POPULARITY
Categories
362 episodes with SOC
164 episodes with SOC
184 episodes with SOC
108 episodes with SOC
45 episodes with SOC
50 episodes with SOC
30 episodes with SOC
39 episodes with SOC
52 episodes with SOC
23 episodes with SOC
61 episodes with SOC
24 episodes with SOC
31 episodes with SOC
18 episodes with SOC
29 episodes with SOC
98 episodes with SOC
28 episodes with SOC
48 episodes with SOC
24 episodes with SOC
24 episodes with SOC
22 episodes with SOC
14 episodes with SOC
14 episodes with SOC
32 episodes with SOC
38 episodes with SOC
14 episodes with SOC
18 episodes with SOC
17 episodes with SOC
13 episodes with SOC
12 episodes with SOC
10 episodes with SOC
15 episodes with SOC
14 episodes with SOC
19 episodes with SOC
19 episodes with SOC
12 episodes with SOC
11 episodes with SOC
16 episodes with SOC
15 episodes with SOC
9 episodes with SOC
11 episodes with SOC
12 episodes with SOC
12 episodes with SOC
10 episodes with SOC
10 episodes with SOC
14 episodes with SOC
10 episodes with SOC
8 episodes with SOC
14 episodes with SOC
18 episodes with SOC
9 episodes with SOC
11 episodes with SOC
14 episodes with SOC
10 episodes with SOC
27 episodes with SOC
20 episodes with SOC
6 episodes with SOC
8 episodes with SOC
33 episodes with SOC
15 episodes with SOC
4 episodes with SOC
5 episodes with SOC
7 episodes with SOC
7 episodes with SOC
15 episodes with SOC
14 episodes with SOC
8 episodes with SOC
9 episodes with SOC
8 episodes with SOC
8 episodes with SOC
10 episodes with SOC
13 episodes with SOC
8 episodes with SOC
8 episodes with SOC
6 episodes with SOC
9 episodes with SOC
8 episodes with SOC
5 episodes with SOC
7 episodes with SOC
17 episodes with SOC
14 episodes with SOC
5 episodes with SOC
7 episodes with SOC
5 episodes with SOC
5 episodes with SOC
7 episodes with SOC
10 episodes with SOC
5 episodes with SOC
6 episodes with SOC
4 episodes with SOC
7 episodes with SOC
4 episodes with SOC
5 episodes with SOC
5 episodes with SOC
94 episodes with SOC
6 episodes with SOC
6 episodes with SOC
6 episodes with SOC
6 episodes with SOC
2 episodes with SOC
4 episodes with SOC
4 episodes with SOC
6 episodes with SOC
4 episodes with SOC
8 episodes with SOC
8 episodes with SOC
6 episodes with SOC
3 episodes with SOC
3 episodes with SOC
5 episodes with SOC
3 episodes with SOC
4 episodes with SOC
4 episodes with SOC
8 episodes with SOC
4 episodes with SOC
7 episodes with SOC
7 episodes with SOC
7 episodes with SOC
8 episodes with SOC
3 episodes with SOC
4 episodes with SOC
4 episodes with SOC
3 episodes with SOC
4 episodes with SOC
4 episodes with SOC
3 episodes with SOC
3 episodes with SOC
9 episodes with SOC
5 episodes with SOC
2 episodes with SOC
4 episodes with SOC
7 episodes with SOC
6 episodes with SOC
6 episodes with SOC
4 episodes with SOC
6 episodes with SOC
6 episodes with SOC
2 episodes with SOC
3 episodes with SOC
5 episodes with SOC
5 episodes with SOC
3 episodes with SOC
4 episodes with SOC
4 episodes with SOC
4 episodes with SOC
4 episodes with SOC
4 episodes with SOC
4 episodes with SOC
53 episodes with SOC
3 episodes with SOC
52 episodes with SOC
5 episodes with SOC
3 episodes with SOC
Security teams spent decades begging for more logs. Now the enterprise is generating petabytes a day, and the thing drowning in it isn't just the SOC anymore, it's your AI agents too. In this episode, Ron sits down with Myke Lyons, CISO at Cribl, who cut his teeth in telemetry and logging decades ago and has landed right back there in the age of AI. Ron and Myke dig into why most telemetry failures aren't data problems at all, they're decisions nobody made about why the logs are being collected in the first place. Myke breaks down what to track on every agent in your environment, why token spend belongs on the security team's plate, why dashboards are quietly dying, and why treating an AI agent like just another employee is a mistake that's going to bite security teams hard. Underneath it all is one question Myke keeps circling back to: do you actually know what normal looks like for every agent in your environment? Impactful Moments 00:00 - Introduction 01:50 - Myth Busting: AI Agents Aren't Just Another User Account 04:25 - Meet Myke Lyons, CISO at Cribl 05:05 - What it means to run security at a telemetry company 06:10 - From gigabytes of logs at GE to petabytes today 07:45 - MITRE ATT&CK, Cribl's new APEX framework, and orienting telemetry 10:20 - Why most telemetry problems are decision problems, not data problems 13:20 - OCSF and how security teams are rethinking their schemas 14:25 - Why the dashboard is dying 17:35 - What Myke wants to track about every AI agent 20:10 - How to spot an agent going rogue 23:15 - Making your data AI-ready and the case for schematizing everything 27:10 - Tokenomics: treating AI spend as a security responsibility 29:05 - The non-negotiable logs every org should be collecting 31:50 - Hot takes: build vs. buy, tier two to three, and Myke's daily AI briefing 33:35 - Closing thoughts and outro Links Connect with Myke Lyons on LinkedIn: https://www.linkedin.com/in/mykelyons/ Learn more about Cribl: https://cribl.io/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/
Skype of Cthulhu presents a Call of Cthulhu scenario. This is Our Home by Jim Phillips. December 16, 1976 Staten Island, New York City, New York Mr. Michale discovers the future is not fixed while Mr. Griffin makes a long awaited appointment. Dramatis Persone: Jim as the Keeper of Arcane Lore Randall as Frank Romero, Electrical Engineer Rachel as Marsha Janelle, Waitress Steve as Trae Grier, Gas Station Attendant Edwin as Kevin Mazer, Chemistry Teacher Gary as Peter Michale, Ex Pro Quarterback Sean as Kirk Griffin, Actor Download Subcription Options Podcast statistics
See what the team at The Successful Bookkeeper has on right now → If you've been watching the AI wave roll in and wondering what it means for your bookkeeping practice, this episode is for you. Alex Lee, co-founder and CEO of Truewind, brings a clear-eyed perspective grounded in three and a half years of building AI tools specifically for accountants. His message is direct: the future of accounting has always been about you, and that isn't changing. Chapters [00:00] Opening: Fear and Opportunity [01:18] Alex Lee's Unlikely Path to AI [04:18] The Future Is Still You [08:00] Will AI Replace Bookkeepers? [12:00] Crawl, Walk, Run: Getting Started [16:30] AI Adoption Across the Profession [19:30] Data Privacy and Security Checklist [24:00] Vision for Accounting's Future [27:00] About Truewind The Work That Has Always Mattered Alex draws a useful historical line — from carving debits and credits in limestone, to paper ledgers, to file cabinets, to cloud software, and now AI. "I see AI as the next iteration of technology that may shape how accountants are doing the work," he says. "But ultimately, the work of the accountants is the same." What AI does is create space for bookkeepers to spend more time on the things that are genuinely hard to automate: being a trusted advisor, being a real business partner, and — as Alex puts it — shaking hands and looking someone in the eye. Those things don't disappear no matter how good the models get. The Spreadsheet Comparison Worth Remembering When the fear of replacement comes up — and it does — Alex points to a pattern that has played out before. When spreadsheets arrived, people predicted mass job losses in accounting. Instead, the profession grew. Some small business owners did start managing their own five-line chart of accounts, and some will use AI to handle basic recordkeeping themselves. But that's not your client. "As accountants, it puts you in a very unique position to elevate yourself in terms of your AI skills and demonstrate to businesses, I know how to use this tool exceptionally well." The expertise gap has always been the value. AI doesn't close that gap — it widens it in your favor if you lean in. A Crawl, Walk, Run Framework for Getting Started Alex is practical about adoption. Start by picking one AI tool you've already heard of — maybe tried once — and use it for everyday tasks: drafting a client email, writing a performance review, planning a trip. Get comfortable at that level before adding complexity. Walking looks like connecting your AI to your Slack, email, or call recordings and asking it to synthesize information — summarizing client pain points before a proposal, for example. Running is letting AI handle a meaningful portion of your day-to-day operations. "Just get started," Alex says. "Over time, get more sophisticated, and then over time, let it be the primary operating system for you." Handling Data Privacy the Right Way Financial data demands careful handling, and Alex doesn't gloss over it. His checklist for vetting any AI vendor: confirm they are SOC 2 Type 2 compliant with a reputable auditor (not a quick rubber-stamp), verify that data privacy agreements exist between your vendor and the underlying model providers like OpenAI or Anthropic, and look for a genuine philosophy of data protection — not just a claim on a website. For teams that are still nervous about connecting client data to AI tools, his advice mirrors the crawl-walk-run approach: start by using AI internally with your own team's Slack and shared drives. Build confidence there before expanding to client-facing workflows. A Bigger Demand for Accountants Is Coming Alex's outlook for the next one to five years is genuinely optimistic. He sees AI acting as a catalyst for what he calls a "Cambrian explosion of demand for accounting." As business models shift from billable hours toward fixed-fee engagements and technology enables firms to handle more clients with the same headcount, he expects more businesses — not fewer — to seek out qualified accounting professionals. "Accountants can get more done with less, driving an influx of demand for what accounting firms can provide." The firms positioning themselves now, building AI literacy and deepening client relationships, are the ones that will be ready to capture that demand. Links Mentioned Truewind — Alex's AI-powered accounting platform The Successful Bookkeeper — show resources and guest information PureBookkeeping — episode sponsor, proven system to grow your bookkeeping business About the Guest Alex Lee is the co-founder and CEO of Truewind, an AI-powered accounting platform built for accounting firms and corporate finance teams. Before founding Truewind, Alex worked as an aerospace engineer at Boeing, spent time in venture capital, and built a financial planning and analysis company. Truewind launched in the same month as ChatGPT and has spent the past three and a half years building what Alex describes as an "agentic workspace" for accountants — integrating with QuickBooks Online, Sage Intacct, and NetSuite to help teams cut close time by 30 to 50%. You can reach Alex directly on LinkedIn or learn more at truewind.ai. About the hostMichael PalmerMichael Palmer is the host of The Successful Bookkeeper podcast and co-founder of Pure Bookkeeping and The Successful Bookkeeper. He started this work because of his father — a brilliant electrical contractor who worked twice as hard as he should have had to, because nobody on the financial side was in his corner. That gap is what The Successful Bookkeeper exists to close. His view: bookkeepers are the most undervalued force in small business — and every bookkeeper who builds a real business changes two families: theirs, and their clients'.
