Explore every episode of the podcast Security Weekly Podcast Network (Audio)

Rogue AI, the Bar, Breaches, BMC, More Hugging Face, Helmuth von Multke, Ike, Shieldfont, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-603

In the security news:

• 2.2 million cars, one shared Bluetooth key
• JFrog tries to spin an AI 0-day into a win
• Sextortion scammers recycling ShinyHunters' leaks
• The first hack ever, from 1966
• Prompt injection as a service, $150 a month
• Cisco's mystery "static credential"
• BMCs still on the internet, still handing out hashes
• Scattered Spider duo sentenced over the TfL hack
• Air-gapped data sneaking out over the video cable
• A ghost in the network
• DNS poisoning checks into hotel WiFi
• Microsoft's cut-rate cybersecurity AI
• Learning to trust USB drives again
• Agentic pentesting shows up just in time for Black Hat
• Microsoft rethinks security for the AI age, again

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-937

Since the pandemic, managing remote teams have been challenging. How do you measure performance and motivate teams when they are remote?

Charles Gaudet, CEO & Founder at Predictable Profits, joins Business Security Weekly to discuss why transparency is the key to team motivation for remote workers. Charles will discuss how culture and performance metrics create that transparency. He will also discuss how to motivate your team based on their personality type.

Segment 1 Resources:

https://www.PredictableProfits.com

Find all of CyberRisk TV's Black Hat 2026 coverage at: https://www.securityweekly.com/blackhat

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-458

Deep Fakes, Molten Salt, PLCS, Checkpoint, Hugging Face, CENTOS, Josh Marpet, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-602

Orgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is an approach for defining customizable scenarios and testing whether those systems fail against known security threats. Mert Saltimaz talks about the background of the project, how orgs can use it as they bring more LLMs into their environment, and how the project intends to grow. Importantly, we also talk about the security controls and designs that orgs can build around the systems and data that models interact with in addition to evaluating the security of the agents and agent harnesses themselves.

Segment Resources:

• https://github.com/OWASP/Agent-Security-Regression-Harness
• https://youtu.be/6DWs5EwbFQ0?si=r0IJ_F0SZnkPzzYg -- "What Trading Systems Taught Me About Breaking (And Defending) Infrastructure"

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-393

Segment 1 - Interview with O'Shea Bowens

What do we really know about "AI Network Protocols"? Network security is about to get popular all over again.

Generative AI caused a disruptive explosion across all of tech and every company’s roadmap. The move from chatbots to AI agents doubled down on that disruption. Now agents need to talk to each other?

Boom: we have MCP. A2A. Universal Commerce Protocol. General purpose and specialized protocols for agent communication. What does this look like from the network perspective, though? O’Shea Bowen joins us to answer this question, and he thinks the results are interesting enough to spark a resurgence of interest in network security tooling.

Segment Resources:

1. https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSIMCPSECURITY.pdf?ver=bmgiSbNQLP6Z_GiWtRt6bg%3D%3D
2. https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-security-crisis-20260504-csa-styled/
3. https://cyberone.security/blog/building-an-ai-security-strategy-without-stalling-business-growth

Segment 2 - Interview with Jeremiah Grossman

Jeremiah Grossman on why we've been measuring cyber risk wrong for 20 years

After decades helping shape modern web security, and building companies that were ultimately acquired by Synopsys and Tenable, Jeremiah Grossman believes cybersecurity has arrived at an inflection point. His argument is a provocative one: for years, the industry has optimized around the wrong metrics. His latest venture, Root Evidence, aims to help security teams identify which risks are most likely to cause meaningful business loss, and he has the evidence - real-world breach data, cyber insurance claims, digital forensics intelligence, attack surface intelligence, and observed attacker behavior - to back it up.

Find all of CyberRisk TV's Black Hat 2026 coverage at: https://www.securityweekly.com/blackhat

Segment 3 - Weekly Enterprise News

Finally, in the enterprise security news,

1. We vibe check the AI model situation
2. hidden devices in California cars causes concerns
3. OpenAI’s models escape sandboxes and breaches another AI company, totally by accident, they promise!
4. Grok Build uploads all your files, totally by accident, they promise!
5. Eclipsium debuts a firmware version of patch tuesday!
6. HTTP gets a new method
7. common problems with incident response
8. Which one of the security weekly hosts would consider switching to a “dumb phone”?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-469

Rogue AI Vehicle Porn, OpenAI, Nudes, Clop, Patches, Oracle, Palo Alto, Aaran Leyland, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-601

In the news this week:

• InfraTrust and knowing what to patch
• Adversary in the middle triggered command injection
• Exploitarium again
• FreeRDP comes with free vulnerabilities
• AI breaking out of sandboxes on its own
• Wordpress RCE
• DMA dangers
• Nightmware eclypse is at it again
• Fortisandbox
• Turning AI to the dark side
• more prompt injection
• Secure boot is broken, still and again...

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-936

America has lived through technological and economic upheaval before. Farm workers moved to factories. Factory workers moved into services. New industries replaced old ones. Productivity rose. Living standards improved. But are we ready for the greatest disruption in American history?

Ben Gilliland, author of the upcoming book Breaking the Compact, joins Business Security Weekly to discuss why business leaders need to be prepared for the upcoming AI disruption. The impact of AI, which has not fully materialized, goes far beyond security and job displacement. It will impact our economy, our privacy, and our way of life. The closest recent warning is the "China shock," the period of rapidly increasing import competition that followed China's integration into the global trading system. AI will dwarf that. Ben will discuss the human advantage and how we can prepare now.

In the leadership and communications segment, Cybersecurity’s Economics Are Broken. Automation Alone Won’t Fix It, The business case for burning down security debt: A practical approach for CISOs, The last human relationship in cybersecurity, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-457

Nudification, Yeats, LegacyHive, ACR Stealer, Hugging Face, Route 53, 764, Wordpress, Kieran Human from Threatlocker, and More.

Segment Resources:

Malicious Edge extension abuses Native Messaging as bridge to malware: https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware/

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-600

Appsec often frames usability and security as at odds with each other. Apple's software has famously emphasized the importance of usability while also creating a solid security foundation. Patrick Wardle talks about how he's seen malware shift from Windows to macOS, how Apple's aggressive stance on deprecation benefits security, and the areas of the OS where he still sees plenty of opportunity for more security research. We discuss how developers make defensible design choices, why privacy needs security, and some security principles that any app developer should keep in mind regardless of their programming language or operating system.

Resources:

• https://objective-see.org/blog/blog_0x86.html
• https://objective-see.org/products/lulu.html
• https://objectivebythesea.org/v9/index.html

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-392

Interview with Keith Hollender, CEO and Co-Founder of Arcova

Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem

As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.

In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.

Keith also shares how Arcova’s practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova’s continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.

Segment Resources:

• https://arcova.com/sectors/
• https://arcova.com/category/blog/

For more information about Arcova and how they can help your enterprise shape what's next, please visit:

https://securityweekly.com/arcova

Topic: CMMC Pause creating chaos among federal contractors

This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide. The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.

I think Howard Holton nails it here when he says:

"100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."

PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.

What this means:

• Phase II is paused
• Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)
• NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required
• 60-day review aims to reform CMMC
• DoW opened an RFI for industry perspectives on what they should do
• CMMC characterized as a "compliance burden" and "red tape"
• False Claims Act and DOJ's cyber-fraud enforcement are still on the table

More resources:

• CIO Davies' post on Twitter
• Administrator of the Small Business Administration, Kelly Loeffler's post
• A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)

Weekly Enterprise News

Finally, in the enterprise security news,

1. will AI eliminate more cybersecurity jobs than it creates?
2. Linus’s law, amended
3. the biggest patch Tuesday ever
4. AI context bombs
5. AI workflows are a security disaster
6. people using AI in areas they don’t understand
7. ransomware crews are hitting legal firms hard
8. lessons learned from CISA’s recent github leak
9. demystify your USB cables!

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-468

M. Thénardier, LastPass, GitHub, EBS, Spirals, Pegasus, Shaft, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-599

This week, our technical segment covers a new open-source tool written by Paul (and Claude) that helps you keep your Linux systems up to date and assess supply chain risks. It's called "fettle" and is a pure Python implementation that gives you even more features than previously discussed! Then in the security news:

• The GodDamn Ransomware
• CMMC suspended
• Holy Microsoft Tuesday!
• Lessons learned
• Without the Internet, do we still get water?
• The forgotten shims
• More than two BIOS passwords
• Cracking firmware encryption with Claude
• 1999 called, and it wants its "Exploits" back
• Prompt injection for defenders
• Grok has your repo
• You're not going to outpatch AI

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-935

More than 48,000 vulnerabilities were disclosed in 2025, yet only about 1% are actively exploited. However, you’re expected to mitigate all vulnerabilities, or at least critical and high. But what if there is no patch to fix the vulnerability or the software is unsupported?

Ben Lipcynski, Director Security and Regulatory Services at Optima, joins Business Security Weekly to discuss how organizations can take back control of your enterprise software. OPTAS — Origina Proactive Threat Assurance Service — predicts, validates, prioritizes, and mitigates threats specific to your environment. Unlike AI vulnerability tools that flag everything without context or mitigation guidance, OPTAS cuts through the noise. OPTAS helps security teams focus on the risks that matter instead of chasing the 99% that do not.

Segment Resources: - https://www.origina.com/optas#optas-overview

This segment is sponsored by Origina. Visit https://securityweekly.com/origina to request a consultation.

In the leadership and communications segment, US enterprises incorporate cyber risk into larger strategic focus, 75% of CISOs Fear Executives Don’t Understand Cybersecurity Risks, AI agents are not your “coworkers”, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-456

Mr. Data, Joomla Babooa, 1VPNS, RabbitMQ, UEFI, Center 16, Sextortion, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-598

While LLMs and agents are new to appsec and everyone else, a lot of AI security requirements translate to well-known API security requirements. Jeremy Snyder helps us frame the OWASP LLM Top 10 into five layers in order to help orgs understand and prioritize their attack surface. A lot of orgs don't have to deal with model-specific threats or building their own GPU architecture, but every org adopting LLMs and agents should be aware of how those agents are being invoked and the output those agents are producing. That awareness of input and output helps in identifying and mitigating prompt injection attacks, ensuring agents are working within their expected boundaries, and taming token budgets.

Resources:

• https://genai.owasp.org/llm-top-10/
• https://github.com/rtk-ai/rtk
• https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
• https://www.firetail.ai/blog/beyond-the-spectacle-rsac-2026-and-the-5-layers-of-ai-security

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-391

Interview with François Proulx from Boost Security

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:

• Smoked Meat announcement
• Smoked Meat github
• Smoked Meat demo with Guillaume and François

Identiverse Interview with Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Identiverse Interview with Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn’t the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Borg, GitLost, ColdFusion, GodDamn, GhostApproval, OWA, Epaphroditus, Locutus, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-597

In the security news:

• Son of Anton strikes again!
• HalluSquatting and using Claude to defend itself
• CISA KEV’s Revolving Door
• LLM's hallucinate and companies get sued
• Additionally - GitLost
• Yet even more Linux vulnerabilities
• Citrix just keeps bleeding
• Old hardware is new again
• A sneak peak into next week's tech segment
• Tenda hidden backdoors
• We're still talking about Mirai
• Today was not a good day for Roundcube
• Canada is hacking criminals
• AI safeguards are still annnoying
• All cars will spy on you
• The FatFs unpatched vulnerability in millions of embedded devices
• Windows OS market share drops below 60% (Paul uses Arch)
• ‘We Cannot Choose to Become Idiots’ - or can we?

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-934

The latest generation of AI models has collapsed the time from vulnerability discovery to weaponized exploit from weeks to minutes, and reactive, module-based tools built around static dashboards simply can't keep up.

In this episode, Tanium COO Matt Quinn joins Business Security Weekly to discuss Tanium Atlas, the new autonomous operating system for IT and security. Matt explains why "good enough" operations are now a liability, how Atlas turns a single operator into the equivalent of an entire team, giving organizations the speed, scale, and efficiency to match the pace of today's threat environment. He also breaks down why nearly two decades of real-time endpoint telemetry across more than 36 million endpoints is the foundation no AI model can replicate on its own.

This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them!

In the leadership and communications segment, CEOs, CIOs clash over AI’s value, Aspiring Leaders, Don’t Just Network Up, Your Talent Strategy Has to Keep Up with Your AI Transformation, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-455

Dune References, FAT, Claude, ZhiPu, PolinRider, RentaBot, Sony, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-596

Mobile applications have unique risks and threat models compared to server-side applications and infrastructure. Consequently, they need different strategies to ensure their business logic and workflows well secured. We'll dive into some of these defense-in-depth strategies and why they are important to mobile applications. Securing workflows goes beyond input validation and pattern matching suspicious payloads; it requires detailed attention to state machines, edge cases, and collecting signals to evaluate trust.

Segment Resources:

• https://hubs.la/Q04jLKj70
• https://mas.owasp.org/MASTG/0x04c-Tampering-and-Reverse-Engineering/
• https://owasp.org/API-Security/editions/2023/en/0x00-header/

This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-390

Interview with Sandy Bird, co-founder of Sonrai Security

In this week's interview, we kick off the conversation with how Sonrai's expertise in securing cloud identity permissions had the company well placed to address the explosion of AI agents and the clear risks they represented. On the surface, this looks like a cloud/hyperscaler permissions challenge, but it isn't that simple. As agents like Claude Code, Codex, and Hermes are connected to enterprise cloud agents, the risk spreads outside VPCs and onto endpoints.

Check out the episode to learn more about some of the most common risks Sandy finds and how Sonrai goes about addressing them.

This segment is sponsored by Sonrai Security. Visit https://securityweekly.com/sonrai to learn more about them!

Segment Resources

• AWS Bedrock agent permissions: what you need to lock down before you go live

Making Enterprise AI Agents Accountable with Amir Ofek, CEO and Co-Founder of aizome

Organizations looking to unlock the power of Enterprise AI Agents, and in a controlled and safe way at the speed of AI. Identity is at the heart of it. However, NHI Governance Is Not Enough for Enterprise AI Agents.

The identity industry has responded to the rise of AI agents the same way it responds to every new identity challenge: extend existing frameworks. Map agents to human owners. Enforce least privilege. Govern them like non-human identities.

It is a reasonable instinct. It is also insufficient in ways that matter enormously. Non-human identity security was built for a deterministic world - service accounts, API keys, bots. These identities do what they are configured to do. Their behavior is predictable enough that static governance models work. Enterprise AI agents are categorically different. Not in degree - in kind. They don't execute fixed instructions. They reason, plan, and adapt in response to context. Their scope shifts with every task. Their behavior at runtime can diverge significantly from anything true at provisioning time. Unlike any identity that came before them, they frequently change their intent, at a pace no governance model built for human movers or machine credentials was designed to handle.

Wrapping them in the same framework you use for a service account isn't wrong. It's just insufficient in precisely the places where risk accumulates.

• Download the SANS AI Security Maturity Model eBook

This segment is sponsored by aizome. Visit https://securityweekly.com/aizomeidv to learn more about them!

The Human Authorized. The Agent Acted. Who's Accountable? Interview with Howard Ting - CEO - Opal Security

A self-driving car still has a license plate The accountability didn't change just because the driver did. The same has to be true for AI agents, but most environments can't trace an agent action back through the layers of delegation to the human who authorized it. Howard Ting, CEO of Opal Security, joins Security Weekly to discuss what the accountability model looks like when employees run swarms of agents, and what has to be in place before that accountability chain is tested.

• https://www.opal.dev/resource-center/identity-governance-report-2026-ai-access

This segment is sponsored by Opal Security. Visit https://securityweekly.com/opalidv to learn more about them!

Next Evolution of Identity Security: AI for Lower Cost, Efficiency & Governance with Ajay Gupta - President & CEO - SDG

Organizations have invested heavily in identity platforms, but many still struggle to maximize security, efficiency, and governance outcomes. As AI transforms both cyber defense and cyber threats, Identity Security is emerging as a critical foundation for securing human and non-human identities alike. In this discussion, we explore how AI is helping organizations reduce costs, improve operations, defend against AI-powered attacks, and address the governance challenges created by AI agents—highlighting the convergence of Identity Security, AI Security, and AI Governance.

This segment is sponsored by SDG. Visit https://securityweekly.com/sdgidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-466

I talk to Gibb Witham, President of Hack The Box, about cyber readiness, hands-on security training, Hack The Box, and AI in cybersecurity.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-595

This week we have a technical segment based on the response to "Atomic Arch", an updated open-source tool to help you catch malicious packages. In the security news:

• Exploitarium
• A hot messy summer of vulnerabilities
• AI Squatting
• Linux LPE - no shortage of those
• Fingerprinting Favicons
• Windows 10 extended
• Can Clothes Make You Invisible to Facial Recognition?
• Fable and Mythos for All
• Do we care about Quantum?
• Execs have AI risk under control
• Biological warefare in Spyware
• The scripts in-scope for PCI
• We don't have privacy, but we may get age restrictions

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-933

One of the biggest questions most executives ask is "Why does it still feel this hard when the talent is clearly there?" The answer, in almost every case, is not a people problem. It is an environment problem. And environment is something a leader can build.

Greg Hoffman, President at Ascension Performance Group, joins Business Security Weekly to discuss his new book, Performance Through People, a leadership parable that shows a practical operating model for building the conditions where people perform at their highest level. It is written as a story, but it is built as a framework. Greg will discuss the core pillars of this framework, including:

• Leadership First Mindset
• Operational Clarity
• Capability
• Empowerment
• Impact

Segment Resources: - https://a.co/d/053FuwYT - https://ascensionpg.com/articles/

In the leadership and communications segment, What the New Quantum Executive Orders Mean for Business Leaders, What I Learned About Burnout the Hard Way (and How to Actually Fix it, Mentorship Matters, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-454

AI Cocaine Recipes, Green Shirt Jailbreak, JLR Russia Hack, Scattered Spider, Cisco Root, Amazon Q Pwned – Aaran Leyland – SWN #594

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-594

SquidBleed reveals another vuln that's been lurking for decades, but its real lesson is in managing an attack surface. Regardless of whatever programming language you use, removing code is one of the best security steps you can take, followed by changing default configs to turn off uncommon features and ancient protocols.

