Explore every episode of the podcast Down the Security Rabbithole Podcast (DtSR)

TL;DR: Xavier Ashe was there when that first DDoS attack by MafiaBoy went down. He's got stories, and we're going to tell them. Recorded live at BSides Atlanta in 2026.

Guest

• Xavier Ashe

Description: A DDoS attack used to be something you could “just block” once you saw the source. Then defenders learned the hard way that thousands of small senders can knock over a giant, and the playbook changed for good. From the stage at B-Sides Atlanta at Georgia Tech, we sit down with security veteran Xavier Asht for story time from the defender’s seat during one of the earliest recorded distributed denial-of-service incidents and what that night still teaches security operations teams today.

From there, we follow the thread into the modern SOC: the messy gap between “something is broken” and “we are under attack,” the endless tooling arms race, and why AI makes some problems easier while creating brand new trust issues. We talk candidly about non-deterministic systems, why “AI will triage everything” keeps falling apart in practice, and how AI may be most useful when it helps glue together fragmented enterprise data the pain point SIEM tools have tried to solve for decades.

We also shift to the human side of cybersecurity: neurodiversity in the workplace, why so many of us feel more at home in hacker spaces than in “normal” environments, and how strengths like hyperfocus can be a superpower only in the right context. We close with a grounded five-year outlook on AI economics, regulation, and what happens when today’s cheap access meets real-world business pressure.

Subscribe for more conversations from the Security Rabbit Hole, share this episode with a friend, and leave a review so more defenders can find it.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod is a conversation about AI and "Open-Weight Models", and if you aren't intimately familiar with what these are this is an episode for you. Wes has a lot of insight, and this is a discussion rather than an info dump.

Guest: 

• Wes Widner

Description

The most disruptive AI feature might not be a new chatbot trick; it might be the ability to download the model and run it yourself. Recorded live at B-Sides Atlanta 2026, we sit down with Wes Widner, senior principal engineer at Cyber Haven and a veteran of McAfee threat intel and CrowdStrike, to unpack what open-weight models really are and why they’re changing the rules for security teams.

We break down the practical side of local LLMs: model weights, quantization, laptop-friendly variants, and why the open model ecosystem on Hugging Face has become a real “model store.” Then we go straight into the uncomfortable part: if a model runs on your hardware, the guardrails are optional. Wes explains how “locks” and refusals get removed, why safety and alignment consume huge effort for frontier labs (not labs), and why trying to regulate distribution can backfire by driving unlocked models into underground channels.

From there, the conversation turns into cybersecurity reality. AI doesn’t reliably understand context like “medical-critical” versus “normal” IoT, and reverse engineering firmware at home can look identical to reversing a sensitive system. Our takeaway is blunt: stop assuming the attacker is limited, and start designing detection, response, and secure engineering for a world where both sides have powerful AI copilots.

YouTube: https://youtu.be/xGIjifjdjnM

Channel: https://www.youtube.com/@DTSR_Podcast

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Phile has been penetration testing for a long time. The difference now is that he's having a much easier time with it thanks to AI. It's an interesting world, and he's here to explain the offensive side of it.

Guest: Phil Brass

Description

Zero-days are not a once-in-a-career event anymore. From B-Sides Atlanta, we sit down with veteran penetration tester Phil Brass to unpack what happens when large language models make vulnerability research dramatically faster and cheaper, not just for defenders, but for attackers too.

We get specific about where AI penetration testing actually moves the needle: LLM-assisted security research that can turn a normal two-week internal pen test into a hunt for brand-new bugs in the commercial software your environment depends on. Phil walks through the mindset shift from “scan the network and review configs” to “download the exact products the client runs and start looking for flaws,” including lessons learned from targeting VMware infrastructure and finding critical issues in vCenter, the control plane that can unlock everything downstream.

That power comes with consequences. We talk responsible disclosure, vendor response, and the uncomfortable reality that patches can be reverse-engineered quickly, leading to real-world exploitation soon after fixes land. On the defense side, the guidance is refreshingly direct: tighten patch cycles, take threat intelligence seriously, and implement real micro-segmentation so one foothold does not expose every dependency on your network. We also dig into third-party risk management and why asking suppliers about LLM-assisted testing may become a new baseline.

