Is internet trust fundamentally broken? On this episode, former Google "Click Fraud Czar" and Rekon CEO Shuman Ghosemajumder joins hosts Tim Peacock and Nolan Karpinski to trace the evolution of automated fraud—from Gmail's early invite days to the origin of "credential stuffing."

Discover why today's threat landscape feels like an AI DDoS, how cybercriminals exploit the "Smart Cow" resource model, and why running security models on-device is our best shot at defending against scaled AI slop without sacrificing data privacy.

What you'll learn:

• 🧠 The "Smart Cow" Problem: How advanced exploit tools are built by the few and commoditized for the masses.

• 💻 On-Device Defense: Why local, lightweight AI models are the future of communications security.

• 🛡️ The Paranoia Protocol: Tim and Shuman's practical advice on validating identities in the age of deepfakes.

👉 Subscribe for your weekly dose of cloud security insights, piping hot every Monday! Watch the full episode on YouTube at youtube.com/@CloudSecPodcast.

Can you build a fully functional, high-scale SIEM in just two weeks for under $7,000?

In this episode of the Cloud Security Podcast, hosts Tim Peacock and Kyle Champlin sit down with long-time collaborator Dan Lucier, Founder of Nano, to unpack how he "vibe-coded" an entire SIEM from scratch during his end-of-year holiday break.

Dan shares his journey of leveraging bleeding-edge AI code assistants to go from a Postgres prototype to a blazing-fast, production-ready SIEM built on Rust and ClickHouse.

In this episode, we cover:

• 🛠️ The $7,000 Stack: How Dan utilized Claude Code and Kubernetes to build a lean platform running on 2 vCPUs and 4GB RAM while ingesting 10–20 GB of data daily.

• ⚡ Why ClickHouse? The database architectural decisions behind maintaining sub-second search speeds at massive scale.

• 🤖 AI-Pilled but Cautious: Why Dan takes a surprisingly conservative approach to AI case closure and triage (and how it compares to Google's Triage and Investigation Agent).

• 💻 Detection as Code: How MCP (Model Context Protocol) servers and AI are leveling the playing field for smaller security teams.

Whether you're an AI enthusiast, a data nerd, or a security leader looking at the "fourth wave" of SIEM, this episode is a masterclass in modern, rapid-fire software engineering.

👉 Subscribe, leave a review, and join the debate on our LinkedIn page!

https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-cisos-can-pursue-technical-and-cultural-resilience-q-a?e=48754805

Guests:

• Gal Ordo, Co-founder & CPO @ Native

Topics:

• In Episode 186, we debated 'Native vs. Third-Party' as a binary choice. Native seems to be a third-party vendor whose entire existence depends on the belief that cloud-native controls are superior. Does your platform validate the 'Cloud Provider' side of the debate (that their controls are enough), or does the fact that you exist prove the 'Third-Party' side (that native interfaces aren't enough)?
• A key argument against native controls is an AWS WAF and a Google Cloud Armor don't behave the same way. If your tool manages native controls across multi-cloud, how do you handle the 'lowest common denominator' problem? Do you dumb down the policy to fit all clouds, or do you expose the unique complexity of each one?
• GuardDuty and SCC produce similar but meaningfully different results. How do you abstract across that so an analyst or IR team isn't having to dig into the exact meaning of the different JSON fields in their output?
• We often say native tools are 'good enough' for 80% of use cases but lack the depth of specialized third-party vendors (like a dedicated CNAPP or DLP). By betting your company on orchestrating native controls, are you effectively betting that 'good enough' is the future of the market? What happens when a customer needs a feature that the CSP hasn't built yet?
• What fraction of your users are taking this from a "I'm 80% this one cloud, I need great coverage there and good enough elsewhere" vs "I'm truly multi-cloud" or even scarier "I have a workload that is active spanning clouds"?
• Do your customers push you towards helping with the kinds of SaaS platforms that SSPM vendors cover?
• If AWS and Google Cloud suddenly decided to make their native security UIs perfect and unified tomorrow, would your company cease to exist? Or is the complexity of the cloud strictly increasing, guaranteeing you job security forever?

Related:

• Video version
• EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim
• EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again!
• The Great Cloud Security Debate: CSP vs. Third-Party Security Tools
• native.security blog

Guest:

• Matt Gregson, Principal - PwC Cyber Security

Topics:

• What is the state of the art of "agentic SOC" in 2026? Can you describe the most agentic SOC you've seen so far?
• In your experience, what are the main measurable benefits of AI agents in a SOC and IR?
• Imagine a 2030 SOC, what do humans do?
• Tell us more about how you judge if a client SOC is ready for AI and agents? What is the "Ouch" moment where most organizations realize their data isn't ready for that level of autonomy?
• Should we be more afraid of "AI hallucinations" or "Human fatigue" in the SOC?
• If a team has an agentic teammate making its own decisions based on emergent reasoning, how do you audit its "thought process"?
• Everyone loves to talk about "Time Saved," but in an agentic SOC, we care about "Decision Quality." What is the one metric PwC uses to prove that a SOC agent deployment is actually reducing risk?
• We often hear about "human-agent teaming." Are they still looking at alerts, or are they just approving "Action Plans" generated by the AI?

Resources:

• Video version
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success
• EP264 Measuring Your (Agentic) SOC: Two Security Leaders Walk into a Podcast
• All SOC and SIEM episodes