Guest:

• Jibran Ilyas, Director for Incident Response at Google Cloud

Topics:

• What is this tabletop thing, please tell us about running a good security incident tabletop? 
• Why are tabletops for incident response preparedness so amazingly effective yet rarely done well?
• This is cheap/easy/useful so why do so many fail to do it? Why are tabletops seen as kind of like elite pursuit?
• What’s your favorite Cloud-centric scenario for tabletop exercises? Ransomware? But there is little ransomware in the cloud, no?
• What are other good cloud tabletop scenarios?

Resources:

• EP60 Impersonating Service Accounts in GCP and Beyond: Cloud Security Is About IAM?
• EP179 Teamwork Under Stress: Expedition Behavior in Cybersecurity Incident Response
• EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends
• EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant
• EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
• EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?

Guest:

•  David Gee, Board Risk Advisor, Non-Executive Director & Author, former CISO

Topics:

• Drawing from the "Aspiring CIO and CISO" book's focus on continuous improvement, how have you seen the necessary skills, knowledge, experience, and behaviors for a CISO evolve, especially when guiding an organization through a transformation?
• Could you share lessons learned about leadership and organizational resilience during such a critical period, and how does that experience reshape your approach to future transformations?
• Many organizations are undergoing transformations, often heavily involving cloud technologies. From your perspective, what is the most crucial—and perhaps often overlooked—role a CISO plays in ensuring security is an enabler, not a roadblock, during such large-scale changes?
• Have you ever seen a CISO who is a cloud champion for the organization?
• Your best advice for a CISO meeting cloud for the first time?
• What is your best advice for a CISO meeting AI for the first time?
• How do you balance the continuous self-improvement and development with the day-to-day pressures and responsibilities?

Resources:

• “A Day in the Life of a CISO: Personal Mentorship from 24+ Battle-Tested CISOs — Mentoring We Never Got” book
• “The Aspiring CIO and CISO: A career guide to developing leadership skills, knowledge, experience, and behavior” book
• EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
• EP101 Cloud Threat Detection Lessons from a CISO
• EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
• EP129 How CISO Cloud Dreams and Realities Collide
• All CISO podcast episodes
• “Shadow Agents: A New Era of Shadow AI Risk in the Enterprise” blog
• “Blocking shadow agents won’t work. Here’s a more secure way forward” blog

Guest:

• Sumedh Thakar, President and CEO, Qualys

Topics:

• How did vulnerability management (VM) change since Qualys was founded in 1999? What is different about VM today?
• Can we actually remediate vulnerabilities automatically at scale? Why did this work for you even though many expected it would not?
• Where does cloud fit into modern vulnerability management?
• How does AI help vulnerability management today? What is real?
• What is this Risk Operations Center (ROC) concept and how it helps in vulnerability management?

Resources:

• 2025 DBIR Report 
• Qualys ROC concept defined
• Qualys ROC-on conference
• Shaping the Future of Cyber Risk Management blog 
• Qualys State of Cyber Risk Assessment Report
• EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!

Guest:

• Rick Caccia, CEO and Co-Founder, Witness AI

Topics:

• In what ways is the current wave of enterprise AI adoption different from previous technology shifts? If we say “but it is different this time”, then why?
• What is your take on “consumer grade AI for business” vs enterprise AI?
• A lot of this sounds a bit like the CASB era circa 2014. How is this different with AI? 
• The concept of "routing prompts for risk and cost management" is intriguing. Can you elaborate on the architecture and specific AI engines Witness AI uses to achieve this, especially for large global corporations? 
• What are you seeing in the identity space for AI access? Can you give us a rundown of the different tradeoffs teams are making when it comes to managing identities for agents? 

Resources:

• EP226 AI Supply Chain Security: Old Lessons, New Poisons, and Agentic Dreams
• EP173 SAIF in Focus: 5 AI Security Risks and SAIF Mitigations
• EP84 How to Secure Artificial Intelligence (AI): Threats, Approaches, Lessons So Far
• Witness AI blog
• Shadow Agents: A New Era of Shadow AI Risk in the Enterprise
• Blocking shadow agents won’t work. Here’s a more secure way forward
• Shadow AI Strikes Back: Enterprise AI Absent Oversight in the Age of Gen AI
• Cloud CISO Perspectives: How Google secures AI Agents
• “The Soul of a New Machine” book
• Emoji Attack: A Method for Misleading Judge LLMs in Safety Risk Detection

Guest:

• Jon Oltsik, security researcher, ex-ESG analyst

Topics:

• You invented the concept of SOAPA – Security Operations & Analytics Platform Architecture. As we look towards SOAPA 2025, how do you see the ongoing debate between consolidating security around a single platform versus a more disaggregated, best-of-breed approach playing out? 
• What are the key drivers for either strategy in today's complex environments? How can we have both “decoupling” and platformization going at the same time?
• With all the buzz around Generative AI and Agentic AI, how do you envision these technologies changing the future of the Security Operations Center (and SOAPA of course)? 
• Where do you see AI really work today in the SOC and what is the proof of that actually happening? What does a realistic "AI SOC" look like in the next few years, and what are the practical implications for security teams?
• “Integration” is always a hot topic in security - and it has been for decades. Within the context of SOAPA and the adoption of advanced analytics, where do you see the most critical integration challenges today – whether it's vendor-centric ecosystems, strategic partnerships, or the push for open standards?