We close with the human side of AI in security: validating LLM output, dealing with hallucinations, avoiding intellectual laziness, and making judgment calls that protect production systems. If you found this useful, subscribe, share it with a teammate, and leave a review so more builders and defenders can find the show.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Mehul joins Rafal live from BSides Atlanta to talk about how AI is changing how vulnerabilities are found and exploited at scale and cost. It's an interesting conversation about how much it costs to break into an organization's software stack.

Video: https://youtu.be/kGajA9ipsp4

Guest

• Mehul Revankar

Description

A disclosed vulnerability no longer needs weeks of hacker effort. When exploitation becomes an automated, agentic workflow measured in minutes and dollars of compute, the way we rank risk, plan patching, and measure security maturity has to change.

Recorded live at B-Sides Atlanta, we sit down with Mehul Revankar, co-founder and chief product officer at Quantro Security (Contro.security), to unpack what “agentic AI offense” looks like in the real world. Mehul shares results from research on building and validating exploits at startling speed, why compute budget is becoming the true limiter, and how model escalation and exploit mutation loops turn yesterday’s “low priority” bugs into today’s fast-moving threats. We also pressure-test the comforting idea that you can simply patch your way out, and we ask what happens to common metrics like EPSS or “not exploited in the wild” when an AI agent only needs to succeed once.

From there, we shift to defense. We talk about compensating controls that still matter, including web application firewalls, tighter firewall policies, and practical ways to reduce exploitation even when you cannot patch everything. We dig into attack surface reduction, the hard problem of legacy software, and why decommissioning old systems may become more realistic as AI lowers the cost of rebuilding. Finally, we explore what AI-native scanners and defensive agents could look like when they can reason on the fly rather than follow brittle, rules-based logic.

If you’re thinking about vulnerability management, cyber risk management, AI security, and the future of cyber defense, this conversation will recalibrate your threat model. Subscribe, share this with your security team, and leave a review with the one metric you think still holds up in an agentic era.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This episode is all about an essential skill few of us have mastered. How do you communicate value? What is it? And how do you make sure you're evaluating value in a way that makes sense to the person you're talking to? This is something that's essential to your career, your business, and your life, and Michael is a master of this art. Don't miss this one.

Guest: 

• Michael Santarcangelo

Description

Most cybersecurity pros know the feeling: you ship real work, you reduce real risk, and the reaction is a polite nod and a budget cut. We sit down with returning guest Michael Tandarcangelo (aka Mr. Santa), who’s turned decades of “problems that don’t have names” into a clear philosophy at ValueSmith: delivering value in a world built to overlook it.

We get concrete about what “value” actually means and why it so often gets misread inside security programs. If leaders see the cost on a spreadsheet but can’t see the benefit, the mental math turns negative fast and security becomes a cost center. We talk through better ways to frame work like PCI DSS and SOC 2, how to connect controls to outcomes people care about, and why value is a dialogue not a declaration.

Then we go upstream to the real failure mode: solving the wrong problem perfectly. Michael shares a simple way to slow down just enough to ask smarter questions without looking “weak,” so you can align with the person who must recognize the result as valuable and make that value travel up the chain. We also dig into how market demand shifts over time, why certifications can be noisy signals, and why paying for outcomes beats paying for hours when you want great work.

If you want clearer stakeholder communication, stronger budget conversations, and a better handle on your own career value, hit play and grab Michael’s free Value Delivery Check. Subscribe, share with a teammate, and leave us a review if this helps you change how you show impact.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's podcast features Rafal & Anton discussing the hype and hysteria that surrounds today's AI headlines. Which side is right, which side is propaganda, and what's real? Listen and find out.

Guest

• Anton Chuvakin

Description

AI panic has officially gone mainstream, and we’re feeling it from every direction: “AI will kill us” on one end and “AI is useless hype” on the other. Rafal brings in Anton Chuvakin to filter the noise and ask a simpler question: what’s actually true when you strip away the social media fever dream?

Anton shares why he’s genuinely torn between two models of reality. Some days, AI looks like a normal enterprise technology wave, complete with failed pilots, dirty data, and brittle implementations. Other days, the pace of improvement feels like an exponential curve, especially when you hear what thoughtful engineers inside major AI labs are seeing firsthand. We talk about why that insider perspective matters, how it clashes with “AI doesn’t work” skepticism, and why both the doomer and booster narratives can miss the point.

Then we get practical. Even if AI capabilities grow fast, the physical world often doesn’t: batteries, robotics, infrastructure, clinical trials, and regulation impose time and physics constraints that no model can simply will away. We connect that to cybersecurity realities too: if you don’t have logs and telemetry, no AI agent can conjure evidence that was never collected. Finally, we tackle the quieter fear that hits close to home: overreliance. If GPS weakened navigation skills, what happens when AI becomes the default for writing, maths, and judgment?

If you want a grounded take on AI safety, AI hype, and real-world limits, listen now, then subscribe, share the episode, and leave a review with your take: are we overreacting, underreacting, or arguing the wrong point?

Video: https://youtube.com/live/v0pkpH1SgXI

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's guest is Richard Bird, who has a new book coming out. He says, "Cybersecurity measures activity while its adversaries measure opportunity," and thirty years of spending has been priced against the wrong scoreboard. Great start, and you know it's going to get a little punchy.

Guest:

• Richard Bird

Description

Cybersecurity spending has exploded for 30 years, and the scoreboard still looks brutal. We sit down with Richard to talk about his new book, “Built Wrong: Why Cybersecurity is Failing and How We Can Rebuild It,” and we don’t sugarcoat the core claim: defenders measure activity while adversaries measure opportunity, and our metrics push us toward more tools, more dashboards, and more noise instead of fewer breaches and smaller blast radii.

We dig into why common security metrics behave like “measuring the weather” and how that creates a self-perpetuating cycle of reports, blinky lights, and ROI stories that don’t hold up in financial terms. Richard shares a blunt economic lens through his Hacker in a Hoodie framing, then we connect the dots to cyber insurance and how premium pricing can accidentally reward planned security purchases rather than proven loss reduction. If losses go up while premiums go down, something is broken in the measurement and incentive chain.

From there we get practical: how do we justify investments like firewall upgrades without relying on vendor promises and buzzwords? We talk about using real evidence like the Verizon DBIR and OWASP Top 10, and Richard offers a simple way to organize security thinking and metrics into three buckets: exposure, interdiction, and consequence. We also push on the leadership problem: if “security is everyone’s job” but only the CISO gets penalized, accountability will always be uneven.

If you care about cybersecurity metrics, cyber risk management, CISO leadership, and building a security program that speaks the CFO’s language, this conversation will challenge your defaults. Subscribe, share this with a security leader who’s tired of vanity metrics, and leave us a review with one measurement you think the industry needs to stop using.

YouTube Video: https://youtu.be/sOdKjIibIKc

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Robert "RSnake" Hansen & Jeremiah Grossman join the pod to talk about the "Vuln-pocalypse", or rather, the lack thereof. We do some math, discuss whether it's worth patching vulnerabilities attackers don't exploit, and discuss a potential alternative to the madness of vuln management and patching we're all living with today.

Guests

• Robert "RSnake" Hansen
• Jeremiah Grossman

Description

The “vulnerability apocalypse” makes great headlines, but our day-to-day reality is stranger: more scanners, more CVEs, more urgency, and still the same breaches. We sit down with Jeremiah Grossman and Robert Hansen from Root Evidence to ask a blunt question most security teams avoid saying out loud: if the overwhelming majority of known vulnerabilities are never exploited, why are we treating every patch like a debt we must repay at any cost?

We dig into where vulnerability management went off the rails. CVSS scores and severity tiers often turn into a kind of black magic, especially at enterprise scale where “patch everything” can be operationally impossible and sometimes actively dangerous. We share real-world patching fallout, talk about why prioritizing millions of findings is like turning the Titanic with a teaspoon, and outline what “reasonable” can look like when you stop optimizing for perfect dashboards and start optimizing for outcomes.

The turning point is data. Cyber insurance carriers and DFIR teams perform root cause analysis on real claims, and that actuarial view shows which remotely exploitable vulnerabilities actually drive financial loss. We talk about focusing on known exploited vulnerabilities, why a relatively small list of CVEs can matter more than thousands of “critical” alerts, and how controls like MDR, canary tokens, and segmentation help prevent exploitation from becoming a business-ending event.

We also pressure-test the AI panic. According to multiple carriers, AI-attributed losses are effectively zero when you exclude phishing, raising an uncomfortable thought: are we funding fear instead of risk reduction? If you want a more evidence-based approach to patch management, cyber risk, and cybersecurity ROI, hit play, subscribe, and share the episode, then leave us a review with the one change you’d make to how your team prioritizes vulnerabilities.

YouTube Video: https://youtube.com/live/wC1v8Vg7qr4

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This pod is part 2 of a 2-part series in which Patrick shares his insights on the world of finance as it relates to cyber startups and financing. As promised, the tracksuit shows up, and it's an epic episode!

Guest: Patrick Dennis

Description

Private equity can feel like a plot twist: one day you are celebrating growth, the next day you are hearing new words like EBITDA, leverage, recap, and “value creation plan,” and everything from headcount to product scope is suddenly under a microscope. We sit down with Patrick to explain what is actually happening behind the scenes when a cybersecurity company moves from venture-backed momentum into private equity discipline.

We start with a clean breakdown of venture capital vs private equity. VC funds can afford many misses because a few massive outcomes pay for everything, whereas PE makes fewer investments and needs them to work more reliably. That difference shapes company behavior, especially when “grow at all costs” collides with a finite market, customer concentration, and the hard truth that bookings and ARR only matter if they turn into cash.

Then we demystify the metrics and mechanics that operators keep hearing but rarely get explained: why cash flow becomes the real governor, why EBITDA becomes the shared language among management, lenders, and investors, and how a value-creation plan drives changes in spend, pricing, and operating discipline. We also get candid about the darker fork in the road: down rounds, running out of cash, taking on debt through leveraged buyouts, and what happens when a company cannot service interest, and lenders end up in control.

Finally, we map the exit paths and what they mean for employees: IPO vs strategic sale vs sponsor-to-sponsor trades, plus how cash and stock deals can (and cannot) translate into payouts for option holders. If you want to evaluate your company’s trajectory with clearer eyes, subscribe, share this with a teammate, and leave a review with the finance term you want us to unpack next.

Youtube Video: https://www.youtube.com/live/3YfiJiTdLhk?si=oiGXZVhHofb3ijnk

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod features a Masterclass on finance for Cyber folks, led by Patrick Dennis, where we ask all kinds of questions and go from idea to the pre-growth stage of a company. What's next? Check out part 2 coming next.

Guest: Patrick Dennis

Description

A splashy funding announcement can feel like proof you’re winning, but it can also be the moment the clock gets louder. We sit down with returning guest Patrick Dennis, a multi-time [cybersecurity] CEO and operator who “swims in these waters,” to translate the funding ecosystem into plain English and remove the mystique from venture money without dumbing it down. If you’ve ever wondered why a Series D gets celebrated, what that really signals, and what it costs later, this conversation is for you.

We walk step-by-step through the early-to-late funding path: angel investors and seed rounds, venture capital at Series A and B, growth equity, and how private equity can show up as companies scale. Along the way, we tackle the words people throw around at conferences as if they’re obvious: valuation, dilution, burn rate, cap table, down rounds, and liquidity. Patrick breaks down why valuation is largely “on paper” until an exit, why investor timelines often point to a three-to-seven-year window, and why the higher you push the price, the smaller your list of realistic buyers becomes. We also talk about the “markup” incentive system that can quietly trap teams into needing a bigger round or a bigger exit than the market will support.

Then we bring it back to operating reality: how the zero-interest-rate [ZIRP] era trained cybersecurity companies to spend aggressively, and what changes when money is no longer cheap. We close with the human part founders underestimate most: taking money means giving up control and choosing a partner, and “hands-off” becomes “hands-on” fast when performance slips. Subscribe for part two, share this with a founder or operator in your circle, and leave a review with the funding question you want answered next.

YouTube video: https://youtube.com/live/zbDNnbHKEaU

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Guests

• Jack Korzeniowski
• Ken Foster

TL;DR: Budget season is upon us, and Rafal & James sit down with Ken Foster and Jack Korzeniowski to get some insights into how CISOs deal with budgets, separate truth from fiction, and get down into the dirty secrets.

Description

Budget season can feel like a slow-motion incident response: everyone has competing priorities, nobody wants surprise spend, and security still has to defend the enterprise. We sit down with experienced security leaders to talk candidly about how cybersecurity budgeting really works when you’re fighting for headcount, renewals, and new controls while leadership asks for ROI and says, “Nothing’s happened for three years, so why are we spending so much?” We share what actually lands in a budget deck that survives scrutiny and what gets cut even when it is clearly needed. 

From there, we get practical about the messy realities that break a clean plan. Audit findings can free up money faster than any risk narrative, but relying on that is a terrible strategy, so we discuss how to model “what happens if we don’t renew” and how to translate risk tolerance into finance language. We also dig into surprise drivers like mergers and acquisitions, sudden asset growth, and cross-team dependencies, where security buys the tool, but IT and app teams handle deployment and ongoing operational workload. If you don’t align early, you don’t just miss timelines; you damage trust across the organization. 

Then we tackle the newest budget collision: AI. Tokenomics, unpredictable utility bills, rising infrastructure costs, shadow AI, and rapidly forming “AI debt” can turn a reasonable forecast into a painful true-up. We outline ways to cap spend, phase rollouts, and keep governance tight without killing innovation. Finally, we give vendors and consultants a clear playbook for being better partners: multi-year price predictability, phased licensing, honest roadmap commitments, no surprise true-ups, and real total cost of ownership and ROI modeling that helps us sell the work internally. 

If you found this useful, subscribe, share it with a security leader heading into budget season, and leave a review with the one budget surprise you never want to relive.

Youtube Video: https://youtube.com/live/al7gQvb7C_Q

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Guest: Dr. Chase "ZeroTrust" Cunningham

TL;DR: AI Marketing slop took over Black Hat Las Vegas 2026, and Rafal sits down for a one-on-one with Chase Cunningham. Featuring their patented level of snark, real analysis, and hype detection, it's a fun conversation.

Description

Black Hat is supposed to be where the security industry shows its best work. This year, it also showed its biggest temptation: slap “AI” on everything, crank the volume, and sort out the truth later.

We break down what we saw on the floor and what it says about cybersecurity right now, with Chase Cunningham (Dr. Zero Trust) bringing receipts from vendor go-to-market changes and the money flowing into “AI-first” security startups. We talk about why so many tools sound identical, how “AI infrastructure” became the new catch-all label, and why the word “leader” stops meaning anything when everyone uses it. Then we get practical: how do you ask a booth team to define their artificial intelligence, what counts as autonomy, and what answers should make you walk away?

The conversation gets real when “AI security” turns out to be a polished UI sitting on top of a large language model API call. We dig into vendor lock-in, pricing and subsidy risk, and the uncomfortable question of who eats the impact when model providers change costs or terms. From there we go straight at the hottest promise in security operations: autonomous SOC and agent swarms. Non-deterministic models can be useful, but mistakes at machine speed can turn into outages and bad calls, so we map where automation helps and where humans still matter.

We also call out what we didn’t see: serious talk about hiring, growing junior talent, or serving SMB security needs even though many breaches flow through third parties and smaller vendors. If you care about security outcomes more than security slogans, this one’s for you. Subscribe, share, and leave a review, then tell us: what’s the most inflated AI claim you’ve heard lately?

YouTube video: https://youtu.be/mww1YpP-J0k

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Guests: Michael Farnum, Sam Van Ryder

TL;DR: Most cybersecurity dashboards don’t fail because they’re ugly. They fail because they don’t change what we do next.

Description

In Episode 717, Rafal sits down with Michael Farnum (Cybersec Community) and Sam (Dragos, a long-time OT and industrial cybersecurity practitioner) to talk about the uncomfortable truth behind security UI/UX: much of what shows up in the GUI is pure noise. We dig into the split between “pretty but useless” interfaces and tools that are practical but painful, then map out what a real practitioner-focused dashboard should deliver: contextual metrics, clear workflows, and data that drives action inside a SOC, an MDR, or an enterprise security team.

From SIEM and EDR lessons to product management realities, we unpack why companies miss the mark when marketing drives the roadmap or when engineering builds for engineers only. We also get candid about the analyst ecosystem, the difference between grounded practitioner feedback and “ivory tower” trend-chasing, and how that can steer executives toward tools that are hard to operationalize.

Then we move into AI and CTEM, continuous threat exposure management, and why the win isn’t a flashier interface. The win is faster telemetry correlation, so we can answer the questions that matter: is this vulnerability reachable in our environment, is it exploitable, and what should we prioritize right now? We also touch on modern “interfaces” like APIs and MCP, where the UX becomes how efficiently you can get results, even when the user is another machine.

If you care about security tools that actually work under pressure, hit play, subscribe, share the episode with a teammate, and leave a review with your biggest UI pet peeve.

YouTube Video: https://youtube.com/live/ts2rU1-j4EI

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Guests: Jason Vest & Josh Neil

TL;DR: Alert fatigue is still a problem; detection isn't generationally better - but we have all this AI. So what gives?

Description

Alert fatigue is not just a workload problem; it is a product design problem. We dig into a provocative claim sparked by a LinkedIn post: today’s “AI SOC triage” can be a band-aid if it only cleans up alerts after the fact instead of improving threat detection where it starts, in raw telemetry and early signal extraction.