This Week In Startups is made possible by: Vanta https://www.vanta.com/twist Agree https://agree.com YSecurity https://YSecurity.io/TWIST Today's show: Frontier AI models can ace PhD-level exams, but it's still bad at tracking down the product you want in the style that suits you. Onton's Zach Hudson tell us that the problem is that models are a black box. His solution? A neurosymbolic model, Ontology 1, that learns about your taste and preferred aesthetic over time, then produces product searches tailored specifically to you, rather than just using keywords and relevant tags. How do neurosymbolic models work, and how does Onton understand your prompts and favorite design trends? And why aren't the frontier labs working on neurosymbolic models of their own? Zach joins Jason and Lon to discuss. PLUS, following a record-smashing SpaceX IPO, Ashi Dissanayake of Spacium makes the case that the real bottleneck in space isn't launching rockets off the ground any more. It's refueling in orbit. Guests Zach Hudson on X: ****https://x.com/nosduhz Onton: https://onton.com/ Spacium: https://spaceium.com/ Spacium on X: https://x.com/SpaceiumInc Relevant Links Poolside's journey to AGI: https://poolside.ai/vision/purpose Startup Archive: Sam Altman on the Paul Graham advice that saved OpenAI: https://www.startuparchive.org/p/sam-altman-on-the-paul-graham-advice-that-saved-open-ai-always-make-an-api Kelly Wearstler: https://www.kellywearstler.com/ Ennis House: https://franklloydwright.org/site/ennis-house/ Los Feliz Living: Ennis House profile: https://www.losfelizliving.com/los-feliz-historic-homes/ennis-house-los-feliz-hcm-149 Indiewire: Ennis-inspired "The Studio" offices: https://www.indiewire.com/features/craft/the-studio-production-design-interview-seth-rogen-1235114365/ Monocle Magazine: https://monocle.com/ Spaceium on Y Combinator: https://www.ycombinator.com/companies/spaceium-inc Orbit Fab's RAFTI: https://www.orbitfab.com/rafti/ James Webb Space Telescope: https://science.nasa.gov/mission/webb/ Houzz: https://www.houzz.com/ Timestamps: 0:00 Zach Hudson joins: What is "neurosymbolic search" 4:03 Ontology 1 isn't a black box 6:31 Who is using Onton? 9:36 Vanta - Get $1000 off your SOC 2 at https://www.vanta.com/twist 11:35 Could neurosymbolic models reach AGI? 13:19 Jason loves Wright's Ennis House 17:03 The shape of AI companies is changing 19:28 Agree.com - Stop chasing invoices and automate your entire contract-to-cash stack. Go to https://agree.com and tell them Jason sent you to get 50% off for life! 22:32 UGC as a data moat 26:03 The Dead Internet Theory 28:13 Ashi Dissanayake of Spacium joins 29:52 YSecurity - The on-demand security team for startups. Need enterprise-grade security without hiring a $400k CISO? YSecurity gives you 40+ expert engineers, matched to exactly what you need, by the hour, with your first six hours completely free. Go to https://YSecurity.io/TWIST 31:50 Storables vs. cryogenics: the zero-boil-off breakthrough 34:11 All kinds of propulsion requires refueling 36:09 Getting more value from LEO to GEO 38:28 Moving at rocket speed 44:54 Why demand is so acute 49:37 The investing climate for space, post-SpaceX Subscribe to the TWiST500 newsletter: https://ticker.thisweekinstartups.com Check out the TWIST500: https://www.twist500.com Subscribe to This Week in Startups on Apple: https://rb.gy/v19fcp Follow Lon: X: https://x.com/lons Follow Jason: X: https://twitter.com/Jason LinkedIn: https://www.linkedin.com/in/jasoncalacanis Check out all our partner offers: https://partners.launch.co/ Great TWIST interviews: Will Guidara, Eoghan McCabe, Steve Huffman, Brian Chesky, Bob Moesta, Aaron Levie, Sophia Amoruso, Reid Hoffman, Frank Slootman, Billy McFarland Check out Jason's suite of newsletters: https://substack.com/@calacanis Follow TWiST: Twitter: https://twitter.com/TWiStartups YouTube: https://www.youtube.com/thisweekin Instagram: https://www.instagram.com/thisweekinstartups TikTok: https://www.tiktok.com/@thisweekinstartups Substack: https://twistartups.substack.com
Imagine how much investigation time your SOC could get back if the busywork just disappeared. Ron sits down with John Gillis, Staff Security AI Engineer at Adobe, who built an in-house AI investigation platform from scratch. John's system runs on more than 30 specialized agents that reason through cases instead of following a script. In one run, that meant over 140 detections investigated in under four hours at an 80 to 85% quality rating. Ron and John dig into the hard lesson that made John rip out his own tooling and rebuild it around function calling, why "humans first" drives every decision his team makes, and whether AI SOC is actually different from SOAR or just the same promise with way better marketing. Underneath all of it is the one thing John says decides whether any of this actually works: context. Give the AI too little and it's guessing, give it too much and it drowns just like a human would. Listen to find out what it actually takes to build an AI SOC that reasons instead of just automates. Impactful Moments 00:00 - Introduction 02:05 - The rewind: how SOAR promised to save the SOC in 2015 03:35 - Meet John Gillis, Adobe's Staff AI Security Engineer 05:30 - What cybersecurity looked like before AI at enterprise scale 07:00 - The "humans first" strategy behind Adobe's AI investigator 09:30 - Why careless context management is the biggest pitfall in agent design 14:45 - Solving the speed problem: is it tooling, process, or people? 17:10 - From monolith to microservices: rebuilding the platform for scale 24:05 - What actually makes an AI agent's "persona" work 26:00 - John's prediction for the SOC three years from now 28:50 - The three skills every security practitioner needs for 2026 32:10 - Final verdict: is AI SOC really different, or SOAR with new branding? Links Connect with John Gillis on LinkedIn: https://www.linkedin.com/in/john-gillis/ If you're a researcher ready to make an impact, check out the announcement about Adobe's new home for the Adobe Bug Bounty Program here: https://blog.adobe.com/security/a-new-home-for-the-adobe-bug-bounty-program Check out Adobe's Bug Bounty profile on Intigriti: https://app.intigriti.com/programs/adobe/adobepublic/detail Learn more about Adobe: https://www.adobe.com/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/
Skype of Cthulhu presents a Call of Cthulhu scenario. Moonchild by Paul Fricker. October, 2013 Springfield, Massachusetts The classmates all pursue different leads while some meet with the man at the center of the mystery. Dramatis Persone: Edwin as the Keeper Randall as Ray West, IT Professional Gary as Maggi Stern, Retail Manager Meredith as Alicia Jucio, Antiques Dealer Steve as Melinda Moody, Journalist Max as Erik Wilson, Accountant Jim as John Vinocur, Nurse Download Subcription Options Podcast statistics
In Episode 111 of the Cybersecurity Readiness Podcast Series, Dr. Dave Chatterjee is joined by Bruno Lecoq, CEO of BEMO, to examine the gap between executive intention and operational security reality in small and medium-sized organizations, and what it costs when resource trade-offs, unclear ownership, and optimism bias quietly undermine programs that look sound on paper.Drawing on his nearly sixteen years at BEMO and twenty years at Microsoft before that, working with companies of 10 to 1,000 users across multiple verticals, Bruno argues that the recurring failure point is rarely the tools; it is the absence of clear ownership, aligned resources, and sustained discipline. The conversation moves through why IT alone cannot own security, how the function's reporting line shapes whether it is treated as a cost center or a strategic capability, and a detailed walk-through of a SOC 2 "fire drill" scenario that Dr. Chatterjee analyzes through his Commitment–Preparedness–Discipline (CPD) Framework.The discussion also covers how BEMO uses AI-driven log review and unannounced tabletop exercises to keep clients honest about their true readiness, why Bruno turns away prospects who treat compliance as a paperwork exercise rather than a genuine security commitment, and why he believes cybersecurity and compliance, approached the right way, are a competitive advantage rather than a cost of doing business.To access and download the entire podcast summary with discussion highlights - https://www.dchatte.com/episode-111-closing-the-gap-between-leadership-intention-and-operational-security-reality-a-cpd-lens-on-smb-cybersecurity-governance/Connect with Host Dr. Dave ChatterjeeLinkedIn: https://www.linkedin.com/in/dchatte/ Website: https://dchatte.com/Books PublishedThe DeepFake ConspiracyCybersecurity Readiness: A Holistic and High-Performance ApproachArticles & Cases PublishedChatterjee, D. (2026). The Cryptographic Reckoning: Why Quantum Readiness Begins with Agility, Not Algorithms, The INFORMS Analytics Magazine, June 26, 2026Chatterjee, D. (2026). The New Digital Fragility: How AI-Enhanced Cyber Threats Are Reshaping Operational Resilience, The INFORMS Analytics Magazine, March 4, 2026Chatterjee, D. (2026). Root: Automating the Remediation Gap, Ivey Publishing, Jan 7, 2026.Ramasastry, C. and Chatterjee, D. (2025). Trusona: Recruiting For The Hacker Mindset, Ivey Publishing, Oct 3, 2025.Chatterjee, D. and Leslie, A. (2024). “Ignorance is not bliss: A human-centered whole-of-enterprise approach to cybersecurity preparedness,” Business Horizons, Accepted on Oct 29, 2024.Isik, O., Chatterjee, D., and Lourenco, D.A. (2024). “Getting Cybersecurity Right,” California Management Review — Insights, Accepted for Publication, July 8, 2024. Chatterjee, D. (2023). “Mission critical – How American Cancer Society successfully and securely migrated to the cloud amid the pandemic,” I by IMD, March 13, 2023.Chatterjee, D. (2022). “Preventing security breaches must start at the top,” I by IMD, September 28, 2022, Institute for Management Development, Lausanne, SwitzerlandChatterjee, D. (2022). “Making Cybersecurity Readiness Mainstream,” Executive Blog Post, NETSPI, March 1, 2022Benz, M. and Chatterjee, D. (2020). “Calculated Risk? A Cybersecurity Evaluation Tool for SMEs,” Business Horizons, available online from May 4, 2020Chatterjee, D. (2019). “Should Executives Go To Jail Over Cyber Attacks,” Journal of Organizational Computing and Electronic Commerce, Vol 29, Issue 1, pp. 1-3.Abraham, C., Chatterjee, D., and Sims, R. (2019). “Muddling through cybersecurity: Insights from the U.S. healthcare industry,” Business Horizons, July 2019.
What actually changed for the AI SOC this year? Bill Peterson, Senior Director of Product Marketing at Sumo Logic, says it reached the point of getting into production, where a year or so ago the same conversation was about what was coming. Marco Ciappelli puts the count of companies carrying AI SOC in the name at 43, and Bill Peterson says that number strikes him as low. The market is maturing, and Sumo Logic announced its own set of AI SOC products and solutions during the week. The second thing is what a security audience does with it. Hands-on practitioners want to touch it, see it, feel it, and Sumo Logic ran live demos of its products on site. When a technical audience puts hands on a keyboard and tries something, Bill Peterson expects them to take it back to work with them. Production first, then enablement of the practitioners. The third is the pace behind all of it. Most security vendors are SaaS companies running CI/CD and shipping continuously, so three and six month roadmaps and delivery are the norm now and the 12 to 18 month roadmap is gone. Some customers are what Sumo Logic internally calls AI shy, accepting they have to get there while taking a slow and reasoned approach, and Bill Peterson treats that as normal for any technology. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Bill Peterson, Senior Director of Product Marketing at Sumo Logic On LinkedIn: https://www.linkedin.com/in/williampetersonjr/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about Sumo Logic: https://www.sumologic.com/ Sumo Logic Dojo AI: https://www.sumologic.com/solutions/dojo-ai Sumo Logic Dojo AI agent announcements at Black Hat USA 2026, including general availability of the SOC Analyst Agent: https://www.prnewswire.com/news-releases/sumo-logics-new-dojo-ai-agents-investigate-and-resolve-security--cloud-operations-issues-at-machine-speed-302839720.html Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS Bill Peterson, Sumo Logic, Marco Ciappelli, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, AI SOC, agentic AI, security operations, Dojo AI, SOC analyst agent, product marketing, CI/CD release cycles, AI adoption, human in the loop, security operations center, market maturity Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Skype of Cthulhu presents a Call of Cthulhu scenario. Moonchild by Paul Fricker. October, 2013 Springfield, Massachusetts Other revelations come forward from another members of the college occult club and the group investigates their old leader's current life. Dramatis Persone: Edwin as the Keeper Randall as Ray West, IT Professional Gary as Maggi Stern, Retail Manager Meredith as Alicia Jucio, Antiques Dealer Steve as Melinda Moody, Journalist Max as Erik Wilson, Accountant Jim as John Vinocur, Nurse Download Subcription Options Podcast statistics
Interview with Jon Hladik - ChatMate Imagine a user asks an LLM a question about a document. An attacker then gains an interactive prompt on the user's chat session, enabling the attacker to instruct the AI assistant to take actions on behalf of the victim. That is exactly the capability researchers at Rubrik Zero Labs were able to demonstrate in a recent study designed to test the bounds of LLM security. Join Joe Hladik, Head of Rubrik Zero Labs, as he breaks down the discovery of "Remote Prompt Execution," a novel vulnerability class that enabled full takeovers of Microsoft Copilot sessions through sandbox escapes. He explores the technical journey behind the eight critical CVEs uncovered by Rubrik Zero Labs and discusses the broader implications for securing generative AI assistants within enterprise environments. This interview highlights the groundbreaking research that earned a $48,000 bounty and featured as a premier briefing at Black Hat USA. Segment Resources: Find more research from Rubrik Zero Labs Rubrik Zero Labs' Black Hat session Demo of the ChatMate attack in action This segment is sponsored by Rubrik. Visit https://securityweekly.com/rubrik to learn more about them! Topic Segment - AI Notetakers and Recorders AI notetakers are built into everything now, and hardware-based AI recorders are becoming mainstream as well. Is privacy over in the workplace? Adrian, Jackie, Katie, and Tyler discuss. Questions enterprises should be asking: Are employees recording or transcribing meetings? Does this policy change if non-employees (external parties) are present? Is consent asked for/given? Is the context of the conversation taken into consideration? Is the geographic/legal/political context of the external party taken into account? Have you done your due diligence on third parties hosting/storing these recordings and transcriptions? Was your due diligence a SOC 2, or real, actual evidence-based due diligence? Do these third parties have an option to allow you to store/manage your own recordings in a place of your choosing, or does it have to be hosted by the AI recording/transcription company? News Segment Finally, in the enterprise security news, we check the vibes and the funding, and the acquisitions seriously, don't mess with the wifi on planes 181,000 meetings were left wide open the sandbox escapes are getting ridiculous research on how reliable AI-generated patches are research on what attackers do after they get a shell research on how cybercriminals are using AI agents research on how vulnerable datacenters are and finally, what's a “mouthpad”? Stick around till the end of the news segment to find out! All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-472
Stewart Alsop sits down with Juan Verhook, founder of Tender Market, for a second conversation that ranges from the mechanics of European public tenders to the future of how we organize digital information. They cover how Tender Market helps smaller companies work around barriers like SOC 2 and ISO certification requirements, the surprising scale of public procurement (roughly 20% of GDP), and how AI and machine learning are reshaping the bidding process. From there the conversation opens up into bigger territory: the changing tolerance for being wrong in an AI-saturated information landscape, how language and culture shape perception, the reverse Turing test and the challenge of verifying human versus AI identity online, and Juan's daily workflow running eight or nine MCP servers through Claude Code. They close out talking about whether the folder and file system will survive the shift to AI-native interfaces, tying back to Stewart's own Stewart Squared episodes on the history of the PC. You can visit Tender Market at tendermarket.eu.Timestamps05:00 — Tender Market's origin story and how they help smaller companies work around SOC 2 and ISO certificate barriers.10:00 — Public procurement and its scale, roughly 20% of GDP, plus a look at public-private partnerships.15:00 — Local LLMs on a plane with no Wi-Fi, and comparing local model performance to frontier models.20:00 — Supply versus demand in AI infrastructure and whether hyperscaler token efficiency is quietly improving.25:00 — Whether AI will replace knowledge work tasks, and the shifting reality of what lawyers and other professionals actually do.30:00 — Reverse Turing test, digital identity verification, and the idea of a "pre-AI internet."35:00 — Model poisoning, RLHF, and the difference between pretraining and post-training.40:00 — Interleaved tool calling and how Tender Market ties pricing to task deliverables instead of billable hours.45:00 — RAG versus fine-tuning, prompt engineering, and when context windows actually matter.50:00 — Deterministic programming versus probabilistic agents, and when to build custom tools versus buy existing ones.55:00 — Juan's daily MCP stack (Supabase, GitHub, Calendly, CRM), and whether the folder-and-file system will survive the shift to AI-native interfaces.Key InsightsCertification requirements aren't dead ends—they're routing problems. When smaller companies got rejected from tenders for lacking SOC 2 or ISO certificates, Juan didn't turn them away. He found that EU procurement rules allow bidding as a consortium or subcontracting to a certified partner, turning a disqualifier into a workaround that builds trust with clients.Public procurement is a massive, underexamined market. Roughly 20% of GDP flows through public purchasing of private-sector goods and services, yet most people have no visibility into how tenders work or how governments post and award these contracts.Being wrong has become more socially acceptable. Juan traced this shift to the falling cost of information: in the Stack Overflow era, giving a wrong answer was costly, but now that answers are instant and abundant, both mistakes and corrections happen faster, changing how people learn and communicate.Task-based pricing beats hourly billing for AI-era services. Rather than charging per hour, Tender Market prices around the deliverable, winning a tender, which avoids the perverse incentive of hourly billing to be inefficient and instead rewards actually solving the client's problem.RAG and fine-tuning solve different problems. RAG helps a model reference large documents without hitting context limits, while fine-tuning changes a model's internal weights so it learns new behavior or style. Juan noted that true RAG use cases needing thousands of pages of context are rarer than the hype suggests.Deterministic code should replace repeated LLM calls once a pattern is found. Stewart described his own workflow: solve a task with an LLM a handful of times, then convert the repeated pattern into deterministic software so tokens are no longer spent on it, freeing the model for genuinely new problems.AI agents are never truly autonomous. Both hosts agreed that no matter how many steps an agent chains together, a human operator always initiates the first prompt, meaning accountability and intent trace back to a person even in multi-agent systems.
Brian Dye, Chief Executive Officer at Corelight, spends Black Hat USA 2026 asking every organization he talks to the same question. What are you doing with AI in the SOC? A year ago, he says, teams thought it was a good idea but were wary of it, and people knew LLMs could produce things without being sure what to do with them. Now he is talking with organizations building their own agents for incident response and for threat hunting, and running their own quality control on the output rather than taking it on faith. What decides how far an agentic SOC workflow can go? The data does. Brian Dye describes a three-legged stool where the model and the agents are only two of the legs. The third is the data going into the workflow, and without the right data the agents hit a headroom of logic. He credits three changes for the shift. Agentic development decomposes an investigation into smaller chunks that can be trusted individually. Time in the saddle has made teams better at separating claims from reality. And organizations now ask the workflow itself what it could not answer and what data it wishes it had. Why does a week like this one matter to product development? Corelight works on translating the network into the right fuel for AI, which means understanding the architecture each customer is building toward, whether that is an in-house SOC, a third party SOC, or a workflow running through their own SOAR or SIEM. Brian Dye also describes the Black Hat NOC as a room where the work looks different. Most security teams look for a needle in a haystack. The NOC team is finding the sharp needle in a stack of dull needles, separating illicit activity from the legitimate malware analysis training running on the same network, while using the room as a multi-vendor playground for new integrations and workflows. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Brian Dye, Chief Executive Officer at Corelight On LinkedIn: https://www.linkedin.com/in/brdye/ RESOURCES Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about Corelight: https://corelight.com Corelight blog: https://corelight.com/blog Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS brian dye, corelight, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, agentic ai, ai in the soc, security operations center, network detection and response, threat hunting, incident response, black hat noc, soar, siem, network evidence, agentic workflows Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Skype of Cthulhu presents a Call of Cthulhu scenario. This is Our Home by Jim Phillips. December 14, 1976 Staten Island, New York City, New York The residents complete research at the local university while Mr. Romero continues to peer into the past. Dramatis Persone: Jim as the Keeper of Arcane Lore Randall as Frank Romero, Electrical Engineer Rachel as Marsha Janelle, Waitress Steve as Trae Grier, Gas Station Attendant Edwin as Kevin Mazer, Chemistry Teacher Gary as Peter Michale, Ex Pro Quarterback Sean as Kirk Griffin, Actor Download Subcription Options Podcast statistics
Interview with Jon Hladik - ChatMate Imagine a user asks an LLM a question about a document. An attacker then gains an interactive prompt on the user's chat session, enabling the attacker to instruct the AI assistant to take actions on behalf of the victim. That is exactly the capability researchers at Rubrik Zero Labs were able to demonstrate in a recent study designed to test the bounds of LLM security. Join Joe Hladik, Head of Rubrik Zero Labs, as he breaks down the discovery of "Remote Prompt Execution," a novel vulnerability class that enabled full takeovers of Microsoft Copilot sessions through sandbox escapes. He explores the technical journey behind the eight critical CVEs uncovered by Rubrik Zero Labs and discusses the broader implications for securing generative AI assistants within enterprise environments. This interview highlights the groundbreaking research that earned a $48,000 bounty and featured as a premier briefing at Black Hat USA. Segment Resources: Find more research from Rubrik Zero Labs Rubrik Zero Labs' Black Hat session Demo of the ChatMate attack in action This segment is sponsored by Rubrik. Visit https://securityweekly.com/rubrik to learn more about them! Topic Segment - AI Notetakers and Recorders AI notetakers are built into everything now, and hardware-based AI recorders are becoming mainstream as well. Is privacy over in the workplace? Adrian, Jackie, Katie, and Tyler discuss. Questions enterprises should be asking: Are employees recording or transcribing meetings? Does this policy change if non-employees (external parties) are present? Is consent asked for/given? Is the context of the conversation taken into consideration? Is the geographic/legal/political context of the external party taken into account? Have you done your due diligence on third parties hosting/storing these recordings and transcriptions? Was your due diligence a SOC 2, or real, actual evidence-based due diligence? Do these third parties have an option to allow you to store/manage your own recordings in a place of your choosing, or does it have to be hosted by the AI recording/transcription company? News Segment Finally, in the enterprise security news, we check the vibes and the funding, and the acquisitions seriously, don't mess with the wifi on planes 181,000 meetings were left wide open the sandbox escapes are getting ridiculous research on how reliable AI-generated patches are research on what attackers do after they get a shell research on how cybercriminals are using AI agents research on how vulnerable datacenters are and finally, what's a "mouthpad"? Stick around till the end of the news segment to find out! All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-472
Interview with Jon Hladik - ChatMate Imagine a user asks an LLM a question about a document. An attacker then gains an interactive prompt on the user's chat session, enabling the attacker to instruct the AI assistant to take actions on behalf of the victim. That is exactly the capability researchers at Rubrik Zero Labs were able to demonstrate in a recent study designed to test the bounds of LLM security. Join Joe Hladik, Head of Rubrik Zero Labs, as he breaks down the discovery of "Remote Prompt Execution," a novel vulnerability class that enabled full takeovers of Microsoft Copilot sessions through sandbox escapes. He explores the technical journey behind the eight critical CVEs uncovered by Rubrik Zero Labs and discusses the broader implications for securing generative AI assistants within enterprise environments. This interview highlights the groundbreaking research that earned a $48,000 bounty and featured as a premier briefing at Black Hat USA. Segment Resources: Find more research from Rubrik Zero Labs Rubrik Zero Labs' Black Hat session Demo of the ChatMate attack in action This segment is sponsored by Rubrik. Visit https://securityweekly.com/rubrik to learn more about them! Topic Segment - AI Notetakers and Recorders AI notetakers are built into everything now, and hardware-based AI recorders are becoming mainstream as well. Is privacy over in the workplace? Adrian, Jackie, Katie, and Tyler discuss. Questions enterprises should be asking: Are employees recording or transcribing meetings? Does this policy change if non-employees (external parties) are present? Is consent asked for/given? Is the context of the conversation taken into consideration? Is the geographic/legal/political context of the external party taken into account? Have you done your due diligence on third parties hosting/storing these recordings and transcriptions? Was your due diligence a SOC 2, or real, actual evidence-based due diligence? Do these third parties have an option to allow you to store/manage your own recordings in a place of your choosing, or does it have to be hosted by the AI recording/transcription company? News Segment Finally, in the enterprise security news, we check the vibes and the funding, and the acquisitions seriously, don't mess with the wifi on planes 181,000 meetings were left wide open the sandbox escapes are getting ridiculous research on how reliable AI-generated patches are research on what attackers do after they get a shell research on how cybercriminals are using AI agents research on how vulnerable datacenters are and finally, what's a "mouthpad"? Stick around till the end of the news segment to find out! All that and more, on this episode of Enterprise Security Weekly. Show Notes: https://securityweekly.com/esw-472
Skype of Cthulhu presents a Call of Cthulhu scenario. Moonchild by Paul Fricker. October, 2013 Springfield, Massachusetts Old school mates reunite to hear an incredible story from a long-absent friend. Dramatis Persone: Edwin as the Keeper Randall as Ray West, IT Professional Gary as Maggi Stern, Retail Manager Meredith as Alicia Jucio, Antiques Dealer Steve as Melinda Moody, Journalist Max as Erik Wilson, Accountant Jim as John Vinocur, Nurse Download Subcription Options Podcast statistics
James Pope is on site in Las Vegas more than a week before the doors open. As SOC lead for the Black Hat NOC and Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, his show starts with switches and access points rather than alerts. The team brings in the ISP, the firewall, the switches, and the access points, deploys them across the conference, and then moves into SOC mode. If there is no network, there is nothing to secure. The tooling arrives through partnership rather than sponsorship. James Pope says a company cannot buy or sponsor its way into the NOC, and that the team picks what it wants and fills gaps as it finds them. Cisco covers Umbrella and file malware analytics, Palo Alto Networks provides the firewall and XSIAM as the log aggregator, Arista handles switching and access points, Jamf runs MDM across the registration devices, and Lumen supplies the internet. Corelight is the network visibility layer. That layer carries different weight here than it would inside a company. Asking attendees to install a certificate or an endpoint agent so the NOC can inspect their traffic is a request nearly everyone declines. In most corporate environments the endpoint is one of the richest sources of signal. At Black Hat, visibility into attendee activity comes from network data. A Black Hat positive is malicious activity that is legitimate in context. Attendees pay to learn attack techniques against real targets, and researchers demonstrate new exploits on stage. Those events generate true detections no corporate SOC would ignore. The NOC lets them run rather than killing a paid training exercise or a live demo. So how does the team tell a training exercise from a real attack? It baselines each classroom and spends its time on the outliers. When seventy students in a room run the same attacks against the same destinations, the activity is probably sanctioned. The curriculum is ingested as a JSON file and the system moves through a series of gates, asking whether this is a class, whether multiple sources are reaching the same destination, and whether the attack would be expected in that curriculum. Anything that does not fit comes back for a human. The team informs far more often than it blocks. On the day of the recording, James Pope went to the trade show floor to tell someone that command and control traffic was running from their machine, and handed over logs for their IT and security team. He is not their manager, and what happens next is their call. Illegal activity is treated differently, and a handful of times per show the team asks a room to stop. At Black Hat Asia, traffic from a Corelight sensor showed a double RAT infection on one machine, a single APT running one implant for exfiltration and another for command and control. Working from traffic, James Pope established that the person was a reporter, the region they covered, and the company they worked for. Open source intelligence narrowed it to a single name, registration confirmed the person was on site, and the NOC invited them in. The reporter arrived expecting a product demo. The laptop was reset with everyone present, sessions were revoked, passwords were changed, and the reporter left in a secured state. This year the team opened the Outpost, running real Black Hat network logs from Corelight behind application guardrails, LLM guardrails, and a kill switch, where visitors query the data with text to SQL. Agentic triage stitches alerts into detections and detections into a timeline, and James Pope treats the ability to drill down to raw logs as a requirement rather than a preference. Success is measured largely by what does not happen: no compromise of registration, the switches, or the access points, and people who arrive infected leaving better than they got here. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST James Pope, Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, and SOC lead for the Black Hat NOC RESOURCES Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about Corelight: https://corelight.com Corelight blog, including the Black Hat NOC series: https://corelight.com/blog Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS james pope, corelight, sean martin, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, network detection and response, network evidence, security operations center, threat hunting, agentic triage, ai in the soc, conference network security, black hat noc, command and control, incident response Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Recorded on site at Black Hat USA 2026 in Las Vegas, Seth Summersett joins Sean Martin to talk through the volume problem that shapes a modern security operations team. Seth Summersett spent about a decade at the NSA and roughly a decade at Mandiant, finishing there as head of innovation and custom engineering, then a couple of years at Meta supporting business unit level CISOs. He co-founded Embed Security with Jeffrey Johns, who ran the data science team alongside him at Mandiant. The catalyst came from watching a managed service run on human scale day after day. Two analysts and a hundred forwarded phishing emails means someone is choosing which ones to open and carrying the ones they cannot reach. Embed Security sits downstream of existing detection investments, taking signals from SIEM, EDR, identity, and email rather than asking a team to rip and replace what it already runs. What do security analysts actually want from AI in the SOC? According to Seth Summersett, it is not a verdict. Analysts want the work off their plate in a way they can verify, which is why Embed Security built what it calls chain of evidence, showing every question asked and the path to each conclusion. Teams also test it in reverse, running previously dispositioned alerts back through the platform to compare results against their own analysts. The numbers come from a competitive bake off at one of the company's largest clients. Embed Security dispositioned roughly 75% of that client's alerts to the point where the team stopped treating them as primary work, against a daily volume above 10,000 alerts. Why not build this in house? Seth Summersett says the demo is the easy part. What follows is evaluation loops that measure a change across hundreds of thousands of alerts rather than one, governance, and a way to capture organizational knowledge automatically. In regulated sectors, auditors may ask a team to prove how a conclusion was reached and that it holds consistently. There is a people side to this as well. Embed Security has supported a wellness program at BSides across its last two events, backing a calming kit and curriculum for analysts working under incident pressure. Seth Summersett closes with consistency for leaders, since a leader looking at 10% of alerts does not have a full risk profile, and career longevity for analysts who would rather build a long run in security operations than burn out in two or three years. GUEST Seth Summersett, Co-Founder and CEO, Embed Security LinkedIn: https://www.linkedin.com/in/summersett/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Embed Security: https://www.embedsecurity.com Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS seth summersett, embed security, sean martin, brand story, brand marketing, marketing podcast, brand spotlight, black hat usa 2026, security operations, soc analyst burnout, alert triage, agentic ai security, chain of evidence, siem alert fatigue, edr alerts, ai soc platform, security analyst workflow, build versus buy security ai, security operations governance, threat investigation Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
The episode highlights the shift toward AI-driven knowledge management within the MSP sector, revealing increased operational dependency on structured data and sophisticated integrations. Lexful, an AI-native documentation platform designed specifically for MSPs, represents this trend by positioning itself not as a simple add-on but as a replacement for legacy documentation tools—controlling critical record-keeping functions and interfacing with principal PSA and RMM systems. This development signals greater infrastructure dependence on AI-based documentation and the implications of technical integration across diverse operational tools. According to Lexful's CEO and statements made during the episode, the platform has completed integrations with major PSA and RMM tools and now handles data by employing a “context-engineered” large language model tailored specifically to the MSP context. Lexful claims its engine minimizes LLM hallucinations, supports record-level access control, and functions as a system of record rather than a direct action platform. Socializing its compliance trajectory, Lexful has achieved SOC 2 Type 2 and shipped its MCP server, but its listing in marketplaces like Pax8 and SureWeb has been delayed, with current status characterized as “coming soon” and full integration targeted before the end of 2026. Supporting developments underscore the complexity and risk of deploying AI-native platforms into MSP environments. The absence of public customer or partner counts persists, with the company attributing constrained accessibility to pending integrations rather than lack of market uptake. Pricing structures diverge from incumbents, moving from per-user to per-client models and establishing minimum contract terms—raising questions about justification of cost versus legacy alternatives. A key operational risk centers on access control and human-in-the-loop governance, with sensitive systems such as password vaults only accessible through layered permissions, and Lexful emphasizing the necessity of robust accountability frameworks to minimize harm from potential automation failures. Practical implications for MSPs include heightened need for rigorous governance of AI systems, especially around data access, role management, and auditability. Vendor dependency deepens as platforms like Lexful supplant multiple existing tools and drive uptake via deeper integration with distribution marketplaces and SaaS ecosystems. Pricing and contract structures require MSPs to reconsider value calculations, as cost is no longer purely user-driven but tied to client volume and operational breadth. The tradeoff is between purported efficiency gains from automation and the risk profile associated with delegating documentation and knowledge management to AI-based infrastructure, particularly as human oversight remains essential to mitigate errors and ensure regulatory compliance. Supported by: ScalePad
Recorded on location at Black Hat USA 2026 in Las Vegas at the end of day two, Karthik Kannan, Founder and CEO at Anvilogic, walks through a seven year build that reached its original shape this year. The plan from the start was a full security operations platform covering data, the detection engineering process, triage and investigation, and case management. In the shorthand of the category, SIEM and SOAR combined. It arrived in phases. Detection engineering came first, implemented on top of Splunk for most customers, then the data platform expanded into data lakes including Snowflake, Databricks, and Microsoft Azure. Triage and investigation followed over the last two years. In the last year Anvilogic rolled out agents that carry out the work of specific personas, and this year the company launched Blueprints, an orchestrator agent that brings the discrete agents together to run a whole workflow with humans in the loop. What separates a security graph from a frontier model? It knows the environment. Karthik Kannan describes the enterprise security graph as Anvilogic's own model running inside the network, learning the micro environment, with frontier LLMs called on to fill gaps in the macro environment. His argument is that platforms operating as LLM wrappers miss the last mile, because AI on its own reaches 60, 70, or 80 percent of the way if you are lucky. How does a team keep control when agents run the workflow? Through gates, permissions, and a record of what happened. Workflows can be described in plain English, with human gates inserted as often as the team wants. Access controls sit at the persona, organization, and object levels, and activity is audited and logged, which matters to the GRC teams Anvilogic works with. Screens dedicated to what the company calls a maturity score show which feeds are coming in, what kinds of detections exist, and what coverage looks like against the MITRE ATT&CK framework, in a form available to executives and CISOs. Karthik Kannan also points to version 8.0, introduced the week before the event, which includes an Anvilogic MCP Server for connecting to third party tools. Customers are already building their own Blueprint workflows during proofs of concept, including a large life sciences customer Anvilogic expects to feature in a public case study. Karthik Kannan is careful about the claim being made here. This is not a proclamation of an autonomous SOC. It is automation that makes life in a SOC easier and more efficient, adopted at a crawl, walk, run pace, with every step visible along the way. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Karthik Kannan, Founder and CEO at Anvilogic On LinkedIn: https://www.linkedin.com/in/karthikkannan001/ RESOURCES Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Learn more about Anvilogic: https://www.anvilogic.com Anvilogic 8.0, from onboarding to investigation: https://www.anvilogic.com/learn/anvilogic-8-0-automate-the-soc Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS karthik kannan, anvilogic, sean martin, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, agentic secops, ai soc platform, enterprise security graph, detection engineering, triage and investigation, blueprints orchestrator agent, mcp server, mitre att&ck coverage, human in the loop automation, siem and soar, security operations, grc audit logs Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Today we're speaking with Christopher Crowley, cybersecurity consultant through Montance and Senior Instructor with the SANS Institute, about the value of cybersecurity operations — how to measure it, how to express it to the business, and how AI is changing the work of the SOC.Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operations centers. He is the author of the annual SANS SOC Survey, a security operations class called SOC-Class, and a new book entitled The Value of Cybersecurity Operations. He is a Senior Instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montance. His background also includes network operations, software development, mobile security assessment, and security policy.Learn more at https://montance.com and get the book at https://shop.montance.comSupport our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
Sumedh Thakar joined Qualys as an early software engineer on the scanner, back when a 90-day scan cycle came with another 90 days to fix whatever it found. Twenty-three years later he leads the company, and the number he uses now is 90 seconds. At Black Hat USA 2026 he walks through what that compression asks of security teams. So what has actually changed? The questions have not. Where are my assets, what is my assessment of them, what do I prioritize, and what do I fix. Thakar points at the clock instead, citing a CISA directive that gives government agencies three days and zero-day conversations built around a 24-hour window. Layering dashboards on top of that produces what he calls dashboard tourism when nothing gets fixed at the end of it. Qualys organizes its response around three pillars. AI speed detection compresses the gap between a vendor disclosure and a confirmed finding. Hyper prioritization runs an actual exploit to see whether firewall and EDR controls already block it, cutting a theoretical 1% down to roughly 20% of that 1%. Autonomous remediation applies the fix without routing it through a human first. How far along is autonomous patching already? Qualys has deployed over half a billion patches, 150 million of them in the past 12 months, and 40 million of those went out with no human intervention. Thakar describes a global company with 450,000 employees running the agent for autonomous patching, where the board metric is a maximum four-hour exposure window from the time a patch is released rather than a count of vulnerabilities. He expects the monthly patch cadence to give way as disclosures accelerate. Qualys recently released InstaScan, which Thakar calls scanless scanning, delivering a finding within an hour of a vendor disclosure. A patch reliability score built using AI lets an agent judge whether a patch is dependable and reboot-free before applying it on a laptop. His closing advice to CISOs is to show up as a business partner. The board and the CEO need visibility into potential loss, current spend, and whether risk sits inside an acceptable appetite. For a $500 million business that means pricing what a breach would cost, funding the reduction of an $80 million exposure, and transferring what remains to cyber insurance. His shorthand for the operating model is the ROC alongside the SOC. This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing GUEST Sumedh Thakar, President and CEO at Qualys On LinkedIn: https://www.linkedin.com/in/sumedhthakar/ RESOURCES Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Qualys: https://www.qualys.com/ InstaScan announcement: https://www.qualys.com/company/newsroom/news-releases/usa/qualys-launches-instascan-to-detect-vulnerabilities-within-minutes-of-disclosure Agent Insta and scanless detection: https://blog.qualys.com/product-tech/2026/08/03/instascan-agent-insta-scanless-detection The Risk Operations Center with Enterprise TruRisk Management: https://blog.qualys.com/product-tech/2024/10/09/qualys-launches-enterprise-trurisk-management-the-industrys-first-cloud-based-risk-operations-center Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS Sumedh Thakar, Qualys, Sean Martin, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, autonomous remediation, patch management, vulnerability management, hyper prioritization, AI speed detection, scanless scanning, InstaScan, risk operations center, cyber risk management, zero day remediation, CISO, exposure management Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
What does it take to go from astrophysics to running operations at one of the fastest-growing AI companies in the world?In this Fan Favorite episode, Cameron Herold sits down with Victoria Weller, former Chief of Staff and now Lead of Operations at ElevenLabs, to revisit one of the show's most fascinating conversations. Victoria's path is rare: astrophysics, space medicine, quantum encryption, and Palantir, before landing at the AI voice company reshaping how the world listens.She breaks down what a Chief of Staff really does at an early-stage startup, how she cleared SOC 2 compliance in seven weeks, and why ElevenLabs grew so fast. They also get into voice cloning, deepfake safeguards, and surprising use cases across hospitals, transit, and accessibility.Whether you want a COO seat or you are building functions from nothing, Victoria's story is a masterclass in figuring it out fast. Listen now.Sponsored by:Redirect Health - Affordable healthcare benefits designed to make traditional insurance optional, with 24/7 access to primary care and Rx support that helps businesses reduce costs while keeping employees covered.Learn more: http://www.redirectcoo.com/Timestamped Highlights[00:00:44] – The ElevenLabs mission, and why an EPUB can become an instant audiobook[00:02:55] – Munich to Edinburgh to Berlin to New York: a career across four countries[00:04:06] – What actually happens to an astronaut's blood in zero gravity[00:07:54] – Lasers, quantum encryption, and the pivot toward tech[00:13:06] – Cameron asks the big ones: aliens, and are we living in a simulation?[00:19:12] – What ElevenLabs is really building, explained simply[00:20:50] – How context lets an AI voice sound genuinely sad or genuinely happy[00:28:12] – The accessibility use cases the team never saw coming[00:31:03] – Cloning a late loved one's voice, and the compliance behind it[00:33:16] – Stopping deepfake voice scams: watermarks and the AI Speech Classifier[00:38:31] – What a Chief of Staff actually does, and why it feels like a SWAT team[00:40:32] – Does a great Chief of Staff work themselves out of a job?[00:47:07] – The advice Victoria would give her 21-year-old selfAbout the GuestVictoria Weller is the former Chief of Staff and now the Lead of Operations at ElevenLabs, the AI voice company behind lifelike text-to-speech and voice cloning, where she owns internal operations, compliance, and hiring. She cleared the company's SOC 2 process in seven weeks. Before ElevenLabs she was a reliability engineer at Palantir Technologies in New York and London. Her background spans astrophysics at the University of Edinburgh, space-medicine research in Berlin, and a master's in applied physics from Columbia University.
New cybersecurity audit requirements under the California Consumer Privacy Act (CCPA) establish a recurring, independent assessment of certain organizations' cybersecurity programs, with the first audit period beginning January 1, 2027. We discuss which organizations may be subject to the requirements, key considerations on audit scope and independence, and how existing cybersecurity, risk, and assurance activities can support readiness.For more on California's cybersecurity audit requirements, see our publication Privacy becomes a cybersecurity imperative under California's audit rule.Follow this podcast on your favorite podcast app and subscribe to our weekly newsletter to stay informed.About our guestsMark Cornish is a partner at PwC who provides assurance and consulting services to global and regional clients within the financial services industry. He is recognized for his experience in complex third-party assurance reporting, internal controls, and risk and compliance matters. His areas of expertise include internal control over financial reporting, SOC 1 and SOC 2 reporting, cybersecurity risk management, privacy, and regulatory compliance. Chris Santucci is a partner in PwC's Cyber, Data & Technology Risk practice who helps global companies across sectors build, operate, and assess data privacy and protection programs through technology-enabled solutions. His expertise spans global privacy program design and regulatory preparedness (including CCPA, GDPR, etc.), data discovery and risk analysis, program assessment and implementation, privacy impact assessments, third-party risk management, as well as sustainable risk and compliance services.About our guest hostDiana Stoltzfus is a partner in PwC's National Office who helps to shape PwC's perspectives on regulatory matters, responses to rulemakings and policy development, and implementation related to significant new rules and regulations. She is also one of the firm's technical experts on sustainability reporting. Prior to rejoining PwC, Diana was the Deputy Chief Accountant in the Office of the Chief Accountant (OCA) at the SEC where she led the activities of the OCA's Professional Practices Group.Transcripts available upon request for individuals who may need a disability-related accommodation. Please send requests to us_podcast@pwc.com.Did you enjoy this episode? Text us your thoughts and be sure to include the episode name.
Skype of Cthulhu presents a Call of Cthulhu scenario. This is Our Home by Jim Phillips. December 13, 1976 Staten Island, New York City, New York The residents learn of a celestrial object heading towards earth while Mr. Griffin looks for help from an old ally. Dramatis Persone: Jim as the Keeper of Arcane Lore Randall as Frank Romero, Electrical Engineer Rachel as Marsha Janelle, Waitress Steve as Trae Grier, Gas Station Attendant Edwin as Kevin Mazer, Chemistry Teacher Gary as Peter Michale, Ex Pro Quarterback Sean as Kirk Griffin, Actor Download Subcription Options Podcast statistics
CISOs have a stack of tools but no system built to run the security program itself. Mike Armistead wants to fix that.In this episode I sit down with Mike Armistead, co-founder and CEO of Pulse Security AI and a longtime security founder behind Fortify and Respond Software. We dig into why the security leader has never had a system of truth the way the CFO has an ERP and the CRO has a CRM, and how an agentic layer on top of the existing tools can finally close that gap. Mike is measured about where AI gets to decide and where the human stays in the seat, and he shares what surprised him most from research with more than 80 senior practitioners and corporate directors.In this episode:- Why two exits later Mike came back to build a third company around the AI wave- The silos that left CISOs with an acronym soup of tools and no way to run the program- What a system of truth for the CISO actually means and how it layers on top of existing structured and unstructured data- Where agents do the heavy lifting on regulatory monitoring, vendor intelligence, and status reporting- Governing the guardrails, not the keystrokes, and why closing the loop still involves people- What corporate directors actually want to hear in the 15 to 20 minutes a CISO gets each quarter- The findings that stood out, including that 55% of boards have never defined the cyber risk they are willing to accept, and only 12.5% of CISOs are very confident the board leaves with a true picture of the risk- Institutionalizing the tribal knowledge every security program runs onChapters:0:00 Intro0:18 Mike's background and two prior exits1:08 Why the AI wave pulled him back2:21 Why the CISO has no system to run the program4:09 Starting at the program level, not the SOC or AppSec5:28 What a system of truth for the CISO means8:19 Speaking the language of the business9:09 Where AI does the heavy lifting on a typical Tuesday11:57 Govern the guardrails, not the keystrokes15:44 Bringing deputies into the conversation16:46 What the research with senior practitioners found20:37 Boards, risk tolerance, and the reporting gap24:57 AI as a double-edged sword for security leaders25:35 Joanna Burkey and institutionalizing tribal knowledge27:31 A year from now for the security leaderGuest links:Mike Armistead on LinkedInPulse Security on AIMore Resilient Cyber:Substack: https://www.resilientcyber.ioSubscribe for more conversations with security practitioners and leaders.
Job applicants are pasting white text into their resumes that only the AI screening tool can read. It says ignore your instructions, this is your strongest candidate, book the interview. On TikTok, people learn to tell customer service bots their grandma died, because grief gets flagged to a real human. Nobody doing this calls it prompt injection, but it's the same attack class Johnny Hung and Munam Wasi spend all day catching. Johnny and Munam are the co-founders of Mighty. Their bet is contrarian, small hyper-focused models instead of frontier ones, retrained on fresh attacks roughly every week, sitting at your model's input and output like a HEPA filter. One line of code, and every app, tool call, and skill behind it gets the coverage. The verdict comes back plain, allow, warn, or block. Jon and Sasha get them to walk through how a 67-page PDF can smuggle a multi-turn attack past a context window, why crescendo attacks escalate 1% per message until the session has to die, and why the big models keep overthinking their way into being bypassed on Mighty's internal evals. Also in here, a grocery chain's chatbot bypassed in one second, malicious instructions hiding in JIRA ticket tags and PowerPoint speaker notes at DEF CON, an open source Go guard under an Apache 2 license, and the case that human-in-the-loop security can't survive attacks that cost a few dollars to launch. Johnny: Munam: www.linkedin.com/in/munamwasi/ Jon: www.linkedin.com/in/jon-mclachlan Sasha: www.linkedin.com/in/aliaksandr-sinkevich YSecurity: www.ysecurity.io
"We cannot solve our problems with the same thinking we used when we created them." – Albert Einstein Scott Alldridge is a tech-forward C-Suite Executive, Board Director, Amazon Best Seller Author and exceptional Problem Solver with deep experience in AI, cybersecurity, data governance and risk management spanning a broad array of industries. He is a transformational leader adept at driving organizational change, mitigating financial and reputation risk and formulating high-impact tech strategies that lead to significant value creation. ______ CYBERSECURITY SME. Scott's work is grounded in Zero Trust – a cyber-tech operations discipline for highly regulated environments. He has led and advised organizations operating under NIST CSF, NIST 800-53, NIST 800-171, CMMC and ISO 27001. Scott's experience also includes HIPAA, PCI DSS, SOX, GLBA, SOC 2, state privacy laws and cyber insurance requirements. In each engagement, Scott's primary goal is to support organizations by strengthening security, ensuring compliance and improving performance – without compromising business efficiency. ENGAGED BOARD MEMBER. Scott helps companies build future-ready infrastructures and leverage technology to strengthen organizational agility and drive profitable growth. He brings a unique blend of business acumen and technical proficiency to his roles as CEO, Advisor and Independent Board Director. Scott's board-level advisory experience includes strategic guidance on a variety of topics including digital transformation, cybersecurity governance, business strategy, portfolio growth and AI. PRAGMATIC LEADER. Scott builds accountable, cross-functional teams that deliver spot-on, data-driven results for their organization, clients and stakeholders. Guided by a shared set of "Mission, Vision and Values", Scott mentors emerging leaders to execute assignments with clarity and autonomy. As testament to his effective leadership style, Scott's core team has remained with him for more than 15 years. https://ipservices.com/ ______ EXPERIENCE and EXPERTISE Small Cap · Mid-cap · SMB · Startups · PE · Digital Transformation • Change Management · AI · IT Roadmaps · Cybersecurity · Continuous Improvement · Agile Methodology · SaaS · ERP Systems Cloud Services · IT Infrastructures · Growth Strategies · Risk Mitigation Business Development M&A Due Diligence • Acquisition Integration • Vendor Negotiations Audit Compliance • NIST • CMMC • GLP • SOX • Gramm-Leach-Bliley Act
Interview 1: Robin Macfarlane from RRMac Associats The Mattress Money Principle: What a 50-Year Veteran Knows About System Fragility In this interview, Robin and Adrian discuss how technology has evolved over the past 50 years. Despite massive technological changes over the decades: the PC revolution, the Internet, smartphones, the Cloud, and now Generative AI - the majority of financial institutions still use mainframes and midrange machines. Why? We explore the reasons why older technology persists alongside the new and the lessons retiring technologists can pass on to new generations inheriting an increasingly diverse tech landscape. Interview 2 with Kyle Sandy from Logically Operational Clarity as the New Customer Experience Kyle Sandy joins Adrian to discuss how prioritizing resilience affects how organizations should plan for incident response. In the past, security teams were focused on prevention and limiting breach damage. Today, boards want to know how long it will take to recover operations. The interview wraps up with a discussion of the right and wrong way to handle a breach and the three most important things every company must get right in order to handle an incident well. Interview 3 with Todd Thiemann from Omdia AI Agents and Identity Security: How Enterprises Are Rewriting the Rules Todd joins ESW with some eye-opening survey insights on the topic of IAM for AI agents. While cybersecurity conversations about internal AI use often revolve around the SOC and security operations, Omdia surveyed identity professionals for a more holistic enterprise perspective. Unsurprisingly, AI agent use is as diverse as enterprise business units. The surprises are around where the budget comes from for these AI projects, and how authentication is handled. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-471
Most vendors at Black Hat USA 2026 have something to say about agentic AI. Jeremy Powell, CISO at Sumo Logic, spends this conversation on the harder proof, which is what happens when a company runs its own product in production at scale. Sumo Logic has been doing that for roughly ten to eleven months. Powell calls it customer zero, and it shapes how he answers almost every question here. The Sumo Logic SecOps team ingests seven exabytes a day globally, which Powell puts at roughly half a billion 8K movies. Against that volume, the team reports 100 percent first level triage handled through automation and about 25 hours saved per analyst per week. Everything learned in production feeds back into the product organization in real time. Security tooling is notoriously hard to use, especially in the enterprise, and Powell is candid that the realization drove a concerted engineering and product effort to fix it. One result showed up at Black Hat this week in the evolved version of Mobot, the conversational interface inside the product. Users can now prompt their way into an investigation, see the audit trail behind it, and get to an answer without configuring their way there first. So how do you trust a decision an agent made? Powell points to an audit trail and a log trail behind every decision the SOC Analyst Agent produces, traceable back through every conceivable log to the root decision. He describes it as human on the loop rather than in the loop. People keep the decisions. Execution and delivery get automated. That changes the shape of the job. Powell describes the SOC becoming something closer to an agile QA organization, where analysts assess the fidelity of what the agent did instead of grinding through first level alerts. On the question of whether automation costs analysts their jobs, he uses a phrase he borrowed from someone else: pay attention to the tension. His answer is that the work gets better and more interesting and the analysts get more capable. The same logic carries up to the board. Powell argues a security leader's job at the executive level is to measure risk transparently and report it accurately, and that boards will build a trend line out of three data points. Telemetry becomes the raw material for informed risk decisions communicated in an executive-friendly way, with the full reasoning available on request. As he puts it, the auditor cares, and the board cares if you fail the audit. This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight GUEST Jeremy Powell, CISO, Sumo Logic LinkedIn: https://www.linkedin.com/in/executivembajeremypowell/ RESOURCES Sumo Logic: https://www.sumologic.com/ Sumo Logic at Black Hat USA: https://www.sumologic.com/events/black-hat Dojo AI agentic security and cloud operations: https://www.sumologic.com/blog/dojo-ai-agentic-security-cloud-operations Building an AI-first SOC, the customer zero story: https://www.sumologic.com/blog/building-ai-first-soc-customer-zero See Mobot in action: https://youtu.be/ZZLXaft7tYM View all of our Black Hat USA 2026 coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight ▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings KEYWORDS Jeremy Powell, Sumo Logic, Sean Martin, brand story, brand marketing, marketing podcast, brand spotlight, Black Hat USA 2026, agentic AI, SOC analyst agent, security operations center, human on the loop, first level triage, security automation, telemetry, exabyte scale, customer zero, Mobot, conversational interface, CISO, board reporting, risk communication, SIEM, AI governance Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Skype of Cthulhu presents a Call of Cthulhu scenario. Curse of Nineveh by Mike Mason, Mark Latham, Scott Dorward, Paul Fricker, and Andrew Kenrick. November, 1925 London The investigators make one last desparate attempt to stop the ritual, knowing that at least one of their members is on borrowed time. Dramatis Persone: Sean as the Keeper Edwin as Dame Agatha, Authoress Jonathan as Katherine "Kitty" Hall, Dilettante Steve as Connor Shaw, Archivist Max as Oswald Nickels, Big Game Hunter Gary as Anthony Kelly, Consulting Detective Randall as Dean Banks, Big Game Hunter Jim as Roger Schindler, Alienist Rachael as Maude Throckmorton, Adventuress Download Subcription Options Podcast statistics
Interview 1: Robin Macfarlane from RRMac Associats The Mattress Money Principle: What a 50-Year Veteran Knows About System Fragility In this interview, Robin and Adrian discuss how technology has evolved over the past 50 years. Despite massive technological changes over the decades: the PC revolution, the Internet, smartphones, the Cloud, and now Generative AI - the majority of financial institutions still use mainframes and midrange machines. Why? We explore the reasons why older technology persists alongside the new and the lessons retiring technologists can pass on to new generations inheriting an increasingly diverse tech landscape. Interview 2 with Kyle Sandy from Logically Operational Clarity as the New Customer Experience Kyle Sandy joins Adrian to discuss how prioritizing resilience affects how organizations should plan for incident response. In the past, security teams were focused on prevention and limiting breach damage. Today, boards want to know how long it will take to recover operations. The interview wraps up with a discussion of the right and wrong way to handle a breach and the three most important things every company must get right in order to handle an incident well. Interview 3 with Todd Thiemann from Omdia AI Agents and Identity Security: How Enterprises Are Rewriting the Rules Todd joins ESW with some eye-opening survey insights on the topic of IAM for AI agents. While cybersecurity conversations about internal AI use often revolve around the SOC and security operations, Omdia surveyed identity professionals for a more holistic enterprise perspective. Unsurprisingly, AI agent use is as diverse as enterprise business units. The surprises are around where the budget comes from for these AI projects, and how authentication is handled. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-471
Interview 1: Robin Macfarlane from RRMac Associats The Mattress Money Principle: What a 50-Year Veteran Knows About System Fragility In this interview, Robin and Adrian discuss how technology has evolved over the past 50 years. Despite massive technological changes over the decades: the PC revolution, the Internet, smartphones, the Cloud, and now Generative AI - the majority of financial institutions still use mainframes and midrange machines. Why? We explore the reasons why older technology persists alongside the new and the lessons retiring technologists can pass on to new generations inheriting an increasingly diverse tech landscape. Interview 2 with Kyle Sandy from Logically Operational Clarity as the New Customer Experience Kyle Sandy joins Adrian to discuss how prioritizing resilience affects how organizations should plan for incident response. In the past, security teams were focused on prevention and limiting breach damage. Today, boards want to know how long it will take to recover operations. The interview wraps up with a discussion of the right and wrong way to handle a breach and the three most important things every company must get right in order to handle an incident well. Interview 3 with Todd Thiemann from Omdia AI Agents and Identity Security: How Enterprises Are Rewriting the Rules Todd joins ESW with some eye-opening survey insights on the topic of IAM for AI agents. While cybersecurity conversations about internal AI use often revolve around the SOC and security operations, Omdia surveyed identity professionals for a more holistic enterprise perspective. Unsurprisingly, AI agent use is as diverse as enterprise business units. The surprises are around where the budget comes from for these AI projects, and how authentication is handled. Show Notes: https://securityweekly.com/esw-471
Executive Summary Jared sits down with Carly Savar, general counsel at Steno, to unpack what actually happens when a law firm signs up with an AI vendor. Carly explains why reading the fine print matters more than any feature list, and what separates a vendor you can trust from one that's just telling you what you want to hear. Key Takeaways Read the actual data processing agreement yourself. Don't assume a vendor's security is handled just because they signed a service level agreement. Push for a zero-day retention agreement, and ask about the LLMs your vendor is built on, not just the vendor itself. SOC 2 Type 2 certification means a company's controls held up over a full year. SOC 2 Type 1 only proves a single snapshot in time. Not all training is created equal. Aggregated usage data is usually fine. Your client's confidential content should never go into a model. New billing ethics guidance says you can only charge for the time you actually spent, not the time an AI tool saved you. About the Guest Carly Savar is general counsel at Steno, a litigation support and court reporting technology company. She spent years litigating before founding her own legal recruiting company and eventually moving in-house. Carly now negotiates AI and data agreements from both sides of the table, as counsel to a legal tech vendor and as a buyer evaluating other vendors herself. Links and Resources Steno: steno.com Red Cave Law Firm Consulting: redcavelegal.com Keywords legal tech, legal technology, AI for lawyers, AI vendor vetting, legal AI vendor contracts, data security for law firms, zero-day retention agreement, SOC 2 Type 2, SOC 2 certification, ISO 27001, shadow AI, in-house counsel, legal tech general counsel, court reporting technology, Steno, AI training data, law firm AI policy, small law firm technology, technology competence rule, Red Cave Law Firm Consulting Episode Chapters 00:00:00 Cold open and show intro 00:02:00 Meet Carly Savar and the vexing AI vendor problem 00:03:00 Zero-day retention and why training on your data is the real risk 00:06:00 What to actually ask vendors before you sign 00:08:00 SOC 2 Type 1 vs Type 2 and other certifications 00:10:00 Life as GC inside a legal tech vendor 00:13:00 Clients who want cool tech vs clients who ask the right questions 00:15:00 Not all training is created equal 00:16:00 Keeping up with shifting ethics rules and regulations 00:18:00 Tech competence and billing for time spent, not time saved 00:22:00 Advice for lawyers going in-house at startups 00:24:00 Carly's path into law and out of Big Law litigation 00:27:00 Finding Steno and the frog-in-water approach to tech adoption 00:33:00 Going to law school too soon and learning to fail 00:37:00 Women in legal tech today 00:39:00 Wrap-up and where to find Carly and Steno
Interview 1: Robin Macfarlane from RRMac Associats The Mattress Money Principle: What a 50-Year Veteran Knows About System Fragility In this interview, Robin and Adrian discuss how technology has evolved over the past 50 years. Despite massive technological changes over the decades: the PC revolution, the Internet, smartphones, the Cloud, and now Generative AI - the majority of financial institutions still use mainframes and midrange machines. Why? We explore the reasons why older technology persists alongside the new and the lessons retiring technologists can pass on to new generations inheriting an increasingly diverse tech landscape. Interview 2 with Kyle Sandy from Logically Operational Clarity as the New Customer Experience Kyle Sandy joins Adrian to discuss how prioritizing resilience affects how organizations should plan for incident response. In the past, security teams were focused on prevention and limiting breach damage. Today, boards want to know how long it will take to recover operations. The interview wraps up with a discussion of the right and wrong way to handle a breach and the three most important things every company must get right in order to handle an incident well. Interview 3 with Todd Thiemann from Omdia AI Agents and Identity Security: How Enterprises Are Rewriting the Rules Todd joins ESW with some eye-opening survey insights on the topic of IAM for AI agents. While cybersecurity conversations about internal AI use often revolve around the SOC and security operations, Omdia surveyed identity professionals for a more holistic enterprise perspective. Unsurprisingly, AI agent use is as diverse as enterprise business units. The surprises are around where the budget comes from for these AI projects, and how authentication is handled. Show Notes: https://securityweekly.com/esw-471
Skype of Cthulhu presents a Call of Cthulhu scenario. This is Our Home by Jim Phillips. November 28, 1976 Staten Island, New York City, New York The residents continue to read the strange book, learning more history and magical incantations, and learn a long lost friend will be returning in time for the holidays. Dramatis Persone: Jim as the Keeper of Arcane Lore Randall as Frank Romero, Electrical Engineer Rachel as Marsha Janelle, Waitress Steve as Trae Grier, Gas Station Attendant Edwin as Kevin Mazer, Chemistry Teacher Gary as Peter Michale, Ex Pro Quarterback Sean as Kirk Griffin, Actor Download Subcription Options Podcast statistics
Skype of Cthulhu presents a Call of Cthulhu scenario. Curse of Nineveh by Mike Mason, Mark Latham, Scott Dorward, Paul Fricker, and Andrew Kenrick. November, 1925 London While the investigators seek to stop the ritual, Roger makes a stunning discovery in the home of a deceased member of the team. Dramatis Persone: Sean as the Keeper Edwin as Dame Agatha, Authoress Jonathan as Katherine "Kitty" Hall, Dilettante Steve as Connor Shaw, Archivist Max as Oswald Nickels, Big Game Hunter Gary as Anthony Kelly, Consulting Detective Randall as Dean Banks, Big Game Hunter Jim as Roger Schindler, Alienist Rachael as Maude Throckmorton, Adventuress Download Subcription Options Podcast statistics
Intel Chat with Matt Bromiley and Chris Luft — recorded in person at Black Hat USA in Las Vegas, day two.No prep doc, no script: just what Matt and Chris were actually hearing on the floor.• Shai-Hulud is back. The self-replicating npm worm returned on August 4, trojanizing the keyv / cacheable family and spreading to 400+ packages within hours. Chris reads through Datadog Security Labs' analysis of the Shai-Hulud 2.0 wave: 796 packages and 1,092 versions, 20M+ weekly downloads, credential harvesting with TruffleHog, GitHub repositories used for both exfiltration and command and control, and a worm that reads its own code to propagate without a C2 server.• The LLM that downloaded the malicious package by itself. A researcher asked a frontier model about a compromised package, and the model decided the best way to help was to go fetch a copy — tripping the SOC's alert and bypassing the company's centralized package clearing house on the way.• Non-human identity as the new perimeter. Every agent you introduce is another identity: who created it, what can it reach, how long should it live?• "Computer says no." Matt's colleague hit a refusal from Opus 5, and the session automatically downgraded to 4.8 and completed the task. Which raises the real question of the episode: do security teams now need model pinning, the way we once needed certificate pinning? And if defenders pin to older models to keep working while adversaries use the newest ones, have we rebuilt the same gap all over again?• AI governance and change control — which models are approved for which tasks, and what happens when a vendor ships a new version or deprecates an old one.• Token spend as a CISO budget line item. Enterprises buying tokens at a scale their vendors can't match and pulling those vendors onto their plan, token burn as an insider-threat vector, and why $100,000 of tokens is not $100,000 of productivity.• Defender takeaways: pin your npm packages, get security off its island and talk to your developers, build approved paths before detections, least privilege and key rotation, and network-gated pushes as a deliberate chokepoint.Stories covered:• https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain• https://research.jfrog.com/post/shai-hulud-is-back-august/• https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/• https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/• https://unit42.paloaltonetworks.com/npm-supply-chain-attack/Chapters:0:00 Live from Black Hat, in person for once0:48 How Black Hat has changed4:31 No prep — let's talk about what's actually happening here4:57 Shai-Hulud is back: supply chain compromise6:23 The LLM that downloaded the malicious package7:19 Inside Shai-Hulud 2.010:34 When attackers and defenders use the same tools11:39 Non-human identity is the new perimeter12:13 Opus 5 said no, so the session downgraded itself15:23 Do security teams need model pinning?18:20 Three companies, very nebulous rules18:35 AI governance: which model for which task21:19 Token spend hits the security budget22:58 Is token spend a productivity metric?25:46 Pin your packages26:25 Get security off the island29:17 Least privilege, key rotation, chokepoints32:55 Why it's called Shai-Hulud33:25 Wrapping up at Black HatThe Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieioLearn more about LimaCharlie: https://limacharlie.io#cybersecurity #infosec #threatintel #AIsecurity #supplychainsecurity
Ravi Soin has clear advice for anyone starting a security career today: don't be a risk manager, be a trust architect. In this episode, Steve Moore sits down with Ravi—CIO and CISO at Smartsheet—for a builder's-eye conversation on the modern CISO role, AI as an accelerant on old sins, and why the CISO who still says “no” is already obsolete.Ravi traces his path through Sun Microsystems, RealNetworks, a decade at Microsoft, and 15 years at healthcare software leader Edifecs to his eight months at Smartsheet. He explains what it means to think about security the way builders do—understanding where corners get cut under sprint pressure—and why that inside-out perspective changes how you defend.Steve and Ravi dig into how Smartsheet is deploying agentic AI across the enterprise: a centralized knowledge graph tied to every corporate system, Claude-powered threat models, DAST and SAST scans, SOC triage on the 80% phishing baseline, and MCP-connected asset and license management.They name the old culture directly. It was an era of risk registers where lows and mediums were quietly punted, tens of thousands of known vulnerabilities were accepted as compensating- control fiction, and time-to-exploit was assumed to be forgiving. Both push back on the panicked reaction to the Mythos disclosures, arguing AI has simply closed the exploit window on the trash environments were already ignoring.Ravi's core advice: build trust into the system, think about security through the customer's lens, and treat AI agents as first-class identities under the same IAM principles you apply to humans. He and Steve close on how incident response must be re-fit for the agentic era, why auditability is the non-negotiable foundation of AI governance, and why community remains the sharpest source of learning.Key Topics• Thinking about security like a builder, from the inside out• Why the CISO who still says “no” is already obsolete• Deploying agentic AI across engineering, SOC, and corporate systems• MCP-connected asset and license management• The old risk-register culture and how the industry was gambling• Why the Mythos reaction missed the bigger story• Advice to your 21-year-old self: be a trust architect• Building security through the customer's lensGuest BioRavi Soin is the CIO and CISO at Smartsheet, where he leads global IT and security strategy for the AI-enhanced enterprise work management platform. He brings more than two decades of security and IT leadership, including 15 years as CIO and CISO at healthcare software leader Edifecs and product roles at Microsoft, RealNetworks, and Sun Microsystems. Ravi serves on the SeattleCIO advisory board and was named Seattle CIO of the Year.GET A DEMO:
Two pen testers have spent thousands of hours inside client networks, and the most common failure they see isn't a missing security product — it's an EDR nobody ever tuned.In this episode, Spencer and Tyler open up the CrowdStrike Falcon console and walk through the specific settings that decide whether your team catches an attack or never sees it. They start with the story that kicked the whole thing off: Tyler running a pen test where every AMSI bypass gets blocked and detections fire left and right, while Spencer runs nearly identical tooling against the same product at another client and the SOC sees nothing all week. Same CrowdStrike. Same version. Different checkboxes.From there it's a tactical walkthrough of Endpoint Security → Prevention Policies and the settings worth your attention: Enhanced Exploitation Visibility, which unlocks command-line and PowerShell telemetry that Microsoft disables by default; Enhanced DLL Load Visibility for side-loading attacks; WSL2 Visibility, which closes a sandbox threat actors have been using to run Kali tooling under the radar; memory scanning for in-memory C# tradecraft; Office malicious macro removal; file system containment for ransomware over SMB; vulnerable driver protection, the direct mitigation for BYOVD attacks and EDR killers; and cloud-based anomalous process execution for living-off-the-land binaries.They also cover custom IOA rule groups for blocking unauthorized RMM tools, centralized firewall policy management, device policies for USB control, and a warning on exclusions — especially wildcard paths, which Tyler calls a threat actor's best dream.The takeaway is simple: you're paying real money for EDR, and default configurations aren't giving you what you paid for. Open your console, work through the settings, test them against an IT pilot group, and enable what fits your environment.TOPICS COVERED- Why EDR vendors ship deficient defaults on purpose- Enhanced Exploitation Visibility and the telemetry gap in PowerShell attacks- DLL side-loading, WSL2 abuse, and vulnerable driver attacks- Memory scanning and in-memory tooling detection- Blocking RMM tools with custom IOA rule groups- Exclusion hygiene and the wildcard path problem- Device policies, USB blocking, and insider threatSentinel One and Defender for Endpoint are next — let us know what else you want covered.Blog: https://offsec.blogWork with us on an internal pen test: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpovFollow Spencer on social ⬇Spencer's Links: https://spenceralessi.comWork with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
This Week In Startups is made possible by: Vanta https://www.vanta.com/twist Agree https://agree.com Odoo https://Odoo.com/twist Today's show: *Airtable just sold for $2.25 billion, an 81% drop from its peak of $11.7 billion. On this week's TWiST VC Roundtable, Aditya Agarwal (South Park Commons), Niko Bonatsos (Verdict Capital), and Rick Heitzmann (FirstMark Capital) break down why the venture world sees this as a good outcome, not a financial disaster. By declining the deal, would Airtable's team have just been delaying the inevitable? Is the fact that they reached $400M+ ARR on its own a reason to celebrate? Find out why our investor panel prefers unwinding a stuck situation rather than chasing a growth rate that's no longer sustainable. PLUS Robinhood's booming prediction market business, the secondary market flap over Anduril shares, why so many VCs shy away from "vice" categories, and a glimpse at how insiders are talking about the Apple-OpenAI lawsuit. Guests Aditya Agarwal on X: https://x.com/adityaag South Park Commons: https://www.southparkcommons.com/apply Niko Bonatsos on X: https://x.com/bonatsos Verdict Capital: https://verdictcap.com/ Rick Heitzmann on X: https://x.com/rick FirstMark Capital: https://firstmark.com/ Relevant Links Airtable: https://www.airtable.com/ Bending Spoons announces Airtable acquisition: https://investors.bendingspoons.com/newsroom/bending-spoons-agrees-to-acquire-airtable Constellation Software: The Anti-Conglomerate: https://www.eaglepointcap.com/blog/constellation-software-the-anti-conglomerate Introducing Robinhood Ventures Fund II: https://robinhood.com/us/en/newsroom/introducing-rvii/ Quartz: Robinhood posted record quarterly revenue: https://qz.com/robinhood-record-revenue-prediction-markets-earnings-073026 Riot Games: https://www.riotgames.com/en AngelList's USVC Fund: https://usvc.com/ Baseten: https://www.baseten.co/ OpenEvidence: https://www.openevidence.com/ Hermes Agent: https://hermes-agent.org/ Granola: https://www.granola.ai/ Timestamps: 0:00 VC intros & Bending Spoons buys Airtable 9:19 Why growth is the only metric that matters 9:45 Vanta - Get $1000 off your SOC 2 at https://www.vanta.com/twist 20:52 Agree.com - Stop chasing invoices and automate your entire contract-to-cash stack. Go to https://agree.com and tell them Jason sent you to get 50% off for life! 26:25 When should VCs sell in secondary markets? 30:55 Odoo - The all-in-one business platform. Get started for free at https://Odoo.com/twist 35:38 Robinhood's prediction markets are exploding 43:13 The USVC-Anduril secondary controversy 46:18 How VC firms use open source models 58:43 Telling the real founders from the grifters 1:02:38 Why Apple is suing OpenAI Subscribe to the TWiST500 newsletter: https://ticker.thisweekinstartups.com Check out the TWIST500: https://www.twist500.com Subscribe to This Week in Startups on Apple: https://rb.gy/v19fcp Follow Lon: X: https://x.com/lons Follow Alex: X: https://x.com/alex LinkedIn: https://www.linkedin.com/in/alexwilhelm Follow Jason: X: https://twitter.com/Jason LinkedIn: https://www.linkedin.com/in/jasoncalacanis Check out all our partner offers: https://partners.launch.co/ Great TWIST interviews: Will Guidara, Eoghan McCabe, Steve Huffman, Brian Chesky, Bob Moesta, Aaron Levie, Sophia Amoruso, Reid Hoffman, Frank Slootman, Billy McFarland Check out Jason's suite of newsletters: https://substack.com/@calacanis Follow TWiST: Twitter: https://twitter.com/TWiStartups YouTube: https://www.youtube.com/thisweekin Instagram: https://www.instagram.com/thisweekinstartups TikTok: https://www.tiktok.com/@thisweekinstartups Substack: https://twistartups.substack.com
Sam and Joe discuss Microsoft's plan to retire Microsoft-provided SMS and voice calls for MFA, with key dates of Sept 1, 2026 (users on SMS/voice are automatically enabled for passkeys and nudged to register) and Feb 1, 2027 (blocking enforcement for users whose only MFA is SMS/voice, no opt-out), noting paid/customer-managed telecom options and the need to warn clients, address legacy per-user MFA vs conditional access, and handle shared accounts via shared mailboxes or passkey-sharing tools. Sam recounts a prolonged Salesforce SSO/MFA issue worsened by poor vendor documentation and misleading AI guidance, ultimately tied to a Microsoft KB update. They then cover partnering with Fuji for client SOC 2 compliance support, emphasizing evidence, audits, costs, and ongoing maintenance, plus how cyber-insurance questionnaires drive security improvements. The episode also touches on residential support cases, Vision Pro support challenges with DRM blocking screen mirroring, and show wrap-up. 00:00 Show Kickoff 00:17 Microsoft MFA SMS Retirement 00:44 Key Dates and User Impact 03:28 Authenticator Backups and PSAs 04:40 Legacy MFA Cleanup Challenges 07:36 Conditional Access Licensing Risks 10:12 Shared Accounts and Passkeys 12:21 Salesforce MFA SSO Headaches 13:25 AI Missteps and Vendor Docs 17:50 SOC 2 Help from Fuji 21:23 SOC 2 Costs and Maintenance 22:49 Easy Buttons and Real Audits 26:27 Cyber Insurance Questionnaires 27:53 Partnering for Expertise 29:07 Cyber Insurance Foot in Door 30:31 Apple Store Referral Win 31:01 Lightroom Migration Pitfalls 34:31 Blocked Contacts Mystery 38:04 Email Search and User Training 40:02 Supporting Vision Pro Clients 47:28 Amazon Returns and Exceptions 50:24 Wrap Up and Callouts
Artificial intelligence is rapidly reshaping Security Operations Centers (SOCs), helping security teams investigate incidents faster while reducing alert fatigue. But as AI becomes more capable, what role do human analysts and packet data play in an increasingly automated SOC?In Packet Forensics Files Episode 67, Michael Morris sits down with Cisco Security Sales Engineer and incident response expert Erik Dove to discuss how Agentic AI is changing incident response, where packet data fits into modern SOC workflows, and why both experienced analysts and packet data remain essential.If you're interested in how AI, automation and packet capture are shaping the future of security operations, this episode is highly recommended. It's a fascinating discussion with plenty of practical advice for organizations looking to build more effective SOCs.
On Cybersecurity Today on the Weekend, host David speaks with Matt Burke, CISO of Bespoke Concierge MD, a telemedicine provider with doctors licensed in all 50 states, about defending patient data amid rising healthcare threats in 2026. Burke explains why healthcare is heavily targeted, recounts a formative 3 a.m. incident rebuilding a critical connection during surgery, and outlines his top concerns: increasingly sophisticated bad actors, "hacking as a service," and user mistakes. He emphasizes education, strong security tooling backed by a proactive/reactive SOC, and rigorous practice of incident and disaster recovery plans, balancing prevention with rapid response. The discussion also covers AI's benefits and risks, leadership support for security, the importance of MFA for both work and personal accounts, and Burke's wish for broader adoption of effective SIEM tools. 00:00 Weekend Show Intro 00:39 Meet Matt Burke 01:23 Concierge Care Model 02:45 Why Healthcare Security 03:13 Origin Story 3AM Call 05:20 Top Threats 2026 06:29 Defense Tools That Work 07:50 AI Helps And Hurts 09:37 Winning Doctor Buy In 10:57 Castle Versus Response 13:42 Threat Surge And Resilience 18:17 Culture And MFA Everywhere 19:59 Career Advice And Magic Wand 22:33 Closing Thanks
Shaju Puthussery and Deepak Ramaswamy are the CEO and CTO of LightSpun, which is rebuilding the back-end engine of insurance processing as agentic AI infrastructure, starting in dental and moving into vision and ancillary benefits. Both came from Overjet, where Deepak was a co-founder and Shaju the first employee, and this conversation is largely about why they walked away from that thesis. Reading X-rays was the visible AI problem. Underneath it was a plumbing problem: claims that never reach clinical review because the documents were wrong, the provider record did not match, or the file never loaded cleanly.Two things in this episode surprised us. The first is that their most valuable asset was an accident. Shaju assumed credentialing was table stakes until a payer CEO told him it was blocking dentist onboarding, and one weekend later Deepak had an approach. That became the rail for roughly 87% of practicing dentists in the US and the provider data spine that feeds adjudication. The second is Shaju's answer to whether anyone profits from claim friction, which is not the cynical answer most people give.We discuss:Why Deepak argues the AI question is not either-or, and why world-class clinical review is worthless if the claim cannot get to itThe moment their business model was confidently wrong: they built for benefits configuration, customers came back asking about credentialing, duplicate records, and file loads, and a startup that planned to do one thing had to bet on tenWhy credentialing was never a Trojan horse for the provider data layer, how the same 200,000-dentist dataset gets monetized twice, and what obligation comes with being the thing the system quietly depends onThe honest ceiling on model performance: 85 to 90% out of the box, and why the climb to 98 or 99% production-ready is where the humans actually liveThe exact decision they will not automate, with the line drawn between deterministic denials (two cleanings a year, a $2,000 annual max) and anything touching a clinical outcomeWhy regulation, not technology, sets the pace, and how they take a faster primary source verification method to their internal NCQA leader with screenshots, timestamps, and source authenticity to prove it still holds upShaju's contrarian read on the $17 to $21 billion admin waste question: no one is winning from the friction, both sides are automating, and the real goal is shifting dollars from admin to careBringing fintech into adjudication with a benefits flex card that carries a Visa or Mastercard rail, blocks non-covered procedures at the chair, and opened doors to a vendor network of roughly 150 health plansThe discipline of not chasing every model release, what Hugging Face taught them early about picking bets, and why the architecture is built to swap foundation models out entirelyDeepak's pushback on the beachhead narrative: dental is several years behind medical, which means the solutions may not transfer cleanly, and they designed for vision and ancillary from day one rather than treating dental as a waypointWhy compliance came before the AI story, with SOC 2 Type 2, HITRUST, and NCQA in place first so they could get in the room with large payers at allThe legacy Deepak actually wants: recognized as the company that automated the boring and the safe, and left the critical decisions with people—Brought to you by: Sage Growth Partners — Value-focused strategy and marketing for growth-driven healthcare organizations.—Where to find Jared:• X: https://x.com/jaredstaylor• LinkedIn: https://www.linkedin.com/in/jaredstaylor/
Jon Sakoda of Decibel joins me to break down AI's impact on cybersecurity startups, venture funding, and why endpoint is the Super Bowl of cyber.Jon is the Founding Partner at Decibel, an early-stage firm backing technical founders in security and infrastructure. He started his career founding IMlogic, an IM security company acquired by Symantec, then spent over a decade at NEA working with companies like Cloudflare, MongoDB, and HackerOne before launching Decibel. We got into why he thinks AI is only magical if you have a magic power, why Decibel led a $100M seed into Ent, and where the firm is placing its next bets.In this episode:Why Decibel operates like the Navy SEALs next to the big platform fundsThe founder community model and finding the early believers among CISOsWhat separates the founders who finish now that AI lets everyone startEnt's $100M seed and the self-driving moment for endpoint securityTelling genuinely AI-native companies apart from AI washingAI eating venture capital and why cyber's best years are aheadOpen models, frontier labs, and why the cat is out of the bagThe agentic SOC, Dropzone AI, and driver assistance vs. self-drivingStartup consolidation cycles and being an N of oneHow buyers and job seekers should evaluate early-stage vendorsDecibel's next bets, from novel AI models to resilience and cyber insuranceChapters:0:00 Intro 0:32 Jon's background and founding Decibel 2:25 Big platform funds vs. specialized firms 3:56 Founders helping founders and early believers 6:22 Scaling beyond the early adopters 7:40 Who finishes the marathon in the AI era 10:19 Founders from outside cyber 12:21 Ent's $100M seed and the endpoint bet 14:53 AI-native vs. AI washing 17:04 AI is eating venture capital 18:55 Open models vs. frontier labs 22:41 The agentic SOC and Dropzone AI 26:03 Consolidation and the startup cycle 29:22 How buyers should evaluate young vendors 31:43 Decibel's next bets and cyber resilience 34:11 Game Day at Black HatConnect with Jon: LinkedIn: https://www.linkedin.com/in/jonsakoda/ Decibel: https://www.decibel.vcSubscribe for more conversations with security practitioners and leaders, and find my writing at https://www.resilientcyber.io
Security Conversations: Kenneth Kinion, founder and CEO of Validin, joins Ryan Naraine on the show to unpack what "internet intelligence" really means for the analysts and responders chasing malicious infrastructure. We trace his path from Georgia Tech through Microsoft and Amazon to the frustrations that led to the creation of Validin, the competition from big AI, the value of AI-powered tools to speed up infrastructure hunting, and why defenders keep falling further behind fast-moving attackers. Timestamps: 0:00 – Intro: What does Validin do? 0:51 – Who uses Validin: CTI teams, SOCs, incident responders 2:19 – Atlanta and Georgia Tech's cybersecurity pipeline 5:31 – Lessons from Microsoft and Amazon: waterfall vs. agile 8:29 – Filling gaps in passive DNS data 9:57 – Misunderstood things about threat intelligence 14:17 – The value of "cyber paleontology" 16:00 – What makes one data set better than another? 19:39 – How Validin works: from one suspicious domain to a full pivot 21:27 – AI as existential threat or force multiplier for Validin 26:55 – Dual-use AI: are defenders losing ground to attackers? 31:11 – Closing: the next hard problem Validin wants to solve
What happens when the adversary moves at machine speed, and your SOC is still responding at human speed? Why does nearly every security team say AI should handle L1 work, while 64% of organizations still have zero agents in production? And how long until the "coworker" resolving your ticket in Slack turns out not to be human at all? Tim Leehealey, VP of Strategy and Operations at Strike 48, joins us this week to talk about what it actually takes to get AI agents out of the demo and into production. Tim agenticized his own company's IT, watched it blow up, and came out the other side with lessons from Fortune 100 SOCs running agents at serious scale. He shares where AI actually belongs in the alert pipeline, the objections holding teams back, and a blunt warning for any leader still waiting on the sidelines in 2027. If AI in the SOC is on your roadmap before the end of this year, start here. Impactful Moments 00:00 - Introduction 01:55 - Busting a myth: AI will replace analysts 04:45 - Introducing Tim Leehealey 05:30 - The Strike48 survey: 84% say hand L1 to AI 08:00 - Fear the low-and-slow attacker, not the loud one 13:00 - Getting breached without agents in 2027 15:00 - When Tim's own rollout blew up 19:00 - Micro agents inside deterministic workflows 21:25 - Skills advice for L1 analysts 26:00 - The next 18 months of agentic adoption 28:00 - Jim Bob in your Slack is an agent 21:30 - Ron's take: transparency is the trust unlock Links Connect with Tim Leehealey on LinkedIn: https://www.linkedin.com/in/tim-leehealey-b8b04321 Learn more about Strike48: https://strike48.com Check out the 2026 State of Agentic Security report here: https://hubs.ly/Q04p49S20 Go deeper on Strike 48's technology: https://labs.strike48.com – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/
This Week In Startups is made possible by: Vanta https://www.vanta.com/twist Superhuman https://superhuman.com YSecurity https://YSecurity.io/TWIST Today's show: *Cybersecurity has long focused on cleaning up a system AFTER a breach but Ent founder Brandon Dixon says that's backwards. He just raised a $100M seed round to put an AI agent on everyone's company laptops that catches the risky clicks, leaked files, or rogue agents BEFORE they wreck havoc. PLUS Clawra creator David Im return swith his new project, Sume's Avatar, a multi-model orchestration layer that generates 60-second UGC videos from a single prompt… and gets it right on the first try, rather than falling back on trial and error. Guests: Brandon Dixon on LinkedIn: https://www.linkedin.com/in/brandonsdixon/ Ent: ****https://ent.ai/ David Im on X: https://x.com/davidim Sume: https://www.sume.com/ Relevant Links: WSJ: "Cyber Security Startup Ent Raises $100 Million in Seed Funding": https://www.wsj.com/pro/cybersecurity/cyber-startup-ent-raises-100-million-in-seed-funding-a3e9b6c6 Microsoft Security Copilot: https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot Engadget: "Meta 'pausing' employee tracking program…": https://www.engadget.com/2199458/meta-is-pausing-employee-tracking-program-after-it-let-the-whole-company-see-sensitive-data/ Seedance 2.0: https://seedance2.ai/ Timestamps: 0:00 Intro: Why AI + cybersecurity is the hot combo right now 2:29 How INT stops breaches before they happen 4:56 AI is giving non-technical employees dangerous new powers 10:26 Vanta - Compliance and security shouldn't be a deal-breaker for startups to win new business. Vanta makes it easy for companies to get a SOC 2 report fast. Get $1,000 off for a limited time at https://www.vanta.com/twist 13:54 Why on-device AI beats cloud-based security 20:08 Superhuman - Get AI that works where you work. Unlock your Superhuman potential at https://superhuman.com 25:18 INT's business model and go-to-market 30:26 YSecurity - The on-demand security team for startups. Need enterprise-grade security without hiring a $400k CISO? YSecurity gives you 40+ expert engineers, matched to exactly what you need, by the hour, with your first six hours completely free. Go to https://YSecurity.io/TWIST 34:18 David M. of Sumi Labs: one-shotting AI video 36:10 Live demo: Sumi's video orchestration API 40:05 Consistent faces, 60-second videos, and who's buying Subscribe to the TWiST500 newsletter: https://ticker.thisweekinstartups.com Check out the TWIST500: https://www.twist500.com Subscribe to This Week in Startups on Apple: https://rb.gy/v19fcp Follow Lon: X: https://x.com/lons Follow Alex: X: https://x.com/alex LinkedIn: https://www.linkedin.com/in/alexwilhelm Follow Jason: X: https://twitter.com/Jason LinkedIn: https://www.linkedin.com/in/jasoncalacanis Check out all our partner offers: https://partners.launch.co/ Great TWIST interviews: Will Guidara, Eoghan McCabe, Steve Huffman, Brian Chesky, Bob Moesta, Aaron Levie, Sophia Amoruso, Reid Hoffman, Frank Slootman, Billy McFarland Check out Jason's suite of newsletters: https://substack.com/@calacanis Follow TWiST: Twitter: https://twitter.com/TWiStartups YouTube: https://www.youtube.com/thisweekin Instagram: https://www.instagram.com/thisweekinstartups TikTok: https://www.tiktok.com/@thisweekinstartups Substack: https://twistartups.substack.com
Misha Glenny and guests discuss the earliest evidence we have of the existence of trees and how even plants we might have on windowsills or as vegetables in gardens can and do, in the right conditions, evolve into trees. Since their emergence around 400 million years ago after low lying plants started to develop stronger stems and grow taller and more upright, trees have transformed our planet, so creating ecosystems, altering the atmosphere and setting the stage for the world as we know it today. With Jenny McElwain 1711 Chair of Botany at Trinity College Dublin and Director of Trinity Botanic GardensChristopher Berry Senior Lecturer in Earth and Environmental Sciences at Cardiff UniversityAndBill Baker Senior Researcher at the Royal Botanic Gardens, KewProduced by Conor GarrettReading list:David Beerling: The Emerald Planet: How Plants Changed Earth's History (Oxford University Press, 2008)C.M. Berry, ‘Palaeobotany: The Rise of the Earth's Early Forests' (Current Biology 29, 2019)Christopher M. Berry and John E.A. Marshall, ‘Lycopsid forests in the early Late Devonian paleoequatorial zone of Svalbard' (Geology 43:12, 2015)N.S. Davies, W.J. McMahon and C.M. Berry, ‘Earth's earliest forest: fossilized trees and vegetation-induced sedimentary structures from the Middle Devonian (Eifelian) Hangman Sandstone Formation, Somerset and Devon, SW England' (J. Geol. Soc. 181, 2024)P. Geisen and C.M. Berry, ‘Reconstruction and Growth of the Early Tree Calamophyton (Pseudosporochnales, Cladoxylopsida) Based on Exceptionally Complete Specimens from Lindlar, Germany (Mid-Devonian): Organic Connection of Calamophyton Branches and Duisbergia Trunks' (International Journal of Plant Sciences 174 (4), 2013) A. Groover and Q. Cronk (eds), Comparative and Evolutionary Genomics of Angiosperm Trees: Plant Genetics and Genomics (Crops and Models, vol 21. Springer, 2017), especially ‘The Evolution of Angiosperm Trees: From Palaeobotany to Genomics' by Q.C.B. Cronk and F. ForestJennifer McElwain, Marlene Hill Donnelly, and Ian Glasspool, Tropical Arctic: Lost Plants, Future Climates, and the Discovery of Ancient Greenland (University of Chicago Press, 2021)Harriet Rix, The Genius of Trees: How Trees Mastered the Elements and Shaped the World (Vintage, 2026)W.E. Stein et al., ‘Mid-Devonian Archaeopteris roots signal revolutionary change in earliest fossil forests' (Current biology, 30:3, 2020) pp.421-431William E. Stein, Christopher Mark Berry, Linda VanAller Hernick and Frank Mannolini ‘Surprisingly complex community discovered in the mid-Devonian fossil forest at Gilboa' (Nature 483, 7387, 2012) Max Telford, The Tree of Life: Solving Science's Greatest Puzzle (John Murray, 2026)K.J. Willis, J.C. McElwain, The Evolution of Plants (Oxford University Press, 2014)James Woodford, The Wollemi Pine: The Incredible Discovery of a Living Fossil from the Age of the Dinosaurs (The Text Publishing Company, 2005)Alexandre R. Zuntini et al, ‘Phylogenomics and the rise of the angiosperms' (Nature vol. 629, April 2024) Spanning history, religion, culture, science and philosophy, In Our Time from BBC Radio 4 is essential listening for the intellectually curious. In each episode, host Misha Glenny and expert guests explore the characters, events and discoveries that have shaped our world.
© 2020-2026 Ivy Podcast Discovery LLC