Resources:

• Jon Oltsik “The Cybersecurity Bridge” podcast (Anton on it)
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP242 The AI SOC: Is This The Automation We've Been Waiting For?
• EP202 Beyond Tiered SOCs: Detection as Code and the Rise of Response Engineering
• EP180 SOC Crossroads: Optimization vs Transformation - Two Paths for Security Operations Center
• EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC
• EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!
• Daniel Suarez “Daemon” book and its sequel “Delta V”

Guest:

• Cy Khormaee, CEO, AegisAI
• Ryan Luo, CTO, AegisAI

Topics:

• What is the state of email security in 2025?
• Why start an email security company now?
• Is it true that there are new and accelerating AI threats to email?
• It sounds cliche, but do you really have to use good AI to fight bad AI?
• What did you learn from your time fighting abuse at scale at Google that is helping you now
• How do you see the future of email security and what role will AI play?

Resources:

• aegisai.ai 
• EP40 2021: Phishing is Solved?
• EP41 Beyond Phishing: Email Security Isn't Solved
• EP28 Tales from the Trenches: Using AI for Gmail Security
• EP50 The Epic Battle: Machine Learning vs Millions of Malicious Documents

Guest:

• Augusto Barros, Principal Product Manager, Prophet Security, ex-Gartner analyst

Topics:

• What is your definition of “AI SOC”?
• What will AI change in a SOC? What will the post-AI SOC look like? 
• What are the primary mechanisms by which AI SOC tools reduce attacker dwell time, and what challenges do they face in maintaining signal fidelity?
• Why would this wave of SOC automation (namely, AI SOC)  work now, if it did not fully succeed before (SOAR)?
• How do we measure progress towards AI SOC? What gets better at what time? How would we know? What SOC metrics will show improvement?
• What common misconceptions or challenges have organizations encountered during the initial stages of AI SOC adoption, and how can they be overcome?
• Do you have a timeline for SOC AI adoption? Sure, everybody wants AI alerts triage? What’s next? What's after that?

Resources:

• “State of AI in Security Operations 2025” report
• LinkedIn SOAR vs AI SOC argument post 
• Are AI SOC Solutions the Real Deal or Just Hype?
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP238 Google Lessons for Using AI Agents for Securing Our Enterprise
• EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025
• RSA 2025: AI’s Promise vs. Security’s Past — A Reality Check
• “Noise: A flaw in human judgement” book
• “Security Chaos Engineering” book (and Kelly episode)
• A Brief Guide for Dealing with ‘Humanless SOC’ Idiots

Guest:

• Rick Correa,Uber TL Google SecOps, Google Cloud

Topics:

• On the 3rd anniversary of Curated Detections, you've grown from 70 rules to over 4700. Can you walk us through that journey? What were some of the key inflection points and what have been the biggest lessons learned in scaling a detection portfolio so massively?
• Historically the SecOps Curated Detection content was opaque, which led to, understandably, a bit of customer friction. We’ve recently made nearly all of that content transparent and editable by users. What were the challenges in that transition?
• You make a distinction between "Detection-as-Code" and a more mature "Software Engineering" paradigm. What gets better for a security team when they move beyond just version control and a CI/CD pipeline and start incorporating things like unit testing, readability reviews, and performance testing for their detections?
• The idea of a "Goldilocks Zone" for detections is intriguing – not too many, not too few. How do you find that balance, and what are the metrics that matter when measuring the effectiveness of a detection program? You mentioned customer feedback is important, but a confusion matrix isn't possible, why is that?
• You talk about enabling customers to use your "building blocks" to create their own detections. Can you give us a practical example of how a customer might use a building block for something like detecting VPN and Tor traffic to augment their security?
• You have started using LLMs for reviewing the explainability of human-generated metadata. Can you expand on that? What have you found are the ripe areas for AI in detection engineering, and can you share any anecdotes of where AI has succeeded and where it has failed?

   Resources

• EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
• EP231 Beyond the Buzzword: Practical Detection as Code in the Enterprise
• EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
• EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations
• EP123 The Good, the Bad, and the Epic of Threat Detection at Scale with Panther
• “Back to Cooking: Detection Engineer vs Detection Consumer, Again?” blog
• “On Trust and Transparency in Detection” blog
• “Detection Engineering Weekly” newsletter
• “Practical Threat Detection Engineering” book

Guest:

• Errol Weiss, Chief Security Officer (CSO) at Health-ISAC

Topics:

• How adding digital resilience is crucial for enterprises? How to make the leaders shift from “just cybersecurity“  to “digital resilience”?
• How to be the most resilient you can be given the resources? How to be the most resilient with the least amount of money?
• How to make yourself a smaller target?
• Smaller target measures fit into what some call “basics.”  But “Basic” hygiene is actually very hard for many. What are your top 3 hygiene tips for making it happen that actually work?
• We are talking about under-resources orgs, but some are much more under-resourced, what is your advice for those with extreme shortage of security resources?
• Assessing vendor security - what is most important to consider today in 2025?  How not to be hacked via your vendor?

Resources:

• ISAC history (1998 PDD 63)
• CISA Known Exploited Vulnerabilities Catