlightening books: Sun Puzzles - on all the curious facts about the Sun that point to an electric, (and not a nuclear) sun.   * Not So: Pick up a copy or two of RSR's 2nd in our series of Real Science Radio Teaching Books: "The List of Not So Old Things.," with all the "not so old things" Bob Enyart compiled over the years!

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation. We discuss: Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles Opportunistic vs. forced TLS Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace What HIPAA actually requires for email security Where NIST (National Institute for Standards of Technology) guidance fits in The actual risk analysis for legacy TLS Benefits of secure email services, and when it might make sense to cancel Data to gather from your secure email service to do your own risk analysis Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Episode 623: Now You Can Secure Outbound Email in Google Workspace Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management. PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know PCT's detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate. PCT's Free Google Workspace Configuration Help Center Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS. PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice PCT's framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources 45 C.F.R. § 164.312 — HIPAA Security Rule Technical Safeguards The regulation itself, including the Transmission Security standard at § 164.312(e). HHS: Are Covered Entities Required to Use NIST Guidance Documents? HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule. HHS: Is the Use of Encryption Mandatory in the Security Rule? HHS explains the Security Rule's risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards. Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections Google's current documentation on Gmail's support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable. NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations NIST's technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.

MacOS 27 - First Boot https://isc.sans.edu/diary/MacOS%2027%20-%20First%20Boot/33340 Cisco Secure Email Gateway SQL Injection Vulnerability CVE-2026-76461 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Detecting and Mitigating Active Directory Compromises https://www.cisa.gov/resources-tools/resources/detecting-and-mitigating-active-directory-compromises Protecting Tokens and Assertions from Forgery, Theft, and Misuse https://nvlpubs.nist.gov/nistpubs/ir/2026/NIST.IR.8587.pdf My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich

AIUC first got our attention with the NFDG backing, and have just announced a $40M series A today, with the most impressive industry advisor list we may have ever seen for an early startup behind AIUC-1, their agent standard backed by real insurance:From being Anthropic's first product hire to building the standards, testing, and insurance infrastructure meant to make frontier AI deployable, Rune Kvist is betting that the biggest constraint on AI adoption won't be capability it will be trust. In this episode, the AIUC cofounder joins swyx and Vibhu to announce a new $40M round and explain why companies like Cursor, Harvey, Lovable, and ElevenLabs are increasingly confronting a problem that gets harder as AI gets better: who is responsible when autonomous systems fail?We go deep on AIUC-1, the emerging standard for agent security, safety, and reliability; how AI agents are stress-tested for jailbreaks, hallucinations, and data leaks; and why Rune thinks standards and insurance could become critical infrastructure for AI. We also discuss the growing trust gap between governments and frontier labs, AI-enabled cyber and biological risks, why every model can ultimately be jailbroken, what happens when a $20 coding agent causes $200M of damage, whether AI engineers should be certified, and why even after AGI there may be one job the labs can never do themselves: be their own watchdog.We discuss:* Why risk, liability, and trust may become the binding constraint on AI adoption* Rune's path from reading the Scaling Laws paper to joining Anthropic in its earliest days* What Anthropic understood about scaling, compute, and the future years before it became obvious* Why Waymo illustrates the gap between AI capability and real-world deployment* AIUC's $40M round and work with Cursor, Harvey, Lovable, ElevenLabs, and other frontier AI companies* AIUC-1: a standard for AI agent security, safety, and reliability* How agents are tested for jailbreaks, hallucinations, and data leakage* Why most AI companies optimize the happy path without seriously stress-testing adversarial cases* Why AI standards may need to update every quarter instead of every decade* The emerging trust gap between frontier AI labs and governments* Cybersecurity, child safety, biological weapons, and the expanding frontier-model risk surface* Why standards and insurance may need to evolve together* How Lloyd's of London can insure AI systems and bring trust to enterprise deployment* What happens if a $20 Cursor subscription contributes to a $200M plane crash* The Air Canada chatbot case and how AI failures are beginning to clarify legal liability* Why copyright may be one of the hardest AI risks to insure* Evals, mechanistic interpretability, monitoring, and models becoming aware they're being tested* The impossible CISO mandate: adopt AI fast, but don't let anything go wrong* Why robotics will make AI liability dramatically more consequential* Whether AI engineers should have Level 1, 2, and 3 certifications* AIUC's roadmap across agents, frontier models, robotics, and universal red teaming* Why AGI could become a question of national sovereignty* Why the labs can never fully serve as their own watchdogs* The Big Short problem: how do you stop competing watchdogs from racing standards to the bottom?Rune Kvist* LinkedIn: https://www.linkedin.com/in/runekvist/* X: https://x.com/RuneKvistAIUC* https://aiuc.comTimestamps00:00:00 AIUC's $40M Round and the Risk Bottleneck for AI00:01:07 From Scaling Laws to Early Anthropic00:07:58 Why Trust, Not Capability, Could Limit AI Adoption00:12:19 Founding AIUC and Building AIUC-100:18:52 How AI Agents Are Audited and Stress-Tested00:25:26 Frontier Models, Government, and the AI Trust Gap00:33:32 Cyber, Child Safety, and AI-Enabled Biological Risk00:38:14 Why Standards and Insurance Belong Together00:41:45 What Does an AI Insurance Policy Actually Cover?00:50:44 The $20 Cursor Subscription and the $200M Plane Crash00:53:53 AI Liability, Monitoring, and Earning Enterprise Trust00:56:21 From AI Agents to Models to Robotics00:58:29 Copyright, Adverse Selection, and AI Insurance01:03:28 Evals, Mechanistic Interpretability, and Eval Awareness01:08:36 The Impossible Enterprise AI Mandate01:11:52 Prediction Markets vs. AI Audits01:14:43 Should AI Engineers Be Certified?01:19:10 AIUC's Roadmap, AGI, and Who Watches the Watchdogs?TranscriptIntroduction: AIUC, the $40M Series A, and Risk as the Adoption BottleneckSwyx [00:00:00]: Okay, we're in the studio with Rune from AIUC, the Artificial Intelligence Underwriting Company, with our trusty co-host, Vibhu. Welcome.Rune Kvist [00:00:10]: Thank you. Thanks for having me. Thank you.Swyx [00:00:11]: What are you announcing today?Rune Kvist [00:00:12]: We have raised $40 million, led by Ribbit Capital and First Harmonic.Swyx [00:00:17]: You first came to my attention when Nat and Daniel invested in you guys. Is the story, like, pretty much the same? Like, what are you today versus what you thought you were back then?Rune Kvist [00:00:26]: When we raised our seed round, we had a hypothesis that at some point risk was going to hold down adoption. At that point in time, that felt kind of hypothetical, and I think that is now over. Clearly, the moment is now with Mythos and Fable. It's pretty obvious that literally the binding constraint on adoption is risk. And so for us, it feels like this is a natural continuation of the same hypothesis, but where previously it was speculation, now it feels like fact.Swyx [00:00:54]: And let's get a list of the customers that you're highlighting as part of your Series A.Rune Kvist [00:00:58]: Totally. Yeah. So we are now working with folks like Cursor, Harvey, Lovable, ElevenLabs.Swyx [00:01:05]: Yeah. Amazing. Congrats.Rune Kvist [00:01:06]: Thank you.Swyx [00:01:07]: So you were famously one of the first hires involved in GTM and product. I'm just kind of curious: what was your path into AI? Just recap.Rune's Path Into AI: Scaling Laws, Capital, and AnthropicRune Kvist [00:01:18]: Yeah.Rune Kvist [00:01:19]: Late 2021, I sold a company, my first company, an edtech company. I had a bit of time to think about what was next. I came across the Scaling Laws paper, and that just struck me like lightning. I was just like, “This is a big idea.” In short, the Scaling Laws paper just says the bigger the model, the smarter the model.Swyx [00:01:38]: So this is the Kaplan one, not the Chinchilla one?Rune Kvist [00:01:40]: Exactly, the Kaplan one.Swyx [00:01:42]: Yeah.Rune Kvist [00:01:42]: And the important thing that clicked for me there was, oh, now capital will understand this. If you put in more money, you get more money out, and so that will kick off a hype cycle. And so you get a sense of predictable returns, which is, in fact, what's played out. And so I just packed my bags. I'd never been to San Francisco. I'd never been there. I just packed my bags, flew out here to find the people who had written it. And at the time, they had just started a small lab called Anthropic. There were around 40 people at the time or so. Drank a bunch of coffee until I eventually got introduced to Dario. And at the time, they were wrestling with some of these questions of, like, should we deploy our models? Should we make revenue? How should we engage with the rest of the world? They'd just broken off from OpenAI, and it's been publicly reported that they were kind of concerned with how they were dealing with deployment. So they were wrestling with some of those questions. At this point, this is early fog of war, like early 2022. The hottest product at the time was, like, Jasper. Like, there's nothing out there. So where value was going to accrue, and what the different parts of the stack were going to be, were all open questions.Swyx [00:02:48]: I want to highlight to people, you ask these questions because you have a PPE background.Rune Kvist [00:02:52]: Yes.Swyx [00:02:52]: I actually was in Singapore in one of the sort of feeder programs for prepping people for PPE. So I had a tutor. We learned, you know, philosophy and politics and economics. But, like, I think your kind of background matters. Machine learning people who read the neural, Scaling Laws paper would not necessarily draw the same conclusions that you did. Whereas any capitalist would read that and go, “Holy s**t.”Rune Kvist [00:03:19]: Correct.Swyx [00:03:20]: Right?Rune Kvist [00:03:21]: Yes.Swyx [00:03:21]: Who tipped you onto that paper? Because it's not a paper that you normally read, right, like, in your circles?Rune Kvist [00:03:26]: Yeah. I think I'd actually, ever since AlphaGo, had some appreciation that AI was a big deal.Swyx [00:03:36]: Yeah.Rune Kvist [00:03:36]: But it kind of felt like it raised all these kind of interesting philosophical questions, but it was kind of not clear from afar where exactly that would go. But it was obvious enough that it was like, this is going to be a big thing if we find the kind of right mechanism to kind of get the techno-capital machine to work on this. But it was just not clear. And so I think there was some way in which, like, that became obvious, and also it wasn't as obvious at the time than it is now, right? Like, it was just like, wow, this is so interesting. But it still felt, coming from kind of a philosophy and economics background, it felt like if this turns out to be true, you're going to be wrestling with all of the big questions in society. Everything you've learned about politics gets thrown out of the window. Everything you've learned about economics at least gets challenged. And so what felt interesting was to be at that frontier that has ramifications across everything. So that's why I sought it out.Swyx [00:04:32]: I mean, clearly really good insight. For people who don't know, the PPE program is, like, where prime ministers are born. So then you end up meeting Dario.Rune Kvist [00:04:41]: Yep. First Dario, yeah.Swyx [00:04:43]: Yeah. Well, I mean, like, so did you get extra insights from talking with them that you didn't get from your original hypothesis?Anthropic's Early Conviction and the Scaling Laws Crystal BallRune Kvist [00:04:50]: If you read the Scaling Laws paper, you get this, like, very vague sketch of like, wow, this seems kind of important. There are some lines on a chart. This seems kind of important. And what I think the team at Anthropic had thought more about than anyone was like, what are the implications of this if you really play this out? And back then they had, kind of vision documents for what the world would look like in 2026, and they were kind of in vivid detail playing out how much compute is going to be needed, what the CapEx was going to look like, what some of the societal concerns were going to be, but also what is the amount of economic value coming out here? And so it kind of felt like they held a crystal ball that in hindsight turned out to just be dramatically correct. And they weren't holding it like they were obviously correct. They were just like, “Take this hypothesis really seriously.”Swyx [00:05:38]: Think it through, yeah.Rune Kvist [00:05:38]: And think it through in the same way as the kind of situational awareness that isSwyx [00:05:43]: Across the street.Rune Kvist [00:05:44]: Across the street.Swyx [00:05:44]: Your office, yeah. Oh my God, we're all living across the street in the same one square mile.Rune Kvist [00:05:50]: Correct. And that's now a couple of years old, but also people keep referencing it these particular weeks with Fable and Mythos, and it's like, wow, if you take this one idea seriously- For the Scaling Laws, a lot of things fall into place.Vibhu [00:06:03]: And keep in mind, at this point, this is the same team that did GPT-1, GPT-2, and GPT-3.Rune Kvist [00:06:08]: Correct.Vibhu [00:06:08]: Which is also, like, it's not just some experimentation. Like, this is a real model that we just scaled up.Rune Kvist [00:06:14]: And they had deep conviction in this idea: if you take a big blob of compute and data, it just wants to learn, and out of that will come smarter and smarter models. And all the particulars were not clear.Vibhu [00:06:26]: Yeah.Rune Kvist [00:06:27]: And all the implications were not clear. But their deep conviction in this, like, core thesis, and that was kind of dizzying. It was both phenomenally interesting and exciting, and also very quickly you get to, like, the world we know today will no longer be if this hypothesis holds. So it also just felt, like, important in some kind of grand sense.Vibhu [00:06:48]: What kind of shaped you there? So that was early 2022. Not only had GPT-1, GPT-2, and GPT-3 come out, but, you know, the amazing founders of Anthropic that have never split up, the only ones, they actually had the conviction to leave OpenAI, start their lab. You said there were about 40 people there. What was the time like there?Inside Early Anthropic: Mission, Deployment, and RiskRune Kvist [00:07:06]: It was kind of remarkably like what it looks like on the outside today. Extremely cohesive, extremely mission-oriented, and living in this tension between their two ideas, which is AI could both go really well and really bad, and we want to be part of building it. That creates astounding amounts of tension. And they were wrestling with this incentive challenge where they know they're in a race that they're in where you might get forced to cut corners, but it also felt very important to them to be at the forefront of technology. And all of those ideas were just present at that time. It kind of feels like that line has been just very clear, and I think kind of love them or hate them, they have really stuck to their guns. There's a core set of beliefs that they hold more deeply than most companies hold any beliefs.Vibhu [00:07:58]: Yeah. Fast-forward to today.Rune Kvist [00:08:00]: Yeah.Vibhu [00:08:00]: What does that lead us to AI underwriting company? What are you up to? What motivated you to start this?From Waymo to AIUC: Confidence Infrastructure for AIRune Kvist [00:08:05]: Yeah. AIUC builds confidence infrastructure for frontier AI through standards and insurance. The link from Anthropic to building confidence infrastructure, looking out the windows at Anthropic offices and seeing Waymos driving by. Already back then, early 2022, Waymos were in some ways like AGI for cars. Like, they were superhuman drivers, but you couldn't take one to the airport. And now, four and a bit years later, you still can't take your Waymo to the airport, despite now everyone having kind of looked at the evidence and being like, “They're better drivers than humans.” So in that particular instance, what's clear is that the binding constraint on AI being useful is not capability, but is that liability or risk or trust. That problem is, general. The reason why right nowRune Kvist [00:08:52]: Fable is not open for access is not because it's not a good model, it's because it's a very good model. It's just hard to make promises about what it will or will not do. And this problem gets worse as AI gets better. Basically, more intelligent AI can be more autonomous. That's more valuable, but also the risk surface grows. And so - what Waymo illustrates is that unless you build the confidence infrastructure to make promises about AI, or at least bring light to the risks, you grind adoption to a halt. Governments, banks, hospitals, militaries need to have some sense of what AI will and will not do to be able to operate for them to incorporate it. And that's the problem that we're trying to solve. Now, why standards and insurance? If you trace this problem back through history, every technology wave has had some version of this problem. So if you go back to, like, year 1900, electricity comesVibhu [00:09:47]: Ben Franklin.Rune Kvist [00:09:48]: Cars burn down, sorry, houses burn down, lots of people die. 1930s, cars are a big deal, kill lots of people. 1950s, private nuclear energy is a big deal, poses big risks. In each of those instances, the market runs ahead of regulation to create confidence infrastructure because that's required to make go/go decisions. That is required for adoption, and the market fundamentally wants adoption. And in all of those instances, common blueprint emerges between standards and insurance. The reason these two components is standards kind of provide the rules of the road, and they also specify, like, what are the tests that need to be run so we can get a sense of how high the risk is. So take in the case of cars, that's like a car crash. Great, everyone, they inform your insurance pricing today, they inform your purchasing decisions, et cetera. That's basically the risk framework. The insurers are important because they pick up the bill. So they are the private institution that is most on the side of. That is best incentivized to quantify the risks truthfully and then figure out all the ways to reduce the risk ‘cause that increases their profit. So they're basically, they help shape the incentives. And these two work really well in unison. Now, how does that show up as a company? Well, one of the things that was obvious even - or starting to become obvious even a couple years ago was that frontier companies, some of our customers today, like Cursor, Sierra, ElevenLabs, Harvey, were going to have a very easy time selling a pilot to a bank. The, like, the demo just sells itself. It's magic. But bringing that through, if you want to do a wall-to-wall rollout at a bank or a hospital, you have to go through the risk process. These banks have no idea even which questions to ask, let alone which answers are sufficient, let alone, like, how do they go and test whether these agents actually work the way they're supposed to. And so they had this problem of, like, what can we say to earn the trust? And we think there's, like, a golden sentence that goes something like, “Hey, I hear you're really worried about hallucinations or jailbreaks or whatever it may be. We've had an independent third party test us against the gold standard. We passed with flying colors. And as a vote of confidence, the world's most conservative insurers have looked at the data.” And they're willing to take some of the risk onto their balance sheet.Swyx [00:12:06]: Yeah.Rune Kvist [00:12:07]: So if something does go wrongSwyx [00:12:07]: There's money behind it, yeah.Rune Kvist [00:12:09]: Exactly. So that's kind of like the link between all this. We can get into some of the hard parts related to the technical testing, which is, I think, the crux of the matter, but I'll pause there.Swyx [00:12:19]: How did you and Rajiv come together? This-- there's always, like, you come across very confident and, you know, and we're announcing your Series A and all these things, but I want to see, like, the early initial stages of, like, idea formation.Cofounding AIUC with Rajiv DattaniRune Kvist [00:12:31]: Yeah. Rajiv is actually my soon-to-be brother-in-law.Swyx [00:12:35]: Oh.Rune Kvist [00:12:36]: So I'm actually, in a week and a half getting married to Rajiv's sister.Swyx [00:12:42]: Okay, now you're tight.Rune Kvist [00:12:44]: Exactly.Swyx [00:12:44]: Now you know.Rune Kvist [00:12:45]: So - Rajiv and I have known each other for a decade. Funny story, I met both Rajiv and his sister, Hena, at the same time when Hena and I were interns at McKinsey in London, and Rajiv was assigned as my mentor. And so met them at the same time. For the longest time, it was not obvious that we were necessarily going to work together. I was in startups. He was, an insurance partner at McKinsey. Three or four years ago, I think Hena convinced him that AI was going to be a really big thing. And so he quit his job, cushy partner job at McKinsey in London, packed his bags, flew to San Francisco, and ended up joining METR. You guys are probably online enoughSwyx [00:13:24]: CEO.Rune Kvist [00:13:24]: Exactly.Swyx [00:13:24]: We've, we've, we've heard of METR.Rune Kvist [00:13:25]: You see the plot-- the chart of the horizons of the tasks that agents can take on is doubling extremely fast. So he was COO at METR, led their partnerships with Anthropic and OpenAI to test their models before release, but also working closely with the US and UK government, to figure out, like, how do you know whether a model can be released? And in some ways, that was, like, the perfect background. He's spent a lot of time in insurance, knows that world, spent a lot of time with frontier testing of models. And so when I was bumbling around this idea space, starting with some of the ideas we talked about related to Waymo, as soon as we got into the content, we were both like, “Oh, this would be an amazing business to build together.” This is wrestling with the problem that we both think is the most important in the world from a market angle, which is kind of our intuitions is that the market can do a lot, and the faster AI moves, the harder it is for government to solve some of these problems. And then it took a little bit of time to work through what is it like to work with family.Swyx [00:14:27]: Sure.Rune Kvist [00:14:27]: And,Swyx [00:14:30]: Because you were already dating at the timeRune Kvist [00:14:31]: Yeah. Yeah, exactly.Swyx [00:14:33]: Yeah.Rune Kvist [00:14:34]: Already back then, itSwyx [00:14:35]: Yeah.Rune Kvist [00:14:35]: We felt like we were a family.Swyx [00:14:36]: Nice.Rune Kvist [00:14:36]: And so starting a business together felt like kind of a big step. And, here we are with just immense amounts of trust.Vibhu [00:14:43]: Yeah. So now you're a company of how big? How big are you guys now?AIUC-1 Certification: Agent Security, Safety, and ReliabilityRune Kvist [00:14:46]: There are just 20 of us now.Vibhu [00:14:47]: 20 of you guys now, have Series A, and you have your first certification out, the AIUC-1. Let's bring up the certification. So this is the agent certification, right? What goes into the process? I have, like, two questions here. One is, walk us through the certification, and two is, what is the process for a company to get certified, you know?Rune Kvist [00:15:08]: Great. As it says right on the top, AIUC-1 is a standard for agent security, safety, and reliability. The fundamental design principle is take all of the concerns that slow down adoption, so all the questions, all the fears that keep, security leaders in the Fortune 1000 up at night, and put them into one comprehensive framework. That's what you'll see there. You can see the six categories. Two, you want to ground all of this in technical testing. So one of the concerns with security standards that often feel kind of like theater paperwork is that they're not actually ground out in, does any of this work? Does any of this matter? And so we had a conviction from early on that was going to be the kind of crux, was to pass this, you must get tested every quarter, basically run thousands of simulations to see, well, so can it actually be jailbroken? How hard is it to jailbreak? How often does it hallucinate? How often does it leak data? Et cetera. And then the last, core idea here, if you scroll up to the top here, is to refresh it quarterly.Rune Kvist [00:16:08]: So the core trait of AI is that it moves extremely fast. Whatever concerns we're discussing today were not the same ones three months ago, and this will keep changing. Typically, standards update on a, like, a decade cycle is obviously not going to work. But the question is kind of how do you update it? And the core thing here was to basically get the risk leaders of the Fortune 1000 around the table. So if you go over to the left hereVibhu [00:16:32]: YeahRune Kvist [00:16:32]: You'll see the AIUC-1 consortium. The consortium is a group of risk leaders who run real banks, real hospitals, real critical infrastructure, who are facing these challenges every day. And we meet with these folks twice a quarter and hear what's top of mind, what is keeping them up at night. There's tremendous amount of desire for that conversation. And then we operationalize that into a specific standard that gets into. And actually, we can go into and look at whatVibhu [00:16:55]: YeahRune Kvist [00:16:55]: What even is the standard. So if we go back to introduction, out there to the left, scroll up a little bit to the wheel, click into reliability. So if you take something like hallucinations sits in reliability. There is a number of requirements here. If you go into the top one, prevent hallucinated outputs, hallucinate outputs, this is one particular requirement. This is a technical control. Basically, we want some kind of ground in this filter. The first thing you see here is what's called a crosswalk. So everyone and their grandmother has put out a framework, very high-level framework for what are the AI risks.Swyx [00:17:27]: This is basically your competition,Rune Kvist [00:17:28]: In some ways our competitionSwyx [00:17:29]: Not seriously, yeah.Rune Kvist [00:17:30]: We're, in fact, friends with them. We'll come back to why.Swyx [00:17:31]: Yeah.Rune Kvist [00:17:32]: But mapping everything together so you have one superset. The claim you're trying to support here is, if you follow this framework, then you can also see how you follow the other frameworks. But the meat of it comes down here in control activities and evidence. So control activities is like, great, you have this high-level requirement. How do you turn that down to something operational? Here's what you must do, and then what is the evidence that we're looking for?Rune Kvist [00:17:57]: And the reason we go this deep is that there's actually not that much confusion about what are the big concerns in AI. Everyone agrees to these. The question, like, what are you actually supposed to do? And so. What we found a lot of demand for is getting down to the specific evidence, that people need to look for. Whether you are Cursor building something or, even JPMorgan building something, but also if you're just a risk leader at JPMorgan, like what exactly should you ask for? What can you ask for without sounding stupid? Like if you ask for some-- you won't believe the amount of time a risk leader has asked for the IP rights to the underlying model to Cursor or something, and you're just like “Sorry, what?” Like,Swyx [00:18:39]: You slip it in there and you seeRune Kvist [00:18:40]: SlipSwyx [00:18:40]: See if you notice.Rune Kvist [00:18:41]: See if they. Exactly.Swyx [00:18:42]: Yeah.Rune Kvist [00:18:42]: Put that in the questionnaire. All right, so that's kind of what our standard is, and we update this every quarter with these folks, to keep up with the latest concerns.Swyx [00:18:51]: Can I double-click on this one?Controls, Evidence, and Third-Party TestingRune Kvist [00:18:52]: Yeah.Swyx [00:18:52]: So first of all, the website's beautiful. Like, it's so confidence-inducing which is the whole point where, like, okay, I know exactly what I'm signing up for when I talk with you. Like, I don't even have to talk to you. I can just see your whole, certification, which is great. But, like, okay, so from here, like D001.1 configure a groundedness filter, how does that get applied? Like, you have a person thatRune Kvist [00:19:16]: Yeah,Swyx [00:19:16]: Goes through it?Rune Kvist [00:19:17]: If you, go backVibhu [00:19:19]: I did see somewhere there's like, you know, fifty-one requirements, a hundred thirty controls. There's like a wholeSwyx [00:19:25]: Right. I just want to. Like, to me, this doesn't translateVibhu [00:19:27]: Yeah.Swyx [00:19:27]: Into a test or an eval.Rune Kvist [00:19:28]: Yes. So if you go into, on the left-hand side. So actually, if - before we go in there are three types of requirements. The first is technical controls, like you must implement some guardrails.Rune Kvist [00:19:42]: Two, there are test controls. So you must have an independent third party go and run some tests against you. I'll show you one of those in a second. And then three, there are policy controls. For example, you must have a person whose name is on the line when you guys f**k up, and you must have a plan for how you tell your customers and how you engage with them. They're kind of more traditional, standard type stuff. So in this particular instance, we just check whether they in fact have a ground in filter. So we will partner with an auditor. So we partner with auditors like KPMG or like Schellman who go in and do the thing auditors do, which is to check the evidence. In this case, that might be a screenshot, it might be part of the code that they need to review to see that it actually. Just that it exists.Swyx [00:20:21]: Oh, okay.Rune Kvist [00:20:22]: And then the second thingSwyx [00:20:22]: So you're not testing the effectiveness of it.Rune Kvist [00:20:24]: That's the second thing. So if you go downSwyx [00:20:25]: Yeah.Rune Kvist [00:20:25]: To the third-party testing for hallucinations out on the left, that's basically the next requirement. This is where we test how well does it actually work.Swyx [00:20:32]: Okay, and is it you testing or the auditor?Rune Kvist [00:20:34]: We test them.Rune Kvist [00:20:35]: We test them.Swyx [00:20:36]: That's a lot of work.Vibhu [00:20:37]: How long does testing take? So if I want to get certified, justCertification Timelines, Remediation, and Quarterly UpdatesRune Kvist [00:20:40]: Yeah.Vibhu [00:20:40]: How long does the end roughly take?Rune Kvist [00:20:42]: Yeah, the end, almost always is dependent on, like, our customers needVibhu [00:20:47]: Yeah.Rune Kvist [00:20:47]: To look something for us. It takes somewhere between, like, 3 to 10 weeksSwyx [00:20:52]: Yeah.Rune Kvist [00:20:52]: Depending on how up to snuff they already are. So some people show up to us with, like, extremely rigorous security programs. When we test them, it works extremely well. We can get that done very quick. Some people come to us, and they're not that far along. We give them kind of the spec that they need to build towards, and then their security teams and engineers get to work and build to meet the standard. The testing itself typically takes a couple of weeks, including the time for them to remediate. Often, we'll find something that we cannot pass, where this is actually just not up to the standard. - you won't pass the standard. And then they will need to go and implement additional safeguards or additional remediation that makes them more robust so that they can actually kind of hand on heart look at their customers in the eyes and say, like, “Hey, we've done truly our very best.”Vibhu [00:21:35]: And they're certified for a year and have quarterly updates?Rune Kvist [00:21:38]: Correct, yeah.Vibhu [00:21:39]: And, yeah, it's pretty interesting. I think, you know, what's changed since. So this is certifying agents in production, right? Your customers, like you've had Lovable, ElevenLabs, Intercom, and they've all gone through this certification.Rune Kvist [00:21:50]: Yes.Vibhu [00:21:51]: What has changed? So I see you post, like, you know, Q2 added MCP agent,How Agent Risks Are Changing: Coding, MCP, and Agent-to-Agent InteractionsRune Kvist [00:21:56]: Yeah.Vibhu [00:21:56]: agent communication. Any other things that you want to kind of highlight since the first iteration? What comes in quarterly?Rune Kvist [00:22:03]: Yeah. So some of the changes have just been agents are not just one thing. So, like, if you take agents like Cursor and compare them to Sierra, they're really quite different. And compare them to Harvey again, compare them to you out of againSwyx [00:22:16]: ElevenLabs, yeah.Rune Kvist [00:22:17]: ElevenLabs, they're all quite different. And so we wanted to design a standard that works for all of the types of agents. And we started with one that was, like, pretty text-based, like, honestly, pretty customer support-focused. That's where there's a lot of existing demand. And then over time, we've picked, some of the frontier companies in each of these other domains that we could work with and build out the standard, so, such that we know that the same standard works for code, it works for customer support, works for automation, et cetera. So that's been one big thing. Yeah, then some of the things that have been top of mind recently, Mythos is bringing up a lot of concerns for security leaders. We're starting to get more and more questions around agent interactions. It's very nascent, at the moment, but it's starting to emerge. There've been a lot of, questions related to OpenClaw and MCP. Again, like agents starting to interact with each other, is really top of mind. Then as coding agents have really taken off, that's also where banks and hospitals, et cetera, are getting more and more precise on what it is they need. So really dialing in as that start to be, like, where most of the tokens flow through in the world, getting much sharper on that.Vibhu [00:23:26]: Can you share for people that are listening that don't really think about this? Like you mentioned, there's the obvious stuff, you know, hallucination, citations. What are best practices that people should do when building agents? Like, if they come to you pretty ready with certification like, you know, they'll probably pass certification. What are the things people don't think about that they should have?Best Practices for Agent Builders: Stress Tests and GuardrailsRune Kvist [00:23:46]: The most important thing is that a lot of companies have not done a serious stress test. They spend most of the time, perhaps rightly so, optimizing for how does it work in the good case, the average case, how high-quality is the output for the customer. And a lot of these companies are pretty new, so they haven't spent a lot of time stress testing the what is there as an adversary on the other side? What are some of the complicated corner cases that you've not really considered? So I think that's, like, a frame of mind. And you'll also see this in startups. It often takes a while until they hire their first security person. They- And that's a whole different kind of risk surface than just building a good product. So a lot of that applies. Most companies actually also have the right kind of architecture. Most of them will have some kind of guardrails in place, either some that come out of the box from their model provider or they'll have built their own filters that sit in between. They just don't work very well. The difference between putting a classifier in place that, like, maybe goes and checks whether you're giving medical advice when you shouldn't and says, “Hey, if this looks like medical advice, filter it out.” Lots of companies have that in place. The question is whether it works. And it's actually pretty fiddly to sit down and think about all the ways in which you could ask for medical advice, read the academic literature on what are the kinds ofRune Kvist [00:25:03]: Framings or tricks you might play to get an AI to give you medical advice when you really shouldn't. And so there's, like, an area of expertise that's just missing. So what we find is that most people have the right building blocks in place. They don'- It doesn'- It's not rocket science, but the finicky thing is, like, getting into the corners and testing whether it works such that you can look your customers in the eye, or maybe a bank or maybe a hospital and be like, “This is going to work for you.”Vibhu [00:25:26]: I see. So we talked a lot about the agent-level certification. Where do you guys go from here? So announcing series A camera, we talked about this a bit. There's the whole security risk of Fable, government stepping in. You guys are kind of announcing that you're also going into model certification?Toward Model Certification: The Government–Lab Trust GapRune Kvist [00:25:46]: When we do a bit of cutting afterwards,Vibhu [00:25:48]: YeahRune Kvist [00:25:48]: We will not yet be announcing this,Vibhu [00:25:49]: NiceRune Kvist [00:25:50]: The question that is top of everyone's minds now is at the model level. And Mythos, then Fable, has really brought this to the fore that in addition to the commercial risk and the kind of economic security risks that are happening at the agent layer, the models are going to present risk in the national security category. The shape of the problem is very similar. You have some people that are on the hook if something goes wrong. In the case of agents, it's often security leaders in the enterprise. In this case, it's the government. They don'- haven't necessarily spent their entire lives thinking about what are the new risks that come here, what is the kind of data you might be looking for, how might you test that? But they do have to make sure that their concerns are addressed. You have some frontier AI companies that are deeply technical. They know a lot about the risks, but they fundamentally have an incentive to not always be truthful. So you have a trust gap between the government and the labs. And in every other industry, you end up with some kind of body sitting between, a neutral third party sitting between those people. There's no other industry where you allow people to audit themselves. So there is going to be a need for a third party that can take the rigor of the labs to run frontier technical evals, but can also speak legible trust in the way that the government trusts PwC to go and run financial audits. And they know that they output audit reports in a way that's consistent, that's easy to read, that's factual, that's, trustworthy. Those two things need to be brought together. And what we've learned from our work with agents is that if you want those-- that communication between those two parties to be smooth, there has to be one common standard that is public, that people can go and inspect. What are the risks that matter? Within each of these risks, what are the kinds of threat models that you're really looking for? You need to specify for each of those risks, what are the guardrails that need to be in place, and what are the tests they need to run to see whether those guardrails are effective? And then you need to go and run audits that are - technical audits that are consistent. So if you're trying to bring trust, it's extremely important that you methodically work your way through the risks. You can't send one researcher in and say, like, “Come back with whatever you find.” You need to be able to explain exactly what you did, exactly what you tried, exactly what you did not try, and therefore the kinds of promises you can and cannot make at the end of it. I think ofNeutral Third Parties, CAISI, and Model Risk AuditsRune Kvist [00:28:13]: Fable as a direct symptom of this problem that the government was told that there's a risk. The government may struggle to assess just how big that risk is. They call Anthropic, and Anthropic is trying to tell them, “Hey, actually, every model can be jailbroken.”Swyx [00:28:28]: That's not what you want to hear, right?Rune Kvist [00:28:32]: As the government, that might be hard to trust.Rune Kvist [00:28:36]: And we think that a broker is the most natural solution. In other markets, you see something like, in financial markets, you see Moody's. Moody's goes in, and they look at a bond, and they output a rating. They say like, “Here's the evidence we found. Here's the rating.” We don't decide whether anyone should buy this bond or not buy this bond. Well, that depends on their risk appetite. But we do provide this common information layer that everyone can rely on. In the case of Moody's, the government, points to them and say, “Hey, pension funds, you should probably really take care. You shouldn't risk your pensioners' money, so you can only invest in triple-A rated bonds.” That means that now the government doesn't have to staff thousands of financial technical experts to rerun forecasts every week to see whether things are correctly rated. They get to point to some neutral third party. So my hypothesis is, my hunch is that you will see a third party that sits between the government and the labs, and it could either be the government builds it themselves. So something like CAISI was set up to do exactly this. And the questionSwyx [00:29:44]: Sorry, I'm not familiar with CAISI.Rune Kvist [00:29:45]: CAISI is the Center for AI Standards and Innovation.Swyx [00:29:49]: Okay.Rune Kvist [00:29:50]: I won't get into the details, but it's a body of NIST that typically sets standards. So it's basically a government body that has AI experts. Yeah, exactly. Exactly.Swyx [00:29:59]: Very key. Very key.Rune Kvist [00:30:00]: Very key.Vibhu [00:30:00]: I think, you know, it's one of those things where when you just sit back and listen-- look at it, like, is there enough technical expertise in the government to measure, test these things right now? Probably not, right? And Fable is a result of, okay, we've had to scale back and pause things,Rune Kvist [00:30:17]: Yeah. And they have excellent people, but they have an extraordinarily small budget compared to the scale of the challenge that's ahead of us. And I think they have a role to play. The question is kind of like, who does what? We have now outlined the jobs to be done, and they're quite extensive. Every model release, there is an astounding-- Given that they take in any input, their risk surface is astounding. And so the question is really: what can only the government do, and what can the market provide here that can keep up with the pace as AI risk changes? Our perspective is that also at the model layer, the risks that people care about today are not the same ones they cared about three months ago. So the pace of legislation is too slow to deal with pinpointing the risks here. And so we think there's a lot that the market can do to surface timely information. Ultimately, there is a bunch of policy decisions here. Is the national security risks of a model too high?Swyx [00:31:12]: Yeah.Rune Kvist [00:31:12]: That's a political answer. But what we want to make sure is that the process that produces this risk information is compatible with very fast innovation. So you don't want to. This is not a question of like, can you slow the things down? Can you keep, the models locked up until-- for months on end until everyone can make a guarantee? But it is this, can you, in the time it. Given that the US is competing with China on releasing models, can you insert risk information that allows the government to, like, make rapid decisions on some of these questions? Balancing that trade-off between failing to adopt AI is going to put us at risk, but also reckless adoption is going to put us at risk. And that's a very kind of fine balance that they're going to need, like, a lot of high-quality intelligence to make.Chinese Models, Data Flows, and National Security ConcernsSwyx [00:31:55]: Just a side mention, because you mentioned Chinese models, any specific concerns that you're hearing from your CISOs about that? ‘cause I guess it's free, but.Rune Kvist [00:32:05]: CISOs have a bunch of concerns around data flows in general that they're really concerned about. So there's a lot of questions like, if these models are Chinese, where does that, where does that data go? I think a lot of this can be addressed, but they come up often.Swyx [00:32:18]: I mean, they understand they're running on American GPUs.Rune Kvist [00:32:21]: Some of them, some of them understand that they're running on American GPUs.Swyx [00:32:23]: They're not, like, phoning home every time you, like, call home.Rune Kvist [00:32:26]: No. A year ago, there was not a lot of understanding of this. I actually think, you're seeing the security leaders becoming kind of AI literate at a blistering pace, and you're actually also seeing my Twitter timeline that's very pilled and my LinkedIn feed that used to not at all be pilled kind of converge. They're both talking about Fable.Swyx [00:32:45]: Right. Yeah, that's true.Rune Kvist [00:32:46]: They are both talking about whether you can prevent models from being jailbroken these days.Swyx [00:32:51]: Yeah.Rune Kvist [00:32:52]: Like national security national security risks are now the conversation that is actually emerging. Other than that, I think you mostly see a kind of general picture: there are no concerns with any particular model or any particular model output, but there is a general nervousness of having critical infrastructure run on models that are not produced in America by Americans where the American government has control.Swyx [00:33:14]: But it doesn't necessarily show up in your framework that directly, or it might, I don't know.Rune Kvist [00:33:18]: There's a bit of stuff in there actually on the, like, the provenance of the models and disclosing that. But I think there's a bunch of use cases where running a Chinese open-source model is just the best solution.Swyx [00:33:27]: Yeah.Rune Kvist [00:33:27]: And a concern is slightly more macro here, which is not best addressed at any particular certification level.Vibhu [00:33:32]: Is there anything interesting that you see at the. You know, if you're trying to fill that middle gap, that mediation gap, any interesting stuff that you guys forecast would be required other than, you know, what the average person might expect?Cyber, Child Safety, Bio Risk, and Expert CoordinationRune Kvist [00:33:47]: There's a bunch of interesting questions about what are the risks that matter here. So right now, the risk of the day is cyber, because it's very real, very tangible. And some of the risks that are also emerging as pretty real and pretty tangible are things like child safety is becoming both extremely important, but also politically important. And then there are some of the risks that are coming down the pipeline that today feel kind of speculative, but people who spend a lot of time with the models see them coming down is things like, risks that relate to biology.Rune Kvist [00:34:18]: And specifically whether models will help adversaries produce biological weapons and making that extremely cheap, extremely accessible, producing-- making the chance of another COVID or worse pandemic. COVID was not engineered to be bad, as if you were trying to do that. So I think those are some of the risks that are coming down the pipeline. I think one other thing to just note is that agents are kind of deliberately narrow. So, like, when a frontier agent company puts a chatbot that interacts with customers, they've really tried to narrow the topics it's interested in talking about. Such that if you ask it, like, “What do you think of the president?” it will just decline, which means that the kind of risk area is somewhat smaller. For models, it is infinite. And so there's not a single expert out there who can competently evaluate the risks of cyberattacks and fifteen-year-olds having month-long conversations with a chatbot and seeing whether it will in fact recommend suicide or something horrendous like that, and can evaluate the risks that terrorists can use AI to produce bioweapons. The risk surface is just too big. And so the central challenge actually becomes how do you get those subject matter experts to work within a one coherent framework that outputs one coherent report and rating that the world can go and inspect? ‘Cause that global perspective is central, but there's not a single organization today that could produce that.Swyx [00:35:47]: And you would be the presumptive one when you put out your model standards.Rune Kvist [00:35:51]: We think there can be one company that can, with a consortium of experts, build one coherent standard. I think we've shown that across all of the enterprise risks today. We think it could be one company that could, with a consortium, specify the audit rules, basically like the inputs and outputs that all these technical experts need. What access do they need? How should they treat infosec- info security? They can look at whether the eval- evals are well-produced without necessarily being able to say, “Hey, is this a threat or not a threat?” But overall, evaluating whether the evals are good, well-constructed, that set of audit rules that basically becomes the interface for all these experts, we think one clearinghouse could put together. To be clear. When I say one company, I think of it as one company coordinating lots of this in the same way that when we saw our consortium, it's not like we say we have all the answers on agent security. What we say is we are taking on the role of eliciting all of the concerns and being the secretary that puts it together and runs a tight house such that the standard updates lockstep every quarter, and that the audit reports that come out, in this case, 100-page audit reports, uniform and crisp and clear all to the level of detail that is required for executives that need to make a clear go/go decision. So that's kind of the role that we think we might play.OWASP, Frameworks, and the Operational Audit LayerSwyx [00:37:11]: I think in many ways you're performing the role that OWASP used to do there, and you said, like, you know, competition and partners.Rune Kvist [00:37:18]: Yeah.Swyx [00:37:19]: Can you go more into, like, how they partner?Rune Kvist [00:37:20]: Yeah. So first of all, OWASP is basically an open source community of security practitioners that are coming together to build frameworks for addressing the latest security concerns. We think they are phenomenal at creating frameworks. We'- In fact, we'- First of all, we're partners with them, so we have a joint article. Two, we've learned a lot from them. We think they're a tremendous source of intelligence. What OWASP does not do is building the machine that runs third-party audits such that a company like Cursor or a company like JPMorgan could get a third party to go and review them against this and say, “Hey, you've passed the standard, and here is the report that you can use to build trust and preempt your partners' or customers' questions.” So they fundamentally try to do something different. You - They are part of the information gathering and intelligence gathering and creating clarity, but the operational layer of turning this into promises is not the business they try to be in.Swyx [00:38:14]: The standard is emerging and is doing very well. Was it necessary to then also do underwriting? Obviously it's in the name, so please remember you thought about it first. I feel like if you just have enough consensus, you don't actually need the money angle, but it does help.Vibhu [00:38:30]: I did want to also note, you guys are a profit company too, right? It's not profit where there's a whole business side to it as well?Why For-Profit Standards and Insurers MatterRune Kvist [00:38:39]: Yeah. Yeah, so I'm just getting crazySwyx [00:38:41]: I think about the money part.Rune Kvist [00:38:42]: Yeah. Yeah, let's get into the money part. Let's start from actually your question, profit versus profit. In the security space today, cybersecurity, most of the standards are produced by nonprofits. I think that's an issue.Rune Kvist [00:39:00]: The question you have to ask yourself is, how do you create good incentives for these standards to be good and keep up?Rune Kvist [00:39:09]: Nonprofits tend to not have these adverse profit incentives where they, hollow out their standard and create a race to the bottom, but they're also not at all responsive by default to the communities that they serve. There's no process-- They don't have customers that they serve where they go and ask, “What do you want? What do you want? What do you want?” And when you look at the overall satisfaction with the security standards today, people tend to just not like them very much. You do see in other domains, that profit standards can serve the world quite well. So there are examples, like we talked about Moody's before. It's not without flaws, but, it is absolutely critical societal infrastructure that gets run at an astounding scale today. Your credit score, it's FICO. It's also a profit business. And when you go back even further in history, some of the crash testing standards came out of insurance companies.Rune Kvist [00:40:06]: The insurance companies together founded the Insurance Institute for Highway Safety because they were very interested in, like, how can we use standards to drive down mortality and save money? Go back, prior-- Our name actually pays homage to the Underwriters Laboratories, UL, which, was started right around when electricity came out. Houses started burning down. Insurers, again, were paying the bill, and they were maybe also good people, but their profit incentive was, let's prevent houses from burning down. Let's test all the electrical products, the light bulbs. All the light bulbs in here are probably tested, the toasters, et cetera. And they set up, an entity to create those standards. Today, UL has a profit entity and a profit entity. What they've recognized, they spun - They started profit. They spun out a profit because what they recognized was like, hey, actually to serve customers well, you need a profit entity. The lesson here is one of the ways that the market can align incentives so you're both responsive to customersRune Kvist [00:41:07]: And not hollowing out your standard over time is to align it with insurers because they fundamentally have good incentives. And so if you're a profit standard that works closely with insurers, you get the feedback loop in such that you're really tuned into your customers, but also have their interest at heart. So that's the model that we - the kind of inspirational model that we've learned a lot from, and that's also where the name comes from. In some ways, the term underwriting can both be associated with insurance, but it's also a broad term for, like, making decisions.Rune Kvist [00:41:40]: If you underwrite a decision, you're fundamentally kind of taking ownership for the consequences of it.AI Insurance Contracts, Lloyd's of London, and ElevenLabsSwyx [00:41:45]: Yeah, I mean, what does an insurance contract look like for AI?Rune Kvist [00:41:49]: Yeah. Most of the demand comes today for insurance contracts is, sitting between people who've built AI and people who are buying AI.Swyx [00:41:56]: Yes.Rune Kvist [00:41:57]: And what you want—the reason why people want insurers involved, both for the traditional reasons, hey, if something goes wrong, we want to be compensated, but it's in particular because insurers can bring trust to the equation. Because insurers will pay for the damages, if they're willing to write an insurance policy, that is them saying, “Hey, we think there is risk here, but that is manageable.” And that is kind of a. Their incentive aligns with the enterprises adopting it, so that's a really a good signal to the market. In the same way, actually, one of the things that Waymo tried to get their first permit to even operate in San Francisco was to get a lot of insurers to stack up a huge insurance policy. In the case if something went wrong, not because Google can't pay, but because it was very valuable to have a third party go and look at that dataRune Kvist [00:42:47]: That are trusted by governments, trusted by enterprises as conservative people and say, “Hey, we've looked at it. We're actually willing to take some of this on our balance sheet.” So that's, that's kind of the reason why people are interested in it. What it looks like is, in some ways like every other insurance contract. You specify what are the perils you want to cover, how much do you want to cover them, like up to what limits, and what does it cost to cover that. And in the case of, if we take a really concrete example, ElevenLabs, bought a first of its kind AI agent insurance policy. They work with some of the biggest, enterprises that work with governments. They're really interested in going above and beyond and making promises to their customers. So they wrote a policy that covers just some of the core concerns that their customers have been asking about. And, the crucial thing was really to get Lloyd's of London, the world's oldest insurer, one of our partners, to look at this data and be that third party alongside us to say, “Hey, we think there's something here that's worth underwriting.” and that's actually what it looks like. And so they will show that contract to their customers, and they can see how much they're covered for. They can see what exactly it covers, and that will also probably change next year. They will want to write an insurance policy that might cover more.Swyx [00:44:04]: When you say Lloyd's, is it reinsurance, or are they sharing somehow at the same level orRune Kvist [00:44:11]: Yeah. So typically, the way, new companies get into insurance is that they partner with insurers such that the insurers take the majority or all of the financial risks. Fundamentally, if insurance is useful, because it brings trust, you have to be able to pay the bill. Lloyd's of London is 400 years old. They've never not paid a claim. They're extremely trusted. What Lloyd's of London struggle to do on their own is to figure out which of the risks are real, what should we be looking for, what are the kinds of technical controls, and running the tests. So they use AIUC-1 as kind of the underwriting framework, and we produce a bunch of eval results that then directly feed in to inform the pricing. So this means that ElevenLabs customers know that payment will be there. They don't have to look to our series A and see, like, do we think they have enough cash on the balance sheet? They will look at Lloyd's.Swyx [00:45:05]: Yeah.Rune Kvist [00:45:05]: Yeah.Swyx [00:45:05]: And Lloyd's, like, famously very creative. I think I remember some headline like, they insured Jennifer Lopez's, butt or something.Rune Kvist [00:45:13]: Correct.Swyx [00:45:13]: Right?Rune Kvist [00:45:13]: And I think, was it, David Beckham's right foot?Swyx [00:45:16]: So, yeah. Right?Rune Kvist [00:45:17]: And stuff like this.Swyx [00:45:18]: So, like, clearly not a large data set.Rune Kvist [00:45:22]: Exactly. It's actually a remarkable institution that's both kind of has some of the truly school virtues of having been around for a long time. They, like, really. They really operate like a trusted entity, and they have appetite to figure out the future. And I think there's a lot of recognition that both there is, like, tremendous amount of risk in AI that is poorly understood today, so getting into this business carries real risks. But also this is where lots of the risk exposure will happen in the future. This is the one market where risk is truly growing. This is the one market that will also take out some of the existing markets. Take, like, auto insurance. When there are no human drivers, how's that market going to look? Well, it's clearly going to change. How are you going to assessSwyx [00:46:08]: You want to insure Waymo?Rune Kvist [00:46:10]: I. All I'll say is the principles for how you insure Waymo are very similar to how you insure other kinds of AI.Swyx [00:46:15]: Right.Rune Kvist [00:46:15]: So again, crash testing, that's what we do for customer share at Lovable. That will also need to happen for Waymo, which is not how you do it for human drivers. So there's this growing awareness that the world is changing very fast, and the only way to learn how to underwrite AI is to write some policies. You may incur some losses and think of that as R&D expense, really. But the question for them is, like, who are the trustedtechnical partners they can get into this business with that can help them navigate and make sure they don't make, kind of foolish mistakes? But also who is willing to hear the wisdom that they have? They've done this before. They've seen it was. They were there when cyber came out. So there are lots of ways in which AI feels completely new, but there's also lots of ways in which risks look the same. And so there's actually a tremendous amount of wisdom sitting in some folks that may have gray hair, but really have, like, a keen sense of, how to quantify risk.Swyx [00:47:08]: Yeah. And the number is. So it's basically like I want fifty million dollars worth of coverage against these perils, and Lloyd's will give you a quote on it, and then you have, like, a small markup or something, and then you turn it around and do that? Is that as simple as it is?Risk Capital, Premiums, and Working with InsurersRune Kvist [00:47:23]: You basically share some of that premium.Swyx [00:47:25]: Yeah.Rune Kvist [00:47:25]: X percent goes to the people who do the pricing of it.Swyx [00:47:28]: You're. It's kind of like a. It's kind of like a merchant bank for insurance type of thing.Rune Kvist [00:47:33]: Exactly. You basically split the fee, and you can think of the insurance supply chain as, like, there's bringing the capital, there is doing the pricing, and there is doing the distribution. And typically, you will pay out some X percent of premium here, Y percent of premium here, and the rest of it will go here.Swyx [00:47:46]: Does all the insurance world work like this, or is there some point at which, like. So if right now you have equity capitalRune Kvist [00:47:51]: Yeah.Swyx [00:47:52]: At some point, maybe you start raising, debt or whatever, and then you have enough of a bank account and enough history, let's say you've been in operation for ten yearsRune Kvist [00:48:00]: Correct.Swyx [00:48:00]: That you don't need Lloyd's anymore?Rune Kvist [00:48:02]: That's totally an option. And I could see some worlds where that makes sense, specifically if there are risks that we feel high confidence that we'd want to insure where the incumbent insurers are too slow to find appetiteSwyx [00:48:13]: Okay.Rune Kvist [00:48:13]: Or simply struggle to evaluate it such that they don't want to do it. But by and large, in general, you do not want to compete with insurers on, bringing risk capital to the game for two reasons. One is that's fundamentally a cost of capital game. They have extremely low cost of capital. Startups have high cost of capital, by and large. And two, you want to hedge your bets, and it's very helpful then to also have a portfolio of home insurance, of car insurance. And we're not about to become a car insurer nor a home insurer.Rune Kvist [00:48:43]: So they have some natural advantages, which makes it much more likely that we'll partner.Swyx [00:48:48]: Yeah.Rune Kvist [00:48:48]: And they bring that, the capital at scale, and we bring the technical expertise.Swyx [00:48:51]: You're, you're going to work with them for a long time.Vibhu [00:48:52]: How are the discussions with the insurers as well? So basically, they're going off of your certification, right? They're trusting the diligence on you that your certification is valid, you tested the right things, and they're backing the money that, you know, you have the right testing in place. So any interesting takeaways from working with insurers?Rune Kvist [00:49:12]: I think the maybe the first thing is they feed into the standard as well. So if there are things that they feel like they need that they're not seeing, we are also taking that as input into the standard, because fundamentally we think a good standard is one that creates a really healthy promise ecosystem, and we think insurers are a critical part of that. And again, they are the most well-incentivized to. They see all the lost data across every. Any particular CISO knows their particular concerns. Insurers see the concerns across the entire portfolio and often have direct access to, like, what exactly happened, who was at fault, et cetera, as they do part of their forensics. So they're actually, like, a great source of intelligence on this. One of the big takeaways from cyber insurance, which is a market that didn't work that well, was that the insurance and the technical expertise was not married up. What our conviction is that standards have to precede insurance. Fundamentally, what everyone first and foremost want, whether you're a CISO at JPMorgan or a CISO at Cursor or an underwriter at Lloyd's of London syndicate, is you want to not have an incidentRune Kvist [00:50:19]: In the first place. You want to know that the risk is well-managed, and only then does insurance start to make sense. So we'll see the standard ecosystem basically run ahead of the insurance. And the reason why we. You asked us kind of why I also do insurance, this is kind of proving what we think a whole promise confidence infrastructure ecosystem needs to look like, and we think it's very compelling to bring that to life, even if we think the standard is kind of the core linchpin that unlocks the rest.Claims, Liability, Air Canada, and Duty of CareSwyx [00:50:44]: There's been no claims yet, right?Rune Kvist [00:50:45]: Nope.Swyx [00:50:46]: This is one of those things where, you know, if people haven't really worked through what it means to cover things.Rune Kvist [00:50:52]: Yeah.Swyx [00:50:52]: So for example, I pay Cursor $20 a month.Rune Kvist [00:50:55]: Yep.Swyx [00:50:56]: And I write a vibe code something that makes, a plane crash, causing $200 million worth of damage.Rune Kvist [00:51:02]: Yes.Swyx [00:51:02]:

⬥EPISODE NOTES⬥Something structural is shifting in how security work gets done. When anyone on a team can stand up a working tool in an afternoon, the constraint stops being capability and starts being coherence. John Linford, Security Portfolio Director at The Open Group, spends his time on exactly that problem, running the Security Forum, the Open Trusted Technology Forum, and the Assured Dependability Work Group, where practitioners from organizations of wildly different sizes argue their way toward standards that are supposed to survive contact with reality.His framing of the tool question is blunt and worth stealing. When a team says it can build the thing, the first response is to ask what decision the thing informs. A dashboard showing numbers nobody was looking at before is not a security improvement, it is a new source of numbers. Standards, in this reading, are not compliance artifacts to be shown to an auditor. They are the thing that tells an organization which part of the problem a tool is supposed to solve, and how it fits alongside everything else already in place. The corollary matters just as much: when the tools themselves conform to a standard, vendors compete on the value they actually deliver rather than on the cost of switching away from them.Linford takes the same argument up a level to architecture. Security architecture only works when it sits inside a broader enterprise and IT architecture rather than beside it, and that requires a CISO with genuine authority and a seat at the executive table. Where that authority is thin, The Open Group's Security Forum has leaned on the idea of security champions, people embedded across teams who do not need deep security skills but do need to know when to pull a specialist into the room. Getting that right moves the security conversation into the design phase, which is the only place it is cheap.The scaling question gets an honest answer. The Open Group operates on one vote per member organization, which means a three-person shop carries the same weight in a final standard as Microsoft or RTX. That structure forces the standards to be implementable by organizations that have no security architect at all, and it shows up in deliberate choices like defining roles rather than job titles, because in a small company one person wears eight of them.Then there is zero trust, which Linford describes with a line that circulates as a running joke inside the Security Forum: it is just what cybersecurity should have been from the beginning. The Zero Trust Commandments trace directly back to the Jericho Forum's deperimeterization work from the 1990s, and they fit on a single page on purpose. Secure assets according to their value and the damage their compromise would cause, and the spending priorities sort themselves out. The alternative, as he puts it, is announcing you will implement all five hundred-odd controls in NIST 800-53 and wishing yourself luck.His closing point is the one most likely to sting. Security practitioners are fluent in security and frequently illiterate in business. Telling a board that twenty controls are required for conformance with the EU Cyber Resilience Act invites one question about cost. Telling them the same work opens a market and removes a year of analysis before expansion is a different conversation entirely, about the same twenty controls.⬥GUEST⬥John Linford, Security Portfolio Director at The Open Group | On LinkedIn: https://www.linkedin.com/in/johndouglaslinford/⬥HOST⬥Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/⬥RESOURCES⬥The Open Group | https://www.opengroup.org/The Open Group Security Forum | https://www.opengroup.org/forum/security-forum-0Zero Trust Commandments | https://pubs.opengroup.org/security/zero-trust-commandments/Zero Trust Architecture at The Open Group | https://www.opengroup.org/forum/security/ZerotrustThe TOGAF Standard, 10th Edition | https://www.opengroup.org/togafOpen Trusted Technology Forum | https://www.opengroup.org/forum/trusted-technology-forumThe Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/⬥ADDITIONAL INFORMATION⬥

⬥EPISODE NOTES⬥Something structural is shifting in how security work gets done. When anyone on a team can stand up a working tool in an afternoon, the constraint stops being capability and starts being coherence. John Linford, Security Portfolio Director at The Open Group, spends his time on exactly that problem, running the Security Forum, the Open Trusted Technology Forum, and the Assured Dependability Work Group, where practitioners from organizations of wildly different sizes argue their way toward standards that are supposed to survive contact with reality.His framing of the tool question is blunt and worth stealing. When a team says it can build the thing, the first response is to ask what decision the thing informs. A dashboard showing numbers nobody was looking at before is not a security improvement, it is a new source of numbers. Standards, in this reading, are not compliance artifacts to be shown to an auditor. They are the thing that tells an organization which part of the problem a tool is supposed to solve, and how it fits alongside everything else already in place. The corollary matters just as much: when the tools themselves conform to a standard, vendors compete on the value they actually deliver rather than on the cost of switching away from them.Linford takes the same argument up a level to architecture. Security architecture only works when it sits inside a broader enterprise and IT architecture rather than beside it, and that requires a CISO with genuine authority and a seat at the executive table. Where that authority is thin, The Open Group's Security Forum has leaned on the idea of security champions, people embedded across teams who do not need deep security skills but do need to know when to pull a specialist into the room. Getting that right moves the security conversation into the design phase, which is the only place it is cheap.The scaling question gets an honest answer. The Open Group operates on one vote per member organization, which means a three-person shop carries the same weight in a final standard as Microsoft or RTX. That structure forces the standards to be implementable by organizations that have no security architect at all, and it shows up in deliberate choices like defining roles rather than job titles, because in a small company one person wears eight of them.Then there is zero trust, which Linford describes with a line that circulates as a running joke inside the Security Forum: it is just what cybersecurity should have been from the beginning. The Zero Trust Commandments trace directly back to the Jericho Forum's deperimeterization work from the 1990s, and they fit on a single page on purpose. Secure assets according to their value and the damage their compromise would cause, and the spending priorities sort themselves out. The alternative, as he puts it, is announcing you will implement all five hundred-odd controls in NIST 800-53 and wishing yourself luck.His closing point is the one most likely to sting. Security practitioners are fluent in security and frequently illiterate in business. Telling a board that twenty controls are required for conformance with the EU Cyber Resilience Act invites one question about cost. Telling them the same work opens a market and removes a year of analysis before expansion is a different conversation entirely, about the same twenty controls.⬥GUEST⬥John Linford, Security Portfolio Director at The Open Group | On LinkedIn: https://www.linkedin.com/in/johndouglaslinford/⬥HOST⬥Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/⬥RESOURCES⬥The Open Group | https://www.opengroup.org/The Open Group Security Forum | https://www.opengroup.org/forum/security-forum-0Zero Trust Commandments | https://pubs.opengroup.org/security/zero-trust-commandments/Zero Trust Architecture at The Open Group | https://www.opengroup.org/forum/security/ZerotrustThe TOGAF Standard, 10th Edition | https://www.opengroup.org/togafOpen Trusted Technology Forum | https://www.opengroup.org/forum/trusted-technology-forumThe Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/⬥ADDITIONAL INFORMATION⬥

Send us Fan MailA compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what's happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “validated.”We walk through the practical CISSP Domain 3 lesson behind the noise: the difference between an algorithm claim (we use AES-256), a configuration claim (we run in FIPS mode), and an evidence claim (we hold an active FIPS 140 validation on the CMVP list). With FIPS 140-2 certificates moving to historical status and FIPS 140-3 testing queues stretching beyond 500 days, the manager move is not wishful thinking. It's documenting the gap, treating it as risk, and getting formal risk acceptance with executive sign-off plus a real remediation plan, especially if you're facing CMMC or customer security assessments.From there we connect the dots across cryptographic life cycle management, cryptographic agility, and the real places crypto fails: key management and implementation. We cover HSM storage, rotation, dual control versus split knowledge, PKI revocation choices (CRL, OCSP, OCSP stapling), common cryptanalysis categories, and why side-channel and fault-injection attacks hit modules rather than “the math.” We then get clear on quantum risk, harvest now decrypt later, and what NIST's post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) mean for your migration plan starting with a cryptographic inventory.Subscribe for more CISSP exam-ready training, share this with a teammate who owns compliance evidence, and leave a review if it helped. What would fail first in your environment: the crypto itself, or the proof you can show an auditor?Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox!  Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

* Questioning 9/11 - 25 Years Later: This week Fred Williams and Doug McBurney recall the events of 9/11/2001 and ask questions about negligence, incompetence and/or outright responsibility for the attacks by the US government.   * Credible Evidence: While many dismiss the reports of the 9/11 Commission, FEMA, and the NIST, we hold the evidence that people on both sides claim, (including credible reports from contrarian Engineers) up against Rob Stadler, PhD's six criteria for high confidence science.   * A Question of Trust: Combine a well placed suspicion of ambitious politicians alongside evidence that the American government effectively sponsored big lies about evolution, the big bang and atheism, and apparently bankrolled ugly, talentless modern "art" during the cold war, and may have given rap music its run via USAID funding, and one can understand why many common sense, Christian Americans are distrustful of the government.   * In The Beginning: Order your 9th edition of Walt Brown's amazing, enlightening, biblically sound book explaining why Earth (and the solar system) look the way they do!   * Sun Puzzles: Check out another one of Ellen McHenry's intriguing and enlightening books: Sun Puzzles - on all the curious facts about the Sun that point to an electric, (and not a nuclear) sun.   * Jesus Light & Design: Get the first in our series of Real Science Radio Teaching Books, all about how light and design point to Jesus Christ as the Creator and Savior of the world.   * Not So: Pick up a copy or two of RSR's 2nd in our series of Real Science Radio Teaching Books: "The List of Not So Old Things.," with all the "not so old things" Bob Enyart compiled over the years!

* Questioning 9/11 - 25 Years Later: This week Fred Williams and Doug McBurney recall the events of 9/11/2001 and ask questions about negligence, incompetence and/or outright responsibility for the attacks by the US government.   * Credible Evidence: While many dismiss the reports of the 9/11 Commission, FEMA, and the NIST, we hold the evidence that people on both sides claim, (including credible reports from contrarian Engineers) up against Rob Stadler, PhD's six criteria for high confidence science.   * A Question of Trust: Combine a well placed suspicion of ambitious politicians alongside evidence that the American government effectively sponsored big lies about evolution, the big bang and atheism, and apparently bankrolled ugly, talentless modern "art" during the cold war, and may have given rap music its run via USAID funding, and one can understand why many common sense, Christian Americans are distrustful of the government.   * In The Beginning: Order your 9th edition of Walt Brown's amazing, enlightening, biblically sound book explaining why Earth (and the solar system) look the way they do!   * Sun Puzzles: Check out another one of Ellen McHenry's intriguing and enlightening books: Sun Puzzles - on all the curious facts about the Sun that point to an electric, (and not a nuclear) sun.   * Jesus Light & Design: Get the first in our series of Real Science Radio Teaching Books, all about how light and design point to Jesus Christ as the Creator and Savior of the world.   * Not So: Pick up a copy or two of RSR's 2nd in our series of Real Science Radio Teaching Books: "The List of Not So Old Things.," with all the "not so old things" Bob Enyart compiled over the years!

Robotics is rapidly moving from specialized environments into everyday life—from drones supporting insurance claims and driverless vehicles operating on public roads to robotic-assisted surgery, rehabilitation and patient care. As these systems become more capable and autonomous, they also raise important questions about safety, liability, data, cybersecurity and trust. In this episode of the Get Plugged In Podcast, Dale Hall, Managing Director of Research at the Society of Actuaries Research Institute, speaks with Dr. Raymond Sheh, an AI Risk Management Researcher in NIST's Information Technology Laboratory, a Guest Researcher in NIST's Engineering Laboratory, and an Associate Research Scientist at Johns Hopkins University. They explore the current state of robotics, how AI is advancing robotic capabilities, the opportunities and risks emerging across insurance and healthcare, and the role that standards, testing and independent evaluation can play in determining whether robotic systems are safe and reliable. Dr. Sheh also shares his practical test for determining when robots are truly becoming intelligent. For actuaries and insurance professionals, understanding how robotics may affect liability, healthcare, data, cybersecurity and risk management will become increasingly important as these technologies evolve. Explore additional tools, research and resources from the Society of Actuaries Research Institute at soa.org/Research Institute and visit the Artificial Intelligence landing page to connect with AI enthusiasts and stay informed about the latest developments. Visit our Artificial Intelligence landing page Send us your feedback at AI-Insights@soa.org

Send us Fan MailDr. David Yashar, National Institute of Standards and Technology (NIST), talks about a new water heater design that helps keep pathogens at bay by raising the heat to at temperature that kills essentially all concerning bacteria. Normally these temperatures would be dangerously hot for human skin, so the new design cheaply and efficiently brings the decontaminated hot water back down to a safe temperature. This episode of Appetite for Construction is brought to you by Webstone. Protect the entire system with Webstone's NEW Sediment Filter. Its spin-down design protects against rust, dirt, sand and other suspended particles, while the multi-mode handle lets you filter, bypass, clean or stop flow. And with Webstone's Twist-to-Clear feature, accumulated debris can be flushed through the integrated hose drain, making service fast and simple. Plus, G-Union connections help simplify installation.Subscribe to the Appetite for Construction podcast at any of your favorite streaming channels and don't forget about the other ways to interact with the Mechanical Hub Team!Follow Plumbing Perspective IG @plumbing_perspectiveFollow Mechanical Hub IG @mechanicalhubSign up for our newsletter at www.mechanical-hub.com/enewsletterVisit our websites at www.mechanical-hub.com and www.plumbingperspective.comSend John and Tim your feedback or topic ideas: @plumbing_perspective

www.patreon.com/theconspiracypodcastThe first two episodes of this series told the story of the September 11th attacks. This episode turns to what's still argued about the World Trade Center collapse twenty-five years later, examining the physical evidence, the official NIST investigation, and the theories that have circulated since 2001.Sean, Eric , and Jorge work through NIST's official findings on the collapse of the Twin Towers — how the aircraft impacts stripped away fireproofing, why the structural failure took the shape it did, and the engineering behind it. They also examine the specific claims that have defined 9/11 conspiracy theories for two decades: reports of molten metal found in the wreckage weeks after the collapse, the speed at which the towers came down, the free-fall acceleration debate, and whether NIST's own data holds up against them.The episode then turns to World Trade Center Building 7 — a 47-story skyscraper that was never struck by an aircraft and collapsed that evening regardless. Building 7's collapse remains one of the most debated open questions connected to 9/11. The hosts cover NIST's official explanation, the competing University of Alaska Fairbanks engineering study that challenges it, and developer Larry Silverstein's "pull it" comment from a 2002 PBS interview, weighing what he has said the phrase meant against how it's been interpreted by skeptics since.The episode closes on the financial side of that day — the World Trade Center lease Silverstein signed six weeks before the attacks, and the insurance settlement that followed, both frequently cited in 9/11 truth movement discussions.New episodes of "9/11: Unanswered," The Conspiracy Podcast's series marking the 25th anniversary of September 11th, release every Tuesday through September 28th. Follow on Apple Podcasts and Spotify. Join the Patreon at patreon.com/theconspiracypodcast for early access and exclusive After Hours content.

Federal agencies can make the authorization to operate (ATO) process more efficient by treating security as an ongoing part of software development rather than a checklist to complete before deployment, according to Victoria Yan Pillitteri, cybersecurity lead at the National Institute of Standards and Technology. Speaking with GovCIO Media & Research at the Carahsoft DevSecOps Conference, Pillitteri outlined common misconceptions that can slow the ATO process, including treating authorization as a one-time compliance exercise or simply a hurdle to clear for approval. Pillitteri explained how NIST guidance gives agencies flexibility to tailor the ATO process to their specific missions, systems and risk tolerances rather than taking a one-size-fits-all approach. She also discusses how clearly defining roles and responsibilities, strengthening risk management practices and building security into software development from the beginning can help agencies streamline authorization while deploying software more efficiently and securely.

I'm Chris Thrall and welcome to my personal transformation podcast for those interested in self discovery and (mid life) awakening. Architect Richard Gage, founder of Architects & Engineers for 9/11 Truth, sits down with me to walk through the physical evidence he says NIST never adequately addressed: free-fall of Building 7, molten metal, iron-rich microspheres, symmetrical destruction of the Twin Towers ... Socials instagram.com/chris.thrall youtube.com/christhrall facebook.com/christhrall christhrall.com Support the podcast at: patreon.com/christhrall (£2 per month plus perks) gofundme.com/christhrall paypal.me/teamthrall Our uncensored content: christhrall.locals.com Mailing list: christhrall.com/mailing-list/ Life Coaching: christhrall.com/coach/

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we recap what behavioral health practice owners should know from day one of the HIPAA Security Conference. We discuss: The timeline for proposed Security Rule changes What practices must have documented in writing according to the current Security Rule Encryption being reasonable and appropriate in almost every practice environment Expanding risk analysis enforcement initiative to include risk management Why risk analyses are foundational, and what they have to include that a gap analysis doesn't Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Episode 618: HIPAA Security Rule Update—What We Know, What We Don't, and What You Should Do Right Now — Our previous update on the proposed HIPAA Security Rule changes, the regulatory uncertainty surrounding them, and why practices should continue strengthening their security under the current rule while the rulemaking process unfolds. Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources HIPAA Security Rule Notice of Proposed Rulemaking Fact Sheet — The Office for Civil Rights' summary of the proposed Security Rule modifications, including greater specificity for Risk Analysis, written documentation requirements, defined compliance intervals, and proposed changes to "addressable" implementation specifications. Unified Agenda Entry for the HIPAA Security Rule — The current federal regulatory agenda lists the rulemaking as a long-term action with final action anticipated in July 2027. This is a planning estimate rather than a legal deadline or guaranteed publication date. HHS OCR Guidance on Risk Analysis — Official guidance explaining the required scope and elements of a HIPAA Security Risk Analysis, why "addressable" does not mean optional, and how Risk Analysis provides the foundation for an organization's risk-management decisions. HHS OCR Security Rule Guidance Materials — A collection of official Security Rule resources, including OCR presentations on Risk Management and Recognized Security Practices, educational papers, and links to relevant NIST publications.

Introduction Most carriers can say how many AI pilots they are running. Far fewer can say where every automated decision in the business sits. That gap is the subject of this episode. Josh Hollander is joined by Karl Canty and Paul Laurent of Artefact, the global data and AI consultancy, for a working conversation about the four frameworks converging on US insurance: the NAIC model bulletin, California's ADMT rules, Colorado's algorithm governance regime, and New York's DFS circular letter. Paul argues that this combination has made US insurance the most completely defined AI governance environment anywhere, and that the scope reaches well past the AI programs carriers are proud of. Rules engines, credit scores, telematics feeds, and vendor models are all inside it. Karl's argument is that carriers moving on this for the first time are not first movers, they are late, and that the inventory work the rules force on you is the same work that makes your own data usable for growth. Guest Bio Karl Canty is Partner and US Insurance Lead at Artefact, where he is building the firm's North American insurance practice. He has spent about twenty-five years in insurance data, technology, and operations, including advisory roles at PwC and EY, a data and AI leadership role at EXL, and a partnership at Capco. He writes for Digital Insurance on where AI actually pays for carriers. Paul Laurent is Head of AI Risk and Data Trust at Artefact, running the firm's AI governance advisory practice across North America. He describes himself as a technical lawyer: criminal prosecutions early on, a master's in computer science, then a decade at Oracle translating regulatory obligations into working architecture, followed by identity, data security, privacy, and now AI. He has contributed to NIST framework work across cybersecurity, privacy, and AI risk management. Key Topics -The four timelines - New York in force since July 2024, an NAIC pilot ending in an AI systems evaluation, California live with enforcement from January 2027, and Colorado already amended toward California's standard. -Scope is wider than AI - California's rules reach deterministic tools and legacy rules engines, which pulls decades-old underwriting and claims infrastructure into the conversation. -The vendor chain is not a place to put the risk - The NAIC treats external consumer data and information systems, including credit scores and telematics, as the carrier's responsibility. -Compliance cannot be delegated to a third-party vendor. -Human in the loop rarely survives the test - California wrote three bright-line conditions for human review. In Paul's assessments, more than eighty percent of processes carriers describe as human-reviewed do not meet them. -Nobody can produce the inventory - The first question in every engagement is where the business makes significant decisions with automation. Paul gets the same answer every time: we have some, we don't know where all of it is, and there is probably shadow. -CalPrivacy is already staffed and fining - Roughly 150 complaints actioned, capacity for a hundred at a time, and eight-figure fines appearing. -Where the work turns into growth - Karl's case for entity resolution, a real AI roadmap, and a durable enterprise AI competency coming out of the same assessment that satisfies the regulators. -The pause happening right now - Paul's most governance-mature client has stopped agentic AI development until these questions are answered, and the conversation inside carriers has moved from the CIO to the chief data officer. Notable Quotes "The most completely defined spot on the global AI governance workspace right now is the US insurance industry." "The vendor chain for NAIC is explicit. You cannot delegate compliance responsibility to a third-party vendor." "I don't think that companies who are moving right now for the first time are first movers. I think you're already late." "If you could tech your way out of this problem, it would have happened already." Resources Guests: Artefact: https://www.artefact.com/ Karl Canty on LinkedIn: https://www.linkedin.com/in/karlcanty/ Paul Laurent on LinkedIn: https://www.linkedin.com/in/paullaurent/ Host & Organization: Joshua R. Hollander on LinkedIn: https://www.linkedin.com/in/joshuarhollander/ Horton International (USA): https://www.horton-usa.com/ Insurtech Leadership Podcast (LinkedIn Showcase): https://www.linkedin.com/showcase/insurtech-leadership-show Subscribe & Review If you enjoyed this episode, subscribe on your favorite platform and leave a review. The Insurtech Leadership Podcast is available on YouTube, Podbean, Apple Podcasts, and Spotify.

This episode of Disruption/Interruption features Poolad Imany, founder and CEO of Icarus Quantum, a company spun out of NIST that is building modular, room-temperature quantum links. Rather than chasing ever-larger monolithic quantum computers, Icarus is tackling the industry's cryogenics bottleneck by connecting smaller quantum modules together, similar to how classical data centers scale. The conversation covers the physics of cryogenic cooling, why quantum interconnects are the missing piece for utility-scale quantum computers, and what Icarus's move to Harvard and MIT clean room facilities means for its fabrication process. Imany also touches on the energy efficiency gains quantum computing could offer and where he sees the industry heading over the next decade. Key Takeaways: 3:35 — Who is Poolad Imany and what pulled him into quantum computing? 5:36 — What is broken about how the industry currently scales quantum computers? 6:49 – How does modularization solve the quantum scaling problem? 25:48 — When will quantum and AI converge, and what happens next? Quote of the Show (6:49):"Let's actually modularize this. Let's take these small modules and connect them in a quantum way to each other to make a bigger quantum computer." — Poolad Imany Join our Anti-PR newsletter where we’re keeping a watchful and clever eye on PR trends, PR fails, and interesting news in tech so you don't have to. You're welcome. Want PR that actually matters? Get 30 minutes of expert advice in a fast-paced, zero-nonsense session from Karla Jo Helms, a veteran Crisis PR and Anti-PR Strategist who knows how to tell your story in the best possible light and get the exposure you need to disrupt your industry. Click here to book your call: https://info.jotopr.com/free-anti-pr-eval Ways to connect with Poolad Imany:Company LinkedIn: https://www.linkedin.com/in/poolad-imanyCompany Website: https://www.icarusquantum.com/ How to get more Disruption/Interruption: Amazon Music - https://music.amazon.com/podcasts/eccda84d-4d5b-4c52-ba54-7fd8af3cbe87/disruption-interruption Apple Podcast - https://podcasts.apple.com/us/podcast/disruption-interruption/id1581985755 Spotify - https://open.spotify.com/show/6yGSwcSp8J354awJkCmJlD YouTube: https://www.youtube.com/results?search_query=disruption+%2F+interuuptionSee omnystudio.com/listener for privacy information.

IonQ's VP of Engineering and CTO, Cameron Chehreh, joins host Konstantinos Karagiannis to break down why the race to scalable quantum computing is accelerating far faster than expected. Bringing a pragmatic, classical compute mindset to quantum systems, Chehreh explains how IonQ is transitioning from traditional optical tables to chip-scale trapped-ion QPUs, bolstered by their SkyWater foundry acquisition to dramatically speed up silicon iteration. He also provides an exclusive update on the company's hardware roadmap, confirming that their 256-qubit system is currently in fabrication and on track as they march toward 10,000 qubits and cryptographically relevant scale before 2030.   Beyond hardware breakthroughs, the conversation tackles the urgent inflection point facing enterprise and public sector leaders. Chehreh details why executive orders and looming cryptographic deadlines mean organizations cannot treat post-quantum cryptography migration as standard IT patching. From real-world defense war-gaming and energy sector hybrid CPU-GPU-QPU pipelines to the complementary deployment of QKD and PQC, this episode delivers a high-stakes look at how quantum computing is leaving the laboratory to reshape modern infrastructure and AI workloads.   For more on IonQ, visit https://www.ionq.com/.Visit Protiviti at www.protiviti.com/US-en/technology-consulting/quantum-computing-services to learn more about how Protiviti is helping organizations get post-quantum ready.  Follow host Konstantinos Karagiannis on all socials: @KonstantHacker             Questions and comments are welcome!  Theme song by David Schwartz, copyright 2021.  The views expressed by the participants of this program are their own and do not represent the views of, nor are they endorsed by, Protiviti Inc., The Post-Quantum World, or their respective officers, directors, employees, agents, representatives, shareholders, or subsidiaries.  None of the content should be considered investment advice, as an offer or solicitation of an offer to buy or sell, or as an endorsement of any company, security, fund, or other securities or non-securities offering. Thanks for listening to this podcast. Protiviti Inc. is an equal opportunity employer, including minorities, females, people with disabilities, and veterans.  

Send us Fan MailIn this episode, Scott Kuhlman and Chasity Owens continue their NFPA 921 series with a breakdown of Chapter 7: Building Systems. They discuss how building design, construction methods, materials, concealed spaces, passive fire protection, and structural components can influence fire development, spread, and collapse. The conversation covers balloon-frame and platform-frame construction, lightweight wood trusses, fire barriers, steel protection methods including intumescent coatings, and the importance of comparing original plans with as-built conditions. They also explore heating systems, fuel types, flame sensors, rollout switches, and why fire-damaged equipment should be properly documented and preserved rather than operated at the scene. Along the way, Scott and Chasity share real-world fire service and investigation experiences and highlight practical resources such as NIST for continued fire investigation training and research.Thank you for listening! If you enjoyed the episode, give us 5 stars, hit the follow button, and subscribe on Spotify, Apple Podcasts, and anywhere you are listening in from. Follow us on social media!Instagram: @infocusfire_podcastLinkedIn: INFOCUS podcastFacebook: INFOCUS podcastTikTok: @infocus_podcast

In "Scaling Logistics Innovation at Descartes Systems Group", Joe Lynch and Dan Cicerchi, the General Manager of Transportation Management Solutions at Descartes Systems Group, discuss the strategic integration of trustworthy AI to enhance existing core logistics technology and solve practical pain points across the global supply chain. About Dan Cicerchi Dan Cicerchi is the General Manager of Transportation Management Solutions at Descartes Systems Group, where he leads strategy and innovation for one of the industry's most widely adopted logistics technology platforms. A seasoned entrepreneur and logistics tech pioneer, Dan co-founded MacroPoint, a real-time freight visibility solution that transformed how brokers, shippers, and carriers track and manage loads. Following its acquisition by Descartes, he has continued to champion technology that drives efficiency, transparency, and resilience across global supply chains. With decades of experience spanning startup growth and enterprise leadership, Dan is passionate about applying practical AI and automation to solve the freight industry's most pressing challenges. He frequently shares insights on freight visibility, fraud prevention, and the future of transportation management. About Descartes Systems Group Descartes Systems Group is a global leader in providing on-demand, software-as-a-service solutions designed to improve the productivity, performance, and security of logistics-intensive businesses. Headquartered in Waterloo, Ontario, with offices and customers worldwide, Descartes helps shippers, carriers, freight forwarders, and logistics service providers connect, collaborate, and automate across the supply chain. Its portfolio includes transportation management, visibility, customs and regulatory compliance, and e-commerce logistics solutions. By combining deep industry expertise with innovative technology, Descartes enables organizations to streamline operations, reduce costs, and deliver superior customer experiences. Thousands of companies around the world rely on Descartes' logistics network and software to move goods more efficiently, mitigate risk, and stay ahead in an increasingly complex global marketplace. Key Takeaways: Scaling Logistics Innovation at Descartes Systems Group In "Scaling Logistics Innovation at Descartes Systems Group", Joe Lynch and Dan Cicerchi, the General Manager of Transportation Management Solutions at Descartes Systems Group, discuss the strategic integration of trustworthy AI to enhance existing core logistics technology and solve practical pain points across the global supply chain. Trust First: AI adoption in logistics must be built on governance and trust, using frameworks like NIST to ensure data security and accountability. AI Augments, Doesn't Replace: AI is a powerful enhancer for core systems (TMS, visibility), not a standalone replacement. Its primary role is to improve efficiency. Focus on Practical Pain Points: Start AI implementation by targeting tedious manual tasks (e.g., check calls, data entry, carrier onboarding) for rapid, measurable ROI. Stability Over Startups: Partnering with existing, integrated tech vendors (like Descartes) ensures greater stability, expertise, and roadmap alignment than relying on new AI-only startups. Audit Your Current Tech: Before investing in new AI, ensure you are fully utilizing the latest features and integrations of your current mission-critical systems. Build Trust with Staff: Overcome internal resistance by layering AI into current workflows and establishing clear performance baselines (ROI) before deployment. Enhance What Works: The path to resilience is through strategically integrating AI into proven, existing workflows step-by-step, not by chasing every new technology trend. Learn More About Scaling Logistics Innovation at Descartes Systems Group Dan Cicerchi | Linkedin Descartes Systems Group | Linkedin Descartes Systems Group The Logistics of Logistics Podcast If you enjoy the podcast, please leave a positive review, subscribe, and share it with your friends and colleagues. The Logistics of Logistics Podcast: Google, Apple, Castbox, Spotify, Stitcher, PlayerFM, Tunein, Podbean, Owltail, Libsyn, Overcast Check out The Logistics of Logistics on Youtube

The National Institute of Standards & Technology (NIST) is expanding its DevSecOps research to explore how artificial intelligence can support software development and security workflows. Michael Ogata, a computer scientist at NIST, discussed how AI and large language models are being applied to coding, testing, security evaluation and vulnerability remediation. He also outlined NIST's emerging focus on agentic AI, including how organizations can establish identities and credentials for AI agents, authorize their actions and ensure those actions remain traceable to accountable human users.

Is operating under strict financial regulation an innovation killer or its greatest catalyst? Host Peter Smulovics (Distinguished Engineer at Morgan Stanley and FINOS Zenith Lead) sits down with Dr. Aditya Vikram Kashyap (FINOS Ambassador, IEEE Senior Member, and Forbes Technology Council member) for an insightful episode of the Open Source in Finance Podcast from the FINOS Zenith Special Interest Group. Innovation and regulation are often portrayed as opposing forces: innovation wants speed and freedom, while regulation introduces constraints and controls. But in financial services, and increasingly with AI, the reality is much more complicated. Good governance can actually make innovation possible at scale, while bad governance can become its own source of risk.Together Dr. Kashyap and Peter challenge the narrative that speed and control are opposing forces. Dr. Kashyap breaks down how regulatory frameworks like model risk management (SR 11-7) and NIST post-quantum cryptography (PQC) standards force architectural clarity, why the "cost of delay" is the most under-managed enterprise risk, and how to structure continuous governance for agentic AI fleets.

Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! In the security news this week: Sixteen-year-old Linux LPEs still work Ubiquiti UniFi, patch it, also light on details If you remember magicJack, you too are old Slovakia doesn't trust its own speed cameras More homework on NIST's vulnerability database Your webcam, mic, and key light, all owned Printer moonlights as Minecraft server Zombie credit cards Your car's infotainment system fuels botnets Feds warn about AI-powered PLC attacks Can an AI actually reverse engineer its way out? Denver International's security breach, volume six Charlotte's breach and a parking company Why your ancient tech might be the safe one Microsoft counts billions of phishing emails A password vault that leaked to any website Australia sells password books at the post office Another perfect ten, this time in Entra ID Cisco's bug scores read like Olympic gymnastics Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-941

Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! In the security news this week: Sixteen-year-old Linux LPEs still work Ubiquiti UniFi, patch it, also light on details If you remember magicJack, you too are old Slovakia doesn't trust its own speed cameras More homework on NIST's vulnerability database Your webcam, mic, and key light, all owned Printer moonlights as Minecraft server Zombie credit cards Your car's infotainment system fuels botnets Feds warn about AI-powered PLC attacks Can an AI actually reverse engineer its way out? Denver International's security breach, volume six Charlotte's breach and a parking company Why your ancient tech might be the safe one Microsoft counts billions of phishing emails A password vault that leaked to any website Australia sells password books at the post office Another perfect ten, this time in Entra ID Cisco's bug scores read like Olympic gymnastics Show Notes: https://securityweekly.com/psw-941

Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! In the security news this week: Sixteen-year-old Linux LPEs still work Ubiquiti UniFi, patch it, also light on details If you remember magicJack, you too are old Slovakia doesn't trust its own speed cameras More homework on NIST's vulnerability database Your webcam, mic, and key light, all owned Printer moonlights as Minecraft server Zombie credit cards Your car's infotainment system fuels botnets Feds warn about AI-powered PLC attacks Can an AI actually reverse engineer its way out? Denver International's security breach, volume six Charlotte's breach and a parking company Why your ancient tech might be the safe one Microsoft counts billions of phishing emails A password vault that leaked to any website Australia sells password books at the post office Another perfect ten, this time in Entra ID Cisco's bug scores read like Olympic gymnastics Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-941

USAF combat veteran, entrepreneur and technology investor Rob Cunningham returns to Michael Jaco with a direct message for President Donald Trump: America can win the AI race—but first, we have to make sure the machines can never take authority they were never given. Cunningham, a former Air Force pilot who flew combat missions during Desert Storm, has publicly offered to serve in an unpaid advisory capacity in support of President Trump's goal of making America the world leader in artificial intelligence. And he says he isn't coming empty-handed. Rob lays out a patented information-physics protocol that he says could fundamentally change how America approaches AI security by separating the enormous computational capabilities of AI and quantum systems from the authority to make sovereign decisions. His principle is simple: Govern the machine. Never allow the machine to govern us. Rob warns that without a new approach, America could enter a perpetual AI-versus-AI arms race requiring ever-larger data centers, enormous amounts of energy, escalating cybersecurity infrastructure and increasingly sophisticated autonomous agents trying to defeat one another. The stakes extend far beyond ChatGPT or consumer technology. Michael and Rob discuss the potential impact of autonomous AI across defense, intelligence, banking, cryptocurrency, energy, communications, supply chains, air traffic control, critical infrastructure, robotics and national security. Rob argues that America should establish the rules of engagement underneath AI itself—creating a sovereignty layer where computational power can continue advancing while unauthorized agency remains off limits. And he's challenging the government to test it. Rob says NIST, DARPA, the FBI, MIT, Caltech or America's highest-level national security teams should independently validate the technology, red-team it and determine whether his claims stand up. If it works, Rob believes the implications could be enormous—not simply for cybersecurity, but for America's ability to become the AI, crypto, energy and manufacturing capital of the world. Michael asks Rob directly what he would say if President Trump invited him to Mar-a-Lago and gave him the opportunity to make his case. His answer sets up the heart of this episode: Test it. Try to break it. Validate it. Then decide whether America should make it the standard. The AI revolution isn't coming someday. It's already here—and Rob Cunningham believes America has an opportunity to define the architecture that governs it before someone else does. The country that establishes sovereignty in the AI era won't simply compete in the AI race. It could define the rules under which that race is run. Wakey Wakey America. Stay informed. Stay sovereign. Stay in the love vibrations. Connect with Michael Jaco Stay connected with Michael for the latest shows, intel, wellness resources, courses, events and more.

Podcast: Energy TalksEpisode: #133: Bridging the IT and OT Gap: Inside the OWASP OT Top 10 ProjectPub date: 2026-08-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationHow a new open-source framework maps critical cybersecurity risks to global industrial standards. In this episode, OMICRON OT cybersecurity expert Simon Rommer speaks with Andreas Happe, who is a security researcher and PhD student at the Vienna University of Technology, and Siegfried Hollerer, who is a security architect and analyst as well as a NIS auditor at the Austrian Ministry of the Interior and lecturer at the St. Pölten University of Applied Sciences in Austria. Simon and his guests discuss their work and experience with the OWASP Operation Technology (OT) Top 10 Project, which is an open-source awareness initiative and practical framework created to identify and rank the most critical cybersecurity risks and vulnerabilities affecting OT environments. They also describe how critical cybersecurity risks are mapped directly to major international frameworks, like IEC 62443 and NIST, providing infrastructure operators with immediate, actionable countermeasures and a shared vocabulary for improved industrial resilience. Get more information about OT Cybersecurity for the Power Grid. We would really like to know what you think about Energy Talks and which topics you would like to hear more about. To do this, simply send us an email to podcast@omicronenergy.com and be sure to give us a star review on Spotify or Apple Podcast. Thanks for your feedback! Please join us to listen to the next episode of Energy Talks

Some crypto products work with multiple chains on different post-quantum paths. NEAR's Illia Polosukhin and Ledger's Charles Guillemet discuss how they manage that challenge. ======================================================== Thank you to our sponsor! ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠ 1inch.com⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you're buying - swap it at⁠⁠⁠ 1inch.com⁠⁠⁠ ======================================================== In March, a Google research team published a paper on breaking cryptographic keys with a quantum algorithm, so cautious about the finding that it released only a zero-knowledge proof the algorithm existed. Weeks later, an EigenLayer AI competition improved on that method in roughly 48 hours. Illia Polosukhin, co-founder of NEAR Protocol, and Charles Guillemet, CTO of Ledger, join Laura Shin for an update on the quantum threat whose deadline could be approaching fast. Both are creating products that deal with multiple chains that all have different post-quantum approaches.  They discuss why, of the three NIST-standardized, post-quantum algorithms, the crypto industry has splintered into different chains working with different ones, whereas most industries are converging on one, called lattice-based. They also debate what to do with Satoshi Nakamoto's bitcoins: do nothing, freeze them, or freeze and tail-emit new bitcoin, an option Guillemet favors even though Bitcoin's leaderless governance makes consensus hard to reach. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guests: ⁠Illia Polosukhin - Co-founder of NEAR Protocol ⁠Charles Guillemet - CTO of Ledger Timestamps

SynkLoader throws in the kitchen sink NIST flags multi-cloud sprawl ReliaQuest blocks a ShinyHunters swing Get the show notes here: https://cisoseries.com/cybersecurity-news-august-25-2026/ Huge thanks to our episode sponsor, ThreatDown Managing an enterprise-sized attack surface without a dedicated SOC? As attackers leverage AI-driven automation to target mid-size business, your legacy defenses are no longer enough. You need the expertise to detect and respond to modern threats, without the overhead of building an in-house security team. ThreatDown provides proactive, Managed Detection and Response, 24/7, so your business can scale safely. Enterprise-grade defense. Built for businesses like yours.

Richard Entrup is unusual in quantum circles: he's not a physicist, and he doesn't pretend to be. He spent decades as a CIO, CTO, CDO, and CISO at organizations including Verizon, Christie's, Disney/ABC, Time Warner, and Tiffany & Company before joining KPMG to lead its Emerging Solutions practice. That background — deep operational experience on the client side — shapes everything about how he thinks about quantum. He's not selling a hardware roadmap; he's thinking about what it actually takes to get a large, complex organization to change its cryptographic infrastructure before a threat materializes.The conversation matters now because the signals are accelerating. NIST has finalized its first post-quantum cryptography standards, executive orders in the US are pushing federal agencies toward PQC migration, and the algorithmic efficiency gains that reduce the qubit threshold for breaking RSA-2048 keep coming. Listeners who work in enterprise technology, cybersecurity, or quantum strategy — or who advise organizations that do — will find Entrup's practitioner perspective a useful counterweight to the more hardware-focused conversations that dominate the field.What We Get IntoWhy Q-Day's exact date is the wrong question — and why the more important issue is how long it will take enterprises to even inventory their cryptographic exposure, let alone remediate itThe scale of the cryptographic migration problem, including why a single laptop may contain hundreds of individual cryptographic components and why upstream/downstream API dependencies make this a supply-chain-wide challenge, not just an internal IT projectWhy "harvest now, decrypt later" creates urgency today, regardless of when fault-tolerant quantum computers arrive — and how compliance and regulatory timelines interact with that threat modelWhat crypto agility actually means in practice — moving from a "set it and forget it" cryptographic posture to a dynamic, continuously monitored framework, including the pressure SSL certificate renewal windows are already creatingHow KPMG built its PQC practice, incubated it within the firm, and handed it off to the cybersecurity advisory team as a core service offeringThe "good quantum" side of the ledger — how KPMG's emerging research function is approaching quantum computing as a source of competitive advantage, not just risk, and what sectors are furthest along in exploring itThe AI-quantum convergence, including Entrup's observation that AI is already being used to read and crack code — and what that means for the urgency of cryptographic modernizationWhy the enterprise quantum opportunity still has a long tail, and how the current moment compares to the early infrastructure phase of the internet — when everyone was talking about TCP/IP and DNS, not Uber or NetflixResources & LinksGuest & OrganizationRichard Entrup — Worth Magazine Profile — Career arc from CIO/CISO roles at major global brands to KPMG's Emerging Solutions practiceKPMG Quantum Dawn (2025) — KPMG's enterprise quantum readiness hub, introducing the Q-PREP framework and PQC implementation services, with Entrup as named leadReports & ResearchKPMG — "The Quantum Threat Is No Longer Theoretical" (2026) — The threat brief discussed in this episode, charting the rapid decline in qubits needed to crack RSA-2048 and urging immediate PQC migrationKPMG — "From Theory to Impact: Real-World Results in Quantum Machine Learning" (2026) — KPMG's joint report with IBM and Kipu Quantum on measurable quantum ML results on real hardwareKPMG — "Prepare Now for Quantum Cyber Risk" — Board Leadership Article (2026) — C-suite and board-level guidance on integrating quantum risk into enterprise oversightarXiv — "Quantum-enhanced satellite image classification" (2026) — The underlying research paper behind the KPMG/IBM/Kipu Quantum ML resultsEcosystem & EventsChicago Quantum Exchange — KPMG Joins CQE (October 2024) — Announcement of KPMG's formal CQE membership, referenced in the episode as part of the firm's ecosystem-building strategyKPMG 2026 Quantum Consortium — The inaugural KPMG Quantum Consortium event (March 2026, Orlando) discussed in the episodeIndependent CoverageQuantum Computing Report — KPMG joins Chicago Quantum Exchange (2024) — Independent coverage of KPMG's CQE partnership and enterprise quantum strategyQuantum Zeitgeist — Kipu Quantum satellite imagery coverage (Feb 2026) — Independent analysis of the KPMG/IBM/Kipu hybrid QML resultsKey Quotes & Insights> "It's not if but when. And it could be five years, could be three years, could be ten years. The fact is organizations are not gonna be ready. And that's the scary part." — Richard Entrup on Q-Day> "This is not just the CISO. This is gonna be the software engineering app dev guys. This is gonna be all your partners, upstream and downstream, who have to also be compliant — because if you change your crypto and they don't, that stuff's gonna break." — On why PQC migration is an enterprise-wide, supply-chain-wide problemInsight: Entrup draws a sharp distinction between the "bad quantum" (cryptographic risk requiring urgent defensive action) and the "good quantum" (competitive opportunity with a longer tail) — and argues that most organizations aren't adequately addressing either.Insight: The analogy to the early internet is deliberate: just as the 1990s were consumed with TCP/IP and DNS rather than the applications those protocols would eventually enable, the current quantum moment is still largely an infrastructure conversation — and that's normal, not a sign of failure.> "AI is expediting all of this. If AI is doing one thing, the use case is reading code and cracking it. That's pretty scary." — On the intersection of AI capability and cryptographic vulnerabilityRelated EpisodesEp. 81 — Quantum LDPC Error Correction with Larry Cohen and Paul Webster — Directly relevant: Cohen and Webster discuss how QLDPC error correction reduces the qubit overhead needed for RSA cryptanalysis, the technical underpinning of the threat timeline Entrup describesEp. 38 — Quantum Machine Learning with Jessic...

In this episode of Tank Talks, host Matt Cohen sits down with Karl Holmqvist, co-founder and CEO of Lastwall, a FedRAMP-certified identity security platform built for the highest-risk use cases. Karl has been deep in cybersecurity since the 1990s, with early experience building critical infrastructure, including Canada's first high-speed mobile data network, and a recent focus on identity security at the forefront of making systems quantum-resilient. In this conversation, they explore the evolution of Lastwall from early behavioral biometrics and cognitive signals to today's hybrid post-quantum cryptography.They also dig into the journey to FedRAMP approval and what it really takes to sell to the hardest customers on the planet, from the DOD's Innovation Unit to critical infrastructure operators globally. Karl shares his view on why hybrid cryptography is the only responsible path right now, the magnified risk of the AI agent era, and his strongly held belief that when it comes to quantum resiliency, you're either going to be too early or too late.Whether you're a founder navigating a path into regulated markets, a security leader thinking about the agentic AI era, or just curious about what it takes to protect critical infrastructure, Karl delivers a grounded, technical, and occasionally unsettling look at where identity security is headed.–A big thanks to our sponsor, Moomoo CanadaThis is the kind of tooling that used to live on a Bloomberg terminal, but now it is on your phone, just a few taps away. They offer real-time data, full options chains, and an AI assistant that actually explains trading strategies.Moomoo is the perfect place for people who want to take their money seriously. Open an account today at moomoo.caGrowing Up in Dubai During the Gulf War (03:50)* Karl's childhood in Dubai as an expat during the Gulf War* Visiting the USS Nimitz and seeing 5,000 people living on an aircraft carrier* How jets overhead and allied ships shaped his early view of technology and defense* The BBS era and the thrill of finding information that wasn't available to everyoneFrom Mobile Data Skepticism to Building Canada's First High-Speed Network (05:31)* Why people thought mobile internet was “the stupidest thing” in the early 2000s* Building a data-only carrier when no one believed you'd want internet everywhere* The Nokia Communicator as his favorite tech gadget and early glimpse of mobile data* Connecting critical infrastructure and discovering default credentials left wide openThe Wake-Up Call: Wastewater Plants and Unsecured Dams (12:58)* Finding a wastewater flow control valve dangling on the internet with admin/admin credentials* The “air-gapped” power plant where an engineer plugged his BlackBerry in to charge* How Shodan and friends revealed dams and power facilities publicly accessible* The founding of Lastwall: “Hackers will be everywhere. We've got to do something.”From Behavioral Biometrics to Quantum Resilience (19:11)* Why 85% of hacks still use valid stolen credentials, the same as the 1990s* Early experiments with keyboard dynamics, mouse movements, and cognitive biometrics* Tracking Peter Shor's algorithm since university and the IBM factorization of 15 in 2001* The 2017 to 2018 decision to embed quantum resiliency natively into LastwallSelling to the Pentagon: DIU and the “Hard Mode First” Strategy (26:07)* Landing the first major deployment with the U.S. Department of Defense Innovation Unit* How DIU pioneered procurement that matches innovation cycles, months instead of years* The advice from Carbon Black founders: build the regulated stack first* Why defense tech used to shut VC doors and how times have changedFedRAMP, Canada, and the Case for Harmonization (33:25)* FedRAMP as the gold standard: do compliance once, reuse everywhere* The Canadian challenge: every agency doing its own security review* Why Canada should base its program on NIST 800 and harmonize with the U.S.* The reality of the integrated North American power grid and shared defenseAI Agents and the Blast Radius of Credential Theft (37:44)* Why 50 to 100 agents per human in 2 to 3 years will magnify damage exponentially* The OpenClaw lesson: agents do what agents do, not what you expect* The “YOLO” approach to AI deployment and why enterprises aren't calling enough* Advice for founders: sandbox first, don't connect your whole drive, go slowlyThe $60M Series A Extension and the Path Forward (43:13)* Raising BDC Capital's Strong North Fund led by Major General (Ret.) Peter Dawe* The milestone of FedRAMP certification and opening the floodgates to U.S. agencies* Deploying in disconnected environments: field containers for critical infrastructure* Why defense is ultimately about protecting the economyAbout Karl HolmqvistKarl Holmqvist is co-founder and CEO of Lastwall, an identity-as-a-service platform built on Zero Trust principles and public key infrastructure, hardened with post-quantum cryptographic resilience. Lastwall serves the U.S. Department of Defense and a growing number of civilian government agencies and critical infrastructure operators. Karl has been a cybersecurity enthusiast since the 1990s, with a background spanning telecommunications infrastructure (including building one of Canada's first high-speed mobile data networks), renewable energy infrastructure across the Middle East, North Africa, and Southern Europe, and international investing. He studied at Mount Allison University and is based in Vancouver, BC.Connect with Karl Holmqvist on LinkedIn: https://www.linkedin.com/in/karlholmqvist/Visit Lastwall's website: https://www.lastwall.com/Connect with Matt Cohen on LinkedIn: https://ca.linkedin.com/in/matt-cohen1Visit the Ripple Ventures website: https://www.rippleventures.com/ This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit tanktalks.substack.com

In the security news this week: Cursor opens your repo, the repo opens you If you want the good model I'm going to need to see your ID Flock's a Flocking mess Defender was supposed to be the chosen one Side stepping Secure boot - twice SonicWall: a LAMP stack in a fancy case Macs don't get viruses, part infinity Flipper One, but why not Nix? NetScaler is back in the room Borrowing phone's good reputation USB and how to make Windows download stuff A KVM with the expensive letters removed Five steps to stop the webcam creeps PlexTrac acquired NIST asks the internet to fix the NVD Poland's health software has a very bad week If Apple pings you about spyware, believe it A macOS stealer that drives your browser for you T-Mobile's incident response tool of choice may suprise you, or not... Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-940

In the security news this week: Cursor opens your repo, the repo opens you If you want the good model I'm going to need to see your ID Flock's a Flocking mess Defender was supposed to be the chosen one Side stepping Secure boot - twice SonicWall: a LAMP stack in a fancy case Macs don't get viruses, part infinity Flipper One, but why not Nix? NetScaler is back in the room Borrowing phone's good reputation USB and how to make Windows download stuff A KVM with the expensive letters removed Five steps to stop the webcam creeps PlexTrac acquired NIST asks the internet to fix the NVD Poland's health software has a very bad week If Apple pings you about spyware, believe it A macOS stealer that drives your browser for you T-Mobile's incident response tool of choice may suprise you, or not... Show Notes: https://securityweekly.com/psw-940

The quantum computing threat isn't a far-off problem anymore, with deadlines rapidly shifting closer to 2029. Organizations are scrambling to secure $30 trillion in legacy IT infrastructure. Dr. José Rosas, CEO of EigenQ, joins host Konstantinos Karagiannis to explain how his company can bypass the need for costly "rip-and-replace" server upgrades by delivering plug-and-play PCIe accelerator boards. By combining quantum entropy (random number generation) with post-quantum cryptography (PQC) algorithms into existing server architectures like Intel Xeon and AMD EPYC, EigenQ creates a full-stack, hardware-rooted trust layer without modifying host motherboards.   Beyond retrofitting legacy servers, Dr. Rosas reveals EigenQ's broader vision to master crypto-agility. Using dynamic hardware reconfiguration to adapt as PQC standards evolve prevents getting trapped by rigid silicon designs. He delves into how their hardware integrates directly into CPU Trusted Execution Environments (TEEs), extends to tactical edge environments like drones, and lays the groundwork for their next frontier: quantum-assisted AI and photonic interconnects.  For more on EigenQ, visit https://www.eigenq.com/.Visit Protiviti at www.protiviti.com/US-en/technology-consulting/quantum-computing-services to learn more about how Protiviti is helping organizations get post-quantum ready.  Follow host Konstantinos Karagiannis on all socials: @KonstantHacker             Questions and comments are welcome!  Theme song by David Schwartz, copyright 2021.  The views expressed by the participants of this program are their own and do not represent the views of, nor are they endorsed by, Protiviti Inc., The Post-Quantum World, or their respective officers, directors, employees, agents, representatives, shareholders, or subsidiaries.  None of the content should be considered investment advice, as an offer or solicitation of an offer to buy or sell, or as an endorsement of any company, security, fund, or other securities or non-securities offering. Thanks for listening to this podcast. Protiviti Inc. is an equal opportunity employer, including minorities, females, people with disabilities, and veterans.  

Lawfare Senior Editor Kate Klonick is joined by three guests to discuss their recent article for the Council on Foreign Relations on the FINRA-style AI regulator reportedly under White House review: Vinh Nguyen, former chief AI officer at the National Security Agency and now CFR's Senior Fellow for Artificial Intelligence; Elham Tabassi, former chief AI advisor at NIST and now director of Brookings' AI and Emerging Technology Initiative; and Kat Duffy, CFR's Senior Fellow for Digital and Cyberspace Policy and director of LEAD AI.The conversation follows recent news of Demis Hassabis's July 14 framework calling for a U.S.-led Frontier AI Standards Body and a subsequent Bloomberg report that Treasury Secretary Bessent is involved in reviewing a version of the proposal. They discuss the problems but benefits with a FINRA-like model and what that means for public trust before the body even launches, especially for allies abroad who may be reluctant to treat an American, industry-funded body as an international standard-setter.To receive ad-free podcasts, become a Lawfare Material Supporter at www.patreon.com/lawfare. You can also support Lawfare by making a one-time donation at https://givebutter.com/lawfare-institute.Support this show http://supporter.acast.com/lawfare. Hosted on Acast. See acast.com/privacy for more information.

Why does compliance paperwork fall behind the systems it describes? Because the systems change faster than the documents. Travis Howerton points to cloud native technologies that spin up and down on demand, which makes describing infrastructure in paperwork something that goes out of date instantly. Add new regulation for third party risk, supply chain, zero trust, and privacy, and an approach that was already expensive and frustrating stops being fit for purpose. RegScale answers that with compliance as code. The company went to NIST and helped write the standard that became OSCAL, the Open Security Controls Assessment Language, then built the capability for machines to attest to their own state using it. Paperwork starts writing itself, and CISOs get risk and compliance outcomes as a byproduct of operational excellence rather than as a separate project. Is automating the evidence trail a shortcut? Travis Howerton argues the opposite. It prevents corner cutting, because the alternative is what he calls compliance theater. An old general he worked for described that as a mother-in-law visit, where you clean the house to a ridiculous standard, everybody goes through the dance, and the moment the visit ends the kids destroy the house again. Where should a security team start automating? Start with what hurts. He tells people to think like a surgeon, who opens by asking the patient what is wrong, then work backwards from the pain. There is no easy button, and the honest starting point is the truth about how fast teams will need to react. That pain usually maps to one of three business drivers. Cut cost, or shift the share of budget going to checklist compliance toward tools that buy down risk. Get real-time assurance. Or earn the reps and certs needed to sell into a market, whether that is FedRAMP for government work or PCI for card data. Compressing those timelines by 70 to 80 percent lets a company get to market faster and grow revenue. The results Travis Howerton cites are specific. One large government agency is touting over $100 million in labor savings, and a Department of War customer with a 52-week end-to-end cycle has compressed it by 36 weeks using RegScale technology alongside other integrated tools. Having tripled, doubled, and doubled again over the last three years, RegScale stays focused on the largest and most complex organizations, with international markets and the energy sector on the horizon. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Travis Howerton, Co-Founder and CEO at RegScale LinkedIn: https://www.linkedin.com/in/travishowerton/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas RegScale: https://regscale.com OSCAL, the Open Security Controls Assessment Language: https://pages.nist.gov/OSCAL/ Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS travis howerton, regscale, sean martin, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, compliance as code, continuous controls monitoring, oscal, grc engineering, fedramp, fisma, authority to operate, ai agents, risk management, cybersecurity compliance Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Topics covered in this episode: Claude Code /insights Post-quantum crypto lands in Python MCP goes stateless — and FastMCP gets renamed inshellisense - IDE style command line auto complete Extras Joke Watch on YouTube About the show Sponsored by Xweather Xweather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server so your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. Michael will tell you more about them later in the show. Get started for free at pythonbytes.fm/xweather Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Claude Code /insights Michael's Insights: michael-kennedy-claude-code-insights-2026-08-09.html Be careful sharing these outputs, they include details references to your projects, errors, security findings, etc. ;) /insights reads your last 30 days of local session transcripts and hands back an interactive HTML report on how you actually work. One command, zero setup: type /insights in a session, or run claude -p "/insights" from the shell for a non-interactive version that just prints the path Reads what's already on disk: pulls session logs from ~/.claude/projects/, skipping agent sub-sessions and anything under 2 messages or 1 minute Project areas: clusters your sessions into themes like "CLI Tooling" or "Documentation" with session counts Friction analysis: categorizes where things went wrong by root cause - and quotes your own prompts back at you Interaction style: tells you whether you're a delegator or a micromanager, plus which workflows are worth doubling down on Actually actionable: suggests concrete CLAUDE.md additions and Claude Code features you're not using The catch: Haiku does the per-session classification, so the first run takes several minutes; results cache to ~/.claude/usage-data/facets/ and the report lands at ~/.claude/usage-data/report.html Calvin #2: Post-quantum crypto lands in Python pyca/cryptography 48 ships ML-KEM (key establishment) and ML-DSA (signatures) — NIST's post-quantum standards, now one pip install away. Big deal because it's the 11th most-downloaded package on PyPI (~1.2B downloads/month) and sits under Ansible, Certbot, Airflow, and paramiko. No PQ there, no PQ anywhere in Python. Trail of Bits did the work (Rust bindings, cross-backend API, tests, AWS-LC backend support), funded by the Sovereign Tech Agency. Timing tracks a June 22 White House order setting federal deadlines: PQ key establishment by end of 2030, PQ signatures by end of 2031. Not a drop-in swap — the wire sizes explode. ML-DSA-65 signatures are 3,309 bytes vs Ed25519's 64; ML-KEM-768 public keys are 1,184 bytes vs X25519's 32. Hardcoded field sizes and length prefixes will bite. API looks like the existing asymmetric primitives, except ML-KEM is encapsulate/decapsulate rather than a Diffie-Hellman exchange. SLH-DSA (the hash-based conservative backstop) is still in progress. The primitives are here, but protocols haven't caught up — so you won't be running post-quantum Certbot this week. Sponsor: Xweather You're using agents that can write code, summarize documents, and automate workflows. But they're missing one thing: awareness of the world around them. This is where today's sponsor, Xweather comes in. Xweather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server built for tools like Claude, Codex, Copilot, and modern IDEs – so your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. Backed by Vaisala, whose instruments fly on NASA missions to Mars, Xweather delivers trusted data and unique insights that go beyond conditions to actual impact – from real-time lightning strikes to road surface forecasts. Start with 15,000 free API calls each month and pay only for what you use as you grow. Xweather is your full weather stack, for developers by developers. Start building for free today at pythonbytes.fm/xweather. The link is in your podcast player's show notes and on the episode page. Thanks so much to Xweather for supporting Python Bytes. Calvin #3: MCP goes stateless — and FastMCP gets renamed From Philipp Acsany over at Real Python The 2026-07-28 spec landed July 28 and the Python SDK shipped 2.0.0 the same day. Biggest rewrite since MCP launched, and it's breaking on purpose. Context for scale: the Tier 1 SDKs are pulling close to half a billion downloads a month, with TypeScript and Python each past a billion total. The headline is the stateless core. The initialize/initialized handshake and the Mcp-Session-Id header are both retired — protocol version, client identity, and capabilities now ride in _meta on every request, with an optional server/discover RPC if a client wants capabilities up front. Any request can land on any instance behind plain round-robin, no shared storage. Server-initiated calls are the hard part of the migration. Sampling, elicitation, and roots/list no longer call back to the client; instead the server returns resultType: "input_required" and the client retries with inputResponses attached. Multi Round-Trip Requests, MRTR. Also: Mcp-Method and Mcp-Name are now required headers so gateways route on headers instead of cracking JSON bodies, and missing-resource errors move to standard 32602. Deprecation sweep with an actual policy behind it — Roots, Sampling, Logging, and the legacy HTTP+SSE transport all deprecated with a twelve-month minimum offramp. Tasks graduated out of the experimental core into a real extension, which is what the formalized extensions framework was for. MCP Apps is now an official extension too, so a tool call can return sandboxed interactive HTML. Auth picked up RFC 9207 issuer validation, issuer-bound credentials, and a shift from DCR toward CIMD. Python SDK 2.0 is where it gets personal: FastMCP is now MCPServer, no alias, no shim. McpError → MCPError. Wire types went snake_case (is_error, input_schema) and moved to a standalone mcp_types package, with mcp.types kept as a permanent alias. One Client object replaces the old transport + ClientSession + initialize() stack. httpx became httpx2. Sync handlers run on worker threads now, so asyncio.get_running_loop() raises inside them. The good news: one MCPServer serves both protocol eras, so 2025-era clients keep working with nothing to configure, and a Resolve(fn) parameter lets one tool body cover MRTR and the old path. 1.x is maintenance-and-security-fixes only — pin mcp>=1.28,

Federal agencies signal upcoming contract dollars through the president's budget months before a solicitation ever posts, and the FY2027 budget was published just weeks ago. Tracy Marcinowski, a former Air Force contracting officer who rose to Assistant Commissioner for Acquisitions at GSA's Public Building Service, a $4 billion organization, walks through how a small business reads that budget to find where the money is going before competitors do. What you'll learn in this episode: Why a signed GSA schedule or OASIS Plus contract can carry zero obligated dollars, and what you still have to do after you win one How to read the president's budget to spot which agencies and programs will have money next year Where federal spending data went after SAM.gov absorbed FPDS and USASpending, and how to pull it now Which GSA vehicle actually fits your business, and why the schedules are often the wrong first move The right people to reach inside an agency, program managers and requirements owners, not the CEO Chapters: 0:00 - Tracy Marcinowski's path from Air Force to GSA 3:00 - Why the government does not buy everything 9:00 - The vendor who pitched the wrong buyer six times 11:30 - Who inside an agency actually shapes requirements 15:30 - Choosing a contract vehicle that fits what you sell 17:30 - Starting research with the president's budget 23:30 - Why GSA is the easiest agency to break into 25:00 - CMMC, NIST, and Department of War requirements 32:30 - Action steps for a first-time small business Mindy gives you the federal opportunities, agency signals, recompete intel, and pursuit briefs that tell you not just what contracts exist, but which ones to chase and how to win them. Sign up for free Daily Alerts and get opportunities delivered to your inbox before the day starts.

"We cannot solve our problems with the same thinking we used when we created them." – Albert Einstein Scott Alldridge is a tech-forward C-Suite Executive, Board Director, Amazon Best Seller Author and exceptional Problem Solver with deep experience in AI, cybersecurity, data governance and risk management spanning a broad array of industries. He is a transformational leader adept at driving organizational change, mitigating financial and reputation risk and formulating high-impact tech strategies that lead to significant value creation. ______ CYBERSECURITY SME. Scott's work is grounded in Zero Trust – a cyber-tech operations discipline for highly regulated environments. He has led and advised organizations operating under NIST CSF, NIST 800-53, NIST 800-171, CMMC and ISO 27001. Scott's experience also includes HIPAA, PCI DSS, SOX, GLBA, SOC 2, state privacy laws and cyber insurance requirements. In each engagement, Scott's primary goal is to support organizations by strengthening security, ensuring compliance and improving performance – without compromising business efficiency. ENGAGED BOARD MEMBER. Scott helps companies build future-ready infrastructures and leverage technology to strengthen organizational agility and drive profitable growth. He brings a unique blend of business acumen and technical proficiency to his roles as CEO, Advisor and Independent Board Director. Scott's board-level advisory experience includes strategic guidance on a variety of topics including digital transformation, cybersecurity governance, business strategy, portfolio growth and AI. PRAGMATIC LEADER. Scott builds accountable, cross-functional teams that deliver spot-on, data-driven results for their organization, clients and stakeholders. Guided by a shared set of "Mission, Vision and Values", Scott mentors emerging leaders to execute assignments with clarity and autonomy. As testament to his effective leadership style, Scott's core team has remained with him for more than 15 years. https://ipservices.com/ ______ EXPERIENCE and EXPERTISE Small Cap · Mid-cap · SMB · Startups · PE · Digital Transformation • Change Management · AI · IT Roadmaps · Cybersecurity · Continuous Improvement · Agile Methodology · SaaS · ERP Systems Cloud Services · IT Infrastructures · Growth Strategies · Risk Mitigation Business Development M&A Due Diligence • Acquisition Integration • Vendor Negotiations Audit Compliance • NIST • CMMC • GLP • SOX • Gramm-Leach-Bliley Act