The Linux kernel's removal of strncpy is another example of managing attack surface by replacing a notoriously misused and ambiguous function with more specific versions that better match the developers intent. It was a six-year journey for the kernel, but one that should remove a class of vulns and, importantly, improve performance.

Then it's on to agents with a discussion of the newly released OWASP AISVS and yet another example of evaluating LLMs as code reviewers.

Agentic AI Has an Identity Problem

AI agents are already running inside enterprise environments, operating on credentials, API tokens, and cloud roles that most security teams have never inventoried. When an agent acts autonomously across production systems, the security question is no longer just what it can do but who it is and whether that identity is governed at all. Itamar Apelblat, Co-Founder and CEO of Token Security, discusses why identity is the right lens for understanding agentic AI risk and what practical steps security teams can take now.

Segment Resources:

• https://www.token.security/product
• https://www.token.security/lp/ai-agent-identity-security-buyers-guide-ebook
• https://www.token.security/enzo
• https://www.token.security/ai-agent-calculator

This segment is sponsored by Token Security. To lean more, visit https://securityweekly.com/tokenidv

Blended Identities and the challenge of IAM for AI

AI agents aren't quite human and aren't traditional machines. So how do you secure workflows that involve humans using AI to access sensitive data, and do it at machine speed and scale? David breaks down the challenges and discusses actual implementations of IAM for AI to explain how to solve them.

Segment Resources:

• https://aembit.io/case-study/a-300b-investment-firm-secures-claude-access-with-aembit/
• https://aembit.io/blog/aembit-now-secures-microsoft-copilot-studio-agents/
• https://www.youtube.com/watch?v=cSInzRUXvNc

This segment is sponsored by Aembit. Get the cloud security alliance survey on AI Identities at https://securityweekly.com/aembitidv

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-389

Interview with Adriel Desautels - the pentest is broken

Adriel joins us for a discussion on the state of penetration testing, why it hasn't done much to help security teams over the last 20 years, and why AI won't save it.

Segment Resources:

• https://hbr.org/2026/04/boards-are-falling-short-on-cybersecurity
• https://www.scworld.com/perspective/how-to-build-a-breach-ready-security-posture-without-the-enterprise-price-tag
• https://netragard.com/blog/what-is-penetration-testing/

Topic: Why Meta is destroying its engineering organization

The titular essay: https://newsletter.pragmaticengineer.com/p/why-is-meta-destroying-its-engineering

A very interesting analysis of what's going on inside big tech companies as they try to dogfood their own AI hype and tokenmaxx themselves into oblivion. There have been a LOT of stories on this, but this is the most comprehensive and enlightening. A few more are linked below.

This is relevant to security, because heavier AI use appears to be linked to a much higher occurrence of availability and security issues.

• ‘Tell Him He’s a Piece of Shit’: Meta’s New AI Unit Is a Total Mess
• The Newest Instagram "Exploit" is the Goofiest I've Seen
• Meta CTO Andrew Bosworth Admits the Company’s AI Reorg Was ‘Atrocious’
• Meta’s months-old AI unit is a soul-crushing gulag, say the engineers stuck inside it

The Weekly Enterprise News

Finally, in the enterprise security news,

1. an AI vibe check
2. An AI SOC vendor shuts down
3. Cybersecurity vendor layoffs
4. funding & acquisitions
5. cascading breaches
6. digital estate management
7. criminals don’t trust AI either
8. some devs won’t code without AI, even if you pay them to
9. Midjourney is now a healthcare company?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-465

AI Brain Harvest, Fortibleed, Win 10, Blacksite, Windchill, Cisco, BB-8 Sidewalk Bots, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-593

First up is Sandy Bird from Sonrai discussing how to protect our cloud infrastructure!

This segment is sponsored by Sonrai Security. Visit https://securityweekly.com/sonrai to learn more about them!

Next up in the security news:

• Help, I am Fortibleeding
• Cisco SD-WAN needs help
• The secret life of probe requests
• Help, I am Squidbleeding
• XSS to RCE and why CVSS isn't the full picture
• TVs spy on you
• Foundational security practices
• Cybersecurity costs money
• Happy "Its too late to update your KEK key" day
• You don't have security flaws if no one can report them
• Rickrolling FIFA
• Domain takeovers
• End of life, out of luck
• The key to Encryption...

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-932

The 2026 Verizon DBIR has arrived and the results are in... Even with a substantial increase in Exploitation of Vulnerabilities, All Credential Abuse is still the top initial access vector for breaches, which means the human is still the weakest link. Why haven't security awareness training and phishing campaigns worked?

Robert Siciliano, Architect of of The Strategic Human Firewall™ at ProtectNow, joins Business Security Weekly to explore why humans, not hackers, are the ultimate deciding factor in organizational security. The industry needs to shift from security awareness to security appreciation. Robert will discuss:

• How you can build a culture that actually protects your people, your data, and your operations in an era of AI deception.
• Why most companies are still performing 'Security Theater'—checking boxes and hoping for the best—instead of driving genuine behavior change.
• How Trust and Denial quietly fuel most disasters, why interactive training is the only way to make the lessons stick, and how leaders can scale this entire framework without needing a Hollywood budget.

Segment Resources:

https://protectnowllc.com/ai-cyber-security-keynote-speaker/

In the leadership and communications segment, Should CEOs Be Held Personally Accountable for Cyber Attacks?, Placing communication at the center of every leadership transition, AI isn’t solving cybersecurity workforce woes, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-453

Turing's Entscheidungsproblem, BODS, Struwwelpeter, EO-14409, VBScript, Pixemsmash, Cloudflare, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-592

Appsec has seen machine identities from daemons and processes to services, microservices, and cloud accounts. And now we have agents. Ev Kontsevoy talks about what it means to have engineers and agents interacting in an environment, and why a focus on actions can be more effective than roles. One of the biggest challenges in securing agents along with all of the other identities that organizations manage is how fragmented that management has become. But a unified engineering view of identities is just a start. Once you're able to shift to a practice where access is granted based on attributes and limited durations, then your environment becomes more resilient to mistakes and unexpected actions, not to mention the security concerns that come with agents acting on their own.

Who Is Responsible for an AI Agent's Actions? As AI agents gain the ability to access systems, invoke tools, and take action on behalf of users, organizations need clear frameworks that define responsibility for machine-driven decisions and outcomes. This segment examines how accountability, delegation, and attribution can be established across users, developers, security teams, and business stakeholders. Neha will explore how governance models support transparent, auditable agent-driven workflows while helping organizations manage risk and maintain trust.

This segment is sponsored by P0 Security. Visit https://securityweekly.com/p0idv to learn more about them!

The rapid rise of agentic AI and non-human identities is fundamentally reshaping the future of identity security, challenging traditional IAM and PAM models built around predictable human behavior. In this executive interview at Identiverse 2026, Amit Masand discusses how autonomous systems, AI agents, and machine identities are creating new operational and governance challenges for modern enterprises. Drawing from more than two decades of industry experience, the conversation explores the growing complexity of continuous governance in a world where identities increasingly operate at machine speed.

Segment Resources: https://www.idmexpress.com/post/preventing-cybersecurity-incidents-through-managed-services https://www.idmexpress.com/post/cyberark-securing-aws https://www.idmexpress.com/post/turning-roadblocks-into-breakthroughs-a-custom-oracle-pam-integration-story

Contact IDMEXPRESS! Secure Your Tomorrow, Today: https://securityweekly.com/idmidv

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-388

Interview with Ankita Gupta, CEO of Akto

How to Navigate Shadow AI Risk in the enterprise

This week, we discuss AI governance in the enterprise, starting with the nuts and bolts of how to discover and understand shadow AI. Following that, we dive into what security and tech leaders should do next with this information: apply guardrails? Limit vendor options?

Ankita has a wealth of experience and anecdotes to share here, from years of working with customers and seeing all the unexpected things that happen with AI in today's workplace.

Segment Resources:

• Website: https://www.akto.io
• Book a Free Demo: https://www.akto.io/agentic-security-demo
• LinkedIn: https://www.linkedin.com/company/akto-io
• YouTube: https://www.youtube.com/@aktodotio

This segment is sponsored by Akto. Visit https://securityweekly.com/akto to secure your AI agents before attackers do.

Topic Segment: Verizon's Breach Impact Study

The same team that delivers the DBIR every year gave us a bonus, based on over 70,000 insurance claims!

Some of my favorite insights:

• Cost of breaches, broken out by SMB, mid-sized enterprise, and large
• The claim amount as a percentage of the company's revenue
• Losses broken down by loss TYPE

This data validates something I think everyone in cyber needs to understand: cyber events are rarely business-ending events. Every cybersecurity professional and vendor, frustrated by companies "not taking security seriously enough" now have data explaining why: breaches don't hurt as much as you thought they did. Maybe you think they should hurt more? Push for regulation/fines/etc.

With that said, the report also shows breach costs increasing significantly over the past 6 years and the quantity of incidents shooting up. Specifically, the median impact has almost doubled.

Security failures aren't getting any cheaper.

Weekly Enterprise News

Finally, in the enterprise security news,

1. A $100M seed round!
2. Accenture acquires 3 security vendors
3. Some thoughts on the government takedown of Fable and Mythos
4. One of the craziest security mistakes I’ve ever seen, in the software FIFA uses to manage World Cup streams!
5. A Critical Copilot vulnerability
6. 75,000 Fortinet Firewalls get compromised
7. Remediation is broken
8. Using guardrails to evade detection

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-464

Doug and Rob Allen talk about Identity, EDR, Your Great Aunt Ida Meets some hot firefighters, and more.

Segment Resources:

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools: https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-591

In the security news this week:

• GPS spoofing and satellite jamming are getting way too accessible
• Rekeying satellites in orbit sounds terrifying
• Cyber extortion and whether criminals still have ethics
• AI helping cybersecurity research... and drug discovery
• Data centers eating regional power grids
• Nuclear, solar, natural gas, and the future of AI infrastructure
• What happens when GPS stops being trustworthy?
• Satellite constellations as the next critical infrastructure target
• AI guardrails and why sci-fi warned us first
• Cyber ranges that don't simulate reality anymore
• The weird morality line between hackers, scammers, and criminals
• Future satellite warfare without calling it warfare
• Security standards for infrastructure nobody thought would be online
• Historical cybersecurity stories that suddenly feel very current
• Why AI changes both offense and defense simultaneously
• And how much of modern cyber defense is just educated guessing

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-931

The browser has become the primary gateway to work, data, and AI. In this episode, Arunesh Chandra, Head of Product, Microsoft Edge for Business at Microsoft Edges for Business, will discuss why security and IT teams are rethinking the role of the browser and what sets Edge for Business apart as a secure, enterprise-ready solution. Arunesh cover how built-in security, native integration with existing IT tools, and centralized management can simplify operations, reduce risk, and support modern work across managed devices, BYOD, and contractors. A must listen for IT pros and security experts navigating browser sprawl and AI adoption.

This segment is sponsored by Microsoft Edge for Business. Visit https://securityweekly.com/edgeforbusiness to learn more about them!

In the leadership and communications segment, CISO role changes as cyber-risk appetites in the C-suite grow, AI is exposing the biggest weakness in cybersecurity: We never built a health model. Until now!, 6 Ways Leaders Harness Stress, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-452

TSME, ARCH, Maine, Fable, PANOS, Doug's Grandma, Vienna Sausages, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-590

Agents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But if we're focused on determining whether code is secure, where do we focus our attention on ensuring a secure outcome? Matias Madou talks about the challenges of finding metrics to help answer these questions. We walk through many of the questions we'd like to see answered and our desire to see appsec (finally?) shift out of a find-and-fix mode into a future of secure design.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-387

Interview with Shiva Pillay from Veeam

Safe AI at Scale

AI investment is exploding, yet nearly 90% of enterprise initiatives fail because the data powering AI cannot be trusted. That’s the uncomfortable truth the industry is facing right now. Safe AI at scale requires more than just great models—it demands trusted, governed, and recoverable data.

This segment is sponsored by Veeam. Visit https://securityweekly.com/veeam to learn more about them!

Segment resources:

• Veeam Launches New Data and AI Trust Maturity Model to Help Organizations Benchmark AI Readiness

Topic: Sure, we know how initial access works, but what about lateral movement?

A special topic segment where we're joined by Albert Estevez Polo, field CTO for Zero Networks (a community guest, not a podcast sponsor). Zero Networks just released some very interesting data on what attackers are doing after they gain access to victim's environments and how they're doing it.

Segment Resources:

• Link to report page

Weekly Enterprise Security News

Finally, in the enterprise security news,

1. Funding and acquisitions
2. Good news, Mythos isn’t dangerous anymore!
3. An excellent breach analysis
4. Cyber insurance rates are dropping, but there’s a catch
5. CISA updates vulnerability remediation guidance
6. Zoom calls are worse than you think, and maybe not for the reasons you think
7. Remember when it was illegal to rip DVDs?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-463

Bad Phones, Sarlaccs, Maine, Chinese Sites, Ivanti, GreatXML, Bitlocker, Peoplesoft, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-589

In the security news:

• Trolling Microsoft With Vulnerabilities
• Fable 5 loves guardrails
• Binwalk vulnerability
• EMBA and local models
• EDRChoker
• AI worms
• Interesting Arista vulnerability added to KEV
• BOD 26-04 and stakeholder specific vulnerability categorization
• Bring your own execution environment
• Homelab tips
• MikroTik routers as interceptors
• Ivanti Sentry and irony
• Smart TV botnets
• Privacy laws
• Solarwinds Serv-U lives on
• More Cisco SD-WAN fun!
• Russia can jam GPS
• No nudes for you says UK Government
• "Why would someone want to learn code when AI does it better and faster?"

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-930

AI is reshaping innovation as businesses embed it into core operations and move more processes online. This transformation is often seen as a tradeoff between innovation and data risk, but that assumption is wrong. Businesses can innovate and scale in the AI era while maintaining strong data security, ensuring protection, compliance, and control remain intact.

Segment Resources:

• Check out these assets from Fortra for more information around Data Security for AI.
• Learn more about our Data Security suite: https://www.fortra.com/solutions/data-protection
• Get the ungated guide: Secure AI Innovation > https://www.fortra.com/resources/guides/secure-ai-innovation
• Read the blog: Staying Compliant While Using AI: What CISOs Need to Know https://www.fortra.com/blog/staying-compliant-while-using-ai-what-cisos-need-know

This segment is sponsored by Fortra. Visit https://securityweekly.com/fortra to learn more about them!

In the leadership and communications segment, Lost in translation: Cybersecurity board reporting for CISOs, AI may finally unlock the cyber budgets CISOs have wanted for years, How People Actually Get to the C-Suite in S&P 500 Companies, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-451

Geinbot, SolarWinds, Brave, UNK_Deaddrop, durabletask, Insta, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-588

Most AppSec teams are working through more findings than their teams can validate. SAST surfaces thousands of potential issues. DAST generates alert volume that outpaces triage capacity. Somewhere in that output are the vulnerabilities that matter, the ones that are actually exploitable in production. This conversation explores why automated testing often stops short of the hardest part of the job: proving what is real. We dig into how business logic flaws and authorization vulnerabilities get missed by tools that scan without reasoning, what exploit validation looks like at runtime, and how security engineers are shifting toward findings that developers will actually act on.

The segment is sponsored by XBOW. Visit https://securityweekly.com/xbow to see how autonomous AI pentesting delivers expert-quality findings in hours with real exploit validation your team can actually act on.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-386

Interview with Filip Stojkovski on the State of AI in SecOps

Filip joins us to talk through the 2+ year rollercoaster that Security Operations tooling has been on since AI entered the chat. We discuss the AI SecOps market, which Filip closely tracks through his SecOps Unpacked project. We also discuss how most of the market has traditionally been focused on the "middle" of the process, which is effectively alert management. Where the conversation really gets interesting is shifting left to discuss building better quality detections.

Segment Resources:

• Be sure to check out SecOps Unpacked - it has more than just vendor information: there are articles, frameworks, podcast episodes, research, and articles/thought leadership

Topic: The Unintended Consequences of Vulnmaxxing

We discuss my latest blog post where I share a theory that perhaps Project Glasswing is a clever exclusive freemium tier, where Anthropic is hoping to ensnare the world's largest producers of software into using its most expensive model to fix their code for the foreseeable future, creating a much needed new revenue stream for the AI giant with a Trillion dollar valuation.

There are some potential unintended consequences that come along with an expensive vulnerability discovery/remediation process that threatens to raise the security poverty line and leave less wealthy companies behind.

The Weekly Enterprise News

Finally, in the enterprise security news,

1. If you were starting a cybersecurity company today, which category would you pick?
2. layoffs
3. funding
4. the White House AI executive order
5. OpenAI’s frontier governance framework
6. Anthropic’s Zero Trust for AI agents guide
7. IBM’s vulnmaxxing efforts
8. RICO as a service for job seekers
9. Instagram had possibly the most embarrassing hack ever

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-462

Local AI, Salesforce, Fluttershell, Aspose, http/2 bomb, Passwords, Cisco, Used Tech, Josh Marpet, and More on this episode of the Security Weekly News

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-587

This week in the security news:

• Security Researchers Are Threat Actors according to Microsoft
• Hands-free malicious firmware
• If you've ever typed "ls" in Windows, this is for you
• Cisco makes more patches, wants you to pay
• Ambiguous Secure Boot bypass
• Threat actors love network edge devices, and I have the chat logs and leaks to prove it
• The downside of chip sanctions
• Your VoIP phone is hacked
• Vulnerability disclosure and incentives
• Claude reccovers Bitcoin wallet
• an Instagram "Exploit"
• Turn the plane around
• The worms will continue
• PAN-OS global protect vulnerability
• The 1-Click Github token stealer
• Data-nuking prompt injection
• Turning Buses into spies
• SymJack
• NIST NVD mistakes, and how CNAs need to up their game

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-929