We’re joined by Jason Vest (CTO at Binary Defense) and Josh (a statistician with experience from Los Alamos, the Department of Energy, and leading the Microsoft Defender for Endpoint data science team). Together we unpack why rules and detection engineering still matter: they encode what we know is bad, but rigid rule matches and atomic alerts can also trap teams in an endless false positive vs. false negative trade-off. Josh goes as far as to argue that alerts should “die in a fire,” pushing us to think in terms of attack stories and enterprise-wide context, not isolated hits.

From there we explore what actually scales: when anomaly detection works, why “model everything” breaks down, and how trigger-based just-in-time modeling can build lightweight models on demand, score the nearby context, then disappear. We also talk about moving from alerts to “situations,” using agentic AI to gather more context across identity, endpoint, and network, plus what transparency should look like for model validation and community standards.

Subscribe, share this with your SOC team, and leave a review. Where do you think detection should evolve next: better rules, better models, or a world without alerts?

YouTube Video: https://youtube.com/live/GYjePXCiKM0

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: David Kennedy & Larry Whiteside, Jr. join the podcast to talk about how 'alerts' are a terrible measure of work in the SOC, and what we're doing about it. We discuss the analyst experience, why it's so difficult and leads to burning our best staff out, and also David introduces his latest: NightBeacon CMD. You need to hear this.

I'm starting to edit my own videos, so hopefully you like the new format.

YouTube Video: https://youtu.be/aMTFaXwRl_A

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod is the conclusion to the 2-part series on AI SOC with Anton Chuvakin, Daniel Miessler, Rock Lambros, Erik Bloch, and Raja Mukerji. We talk about the rational application of AI to cybersecurity and what the future holds for the various options. You won't want to miss this one.

Youtube Video: https://youtu.be/5YIpZuQLTMg

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Join Raja Mukerji, Anton Chuvakin, Daniel Miessler, Rock Lambros, and Erik Bloch for a banger of an episode (part 1 of 2) where we debate the potential of AI and the current state of delivery for SOC and security applications.

This episode was made possible by a group of people with much better things to do than record a podcast who donated their time. Please join me in thanking them for their generous contributions.

YouTube video: ...coming soon, blame Anton

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Seth Summersett of Embed Security joins the podcast to talk about the snake oil that's coming from the AI SOC sellers. There's such a significant gap between what you're being sold and what's real. Seth and the gang talk about what's real, what you should expect, and where the line of bullsh** is.

YouTube video: https://youtube.com/live/Z8R19cjTjwA?

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod features Tim Chase, a field CISO and, by background, a practitioner. We talk about "prioritization", a topic that's boring but incredibly necessary, as I am confident nobody out here has this solved yet!

YouTube Video: https://youtube.com/live/099rUu0pV0g

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's podcast features Adam Ely - innovator, leader, and founder. Adam's led some of the world's largest security orgs, and started a tiny start-up. He's got knowledge and wisdom to share, so take it in.

YouTube video: https://youtube.com/live/PVTDaiiwlMs

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Phillip Wylie joins Rafal live from Zero Trust World 2026 in Orlando, FL, to talk about Operational Technologies (OT) in the context of Zero Trust. As the Joker once said, "Hubba Hubba, who do you trust?"

YouTube: https://youtu.be/N5sI85IwxIQ

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod features Karim Hijazi, Adam Meyers, and Will Gragido on AI and the potential advantages for adversaries. It's a fascinating discussion with in-depth analysis, commentary, and relatable stories that will give you the insights you can't get anywhere else. Buckle in, this one's an hour but completely worth it.

YouTube Video: https://www.youtube.com/live/w7nBe_uS8G4

Energy-Based Model company (that Karim referenced): https://logicalintelligence.com/

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Today's pod features Will Gragido, a multi-time returning guest with deep expertise in cyber intelligence, threat actors, and related activity. Will shares his expertise with us on how AI will impact the gathering, analysis, dissemination, and utilization of adversary and threat intelligence.

YouTube Video: https://youtube.com/live/l7mrBPRTokQ

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: How are organizations like the Motley Fool handling AppSec right now? How are companies building sustainable, measurable, and resilient software security programs, even as AI looms overhead? Catch Paolo del Mundo, Director of Application Security at the Motley Fool, and hear his insights on how he and his team make it work.

YouTube video: https://youtube.com/live/s6z-OytApF0

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Howard Holton's back for part 2 of this 2-part special on the cybersecurity market, procurement's role, innovation, and now with 100% more AI discussion (drink up). Will it be Idiocracy? Or Star Trek? I know what I think.

YouTube video (still sorry for the crap quality): https://youtube.com/live/q15xAwcPur8

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Buckle up. Howard Holton, CEO of GigaOm, joins for a 2-part special on the cybersecurity market, innovation, market saturation, and more. What an absolute blast of a podcast.

YouTube video (apologies for the crap quality): https://youtube.com/live/q15xAwcPur8

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Returning guest Gadi Evron joins the crew to talk about the latest bomb dropped by Anthropic - "Mythos". Allegedly, this model could bring about the vulnerability apocalypse, or something. Let's dive into it.

YouTube Video: https://youtube.com/live/RxY0Zj2UtLw

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Do you have a trusting relationship with your cyber VAR, reseller, or integrator? Most of us don't, and that's because the erosion of trust has been ongoing for the last decade. So when Josh Jones, Chris Roche, and Yonesy Nunez get together to work on a problem, you know it's worth your time to listen. On this episode, we dive into how we got here, how bad the problem is - and most importantly, what we can do about it.

YouTube Video: https://youtube.com/live/0umF7Bv3ra4

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Starting off the 700 series is Adrian Sanabria, long-time analyst, and industry insider. Adrian's SubStack post ( https://substack.com/home/post/p-189699798 ) makes an interesting distinction between 'work' and 'tasks'; then he goes on to explain how AI will apply. Fascinating conversation recorded live from Zero Trust World, 2026 sponsored by ThreatLocker.

YouTube Video: <shortly available>

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: THANK YOU. I can't believe I'm dropping episode 700. It's been a journey since September 2011 - so many amazing and unbelievable guests, conversations, and life lessons. So much incredible content that ages like fine wine, thank you to my friends James Jardine and Jim Tiller for doing this thing.

Thank you to all of YOU for listening, sharing, and rating us.

This is the industry's premier podcast for all things related to our profession. Here's to another 700.

YouTube video: https://youtube.com/live/bUnz763Iq90

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: As I continue to post content recorded in Orlando at Zero Trust World 2026, I bring you a live recorded episode with Marcus Hutchins. It's an interesting discussion that is no doubt polarizing, but no less interesting. Enjoy!

We are ONE EPISODE away from 700, thanks for being along for the ride!

YouTube Video: (coming shortly)

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's guest is Alex Hutton - who has been leading security teams in high-stakes organizations for years and is bringing his experience to you. We discuss leadership, risk, and several leadership topics you'll want to take notes on.

YouTube video: https://youtube.com/live/FRBbnWVyO_Q

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: On this episode of the pod, G. Mark Hardy joins Jim, James, and Rafal to talk about the precarious evolution of the role of the CISO. We even delve into the definition and purpose of risk, and find some there, there.

YouTube video: https://youtube.com/live/_gpV4XilToc

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's podcast is live'ish from Zero Trust World 2026, put on by ThreatLocker. It's a lively conversation with their CPO Rob Allen who can't help himself but mess with my recording equipment. Shenanigans ensue. You'll love it.

YouTube video: https://youtu.be/aOP6IT8OiDI

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Is cybersecurity headed for a market meltdown? Are we watching the bubble pop? Patrick Dennis joins Rafal to give some observations, analyze and provide guidance on what's happening, and what's to come. Buckle that chin strap, it's going to get crazy.

YouTube video: https://youtube.com/live/bhtvOSv48Jc

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: We've all experienced it - either you're the one, or you know someone, who works themselves to death. Whether it's "part of the job" or part of the job - it always leads to the same end. Rebekah Wilke and Ryan Halstead join James and I to talk through a very timely and critically important topic from a leadership perspective.

Big thanks to my guy Josh Jones for the excellent connection.

YouTube Video: https://youtube.com/live/Adpyja9KIkU

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This is one of the most relevant AI conversations, in the moment. Gadi Evron joins me to talk about how AI is not just changing everything, but how it's actually going to impact what you're doing - from security to everything else. Tune in, this is a critical conversation.

YouTube: https://youtube.com/live/t48sX54QCwI

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: What's it like to be an entrepreneur your entire career? Always trying something new, always doing something different? Ask Ran Nahmias, someone who's been around long enough to have done it all, and he's not done yet.

YouTube Video: https://youtube.com/live/qngve0dmd7M

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Today, Julian Brownlow Davies rejoins the pod (Ep 688) to continue the conversation about 3rd party external security testing. It's strong opinions and tales of woe all around.

Episode 688: https://dtsr.buzzsprout.com/2153215/episodes/18498795-dtsr-episode-688-looking-for-meaning-in-the-signal

YouTube video: https://youtube.com/live/6ZCPNXR_5u0

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's guest is Matt Carothers who works at a major Internet provider. We talk about defending, strategy, and some of the interesting topics that come with the job. If you have Internet at home, or at the office, or on the go - this episode is for you. There will probably be a part 2.

YouTube: https://youtube.com/live/tJcjtgn759g

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Social media is corrupting our kids, radicalizing your neighbors, and being basically evil with no checks. This episode is an "off the rails" discussion on a not-so-clearly Cyber Security topic, with us diving deep and getting a little angry. Thanks to Kevin Thompson for joining us and sharing his qualified opinion as a dad and experienced Scout Master.

YouTube: https://youtube.com/live/RXzAVG98T6s

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Grab your favorite note-taking thing, this week's pod features Julian Brownlow Davies of BugCrowd and it's chock full of things you'll want to look up. We tackle how red teaming and external 3rd party testing fits into a current security strategy, and how finding signal in the noise is just the beginning.

YouTube video: https://youtube.com/live/aNz-qPmWf7g1

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's episode is a special one. I (Rafal) revisit episode 100 with the one and only Dan Geer. Some shows are "in the moment", some are timeless. This show is timeless. Dan's wisdom and insights are as applicable today as they were 12 years ago. Crazy, right? Fun story - I ran into Dan at Black Hat conference a few years ago and asked him what he would say is 'different' since we recorded that episode... his response? "My beard is longer". Solid GOLD.

Listen in. Take notes.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: On today's pod, Rob Allen of ThreatLocker makes his triumphant return to derail us straight into a conversation about legacy systems and why he's still supporting WindowsXP. Right, you read that right. A great conversation ensued, and I'm glad we were able to record this one. Enjoy.

From us to you, thank you for following along this year, and we wish you a happy new year, and all the best in 2026!

YouTube video: https://youtube.com/live/dFO1NTo1MGc

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: In part 1 of 2, Gadi Evron joins the show and chats with Jim and Rafal on the topic of the "AI Cataclysm". What does that even mean? Listen in - but it's part to do with how AI is changing the attacker model (level of effort, expertise required, timeline) and what defenders should start to think about. Part 2 is coming soon, standby.

YouTube Video: https://youtube.com/live/izX0jOUpKJM

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's show features Aaron Costello, and is all about an analog from real-world attacks on humans, applied to AI "agents". I know what you're thinking - computers are supposed to be more difficult to trick, right? Right... no. Attacks such as this where computers try to be "helpful" (just like humans) are probably more common than we'd like to think. Give this a listen, it's a hoot.

YouTube video: https://youtube.com/live/fM88jSkamDQ

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: On this episode, it's just Jim and Rafal talking about how sometimes you just need to take a big step back from your day job and touch some grass. Our chosen profession is, demanding, to say the least. So let's take a minute to acknowledge what we're really thinking. Unfiltered, raw, and straight from our heads to your ears, enjoy.

YouTube video: https://youtube.com/live/ULTq1pzckFg

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod features a conversation with the Jay Jacobs, whom had previously been on the show talking about this very topic (vulnerability ranking/scoring) many, many years ago. If you missed Episode 297 check it out, it's crazy how far (or not) we've come since that conversation.

YouTube Video: https://youtube.com/live/cpL9ZYbwkes

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: John Rafal & Jim as we welcome Dustin Lehr to talk about the state of AppSec and how we got here. We discuss vulnerabilities, accountability, culture, and a host of other things. It's a caffein-fueled episode, so buckle in!

Youtube video: https://youtube.com/live/yoBIQ_sIawI

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: We heard RSnake's take on CVSS and CVEs and such, now let's hear Brian "Jericho" Martin's take. The gloves are off, and the opinions go native when we take this episode live. Brian doesn't pull any punches, and apparently I'm the only one without a pocket full of $2 bills?

Sorry for the explicit rating, that's Brian's fault.

YouTube Video: https://youtube.com/live/2-3Jzks5myc?feature=share

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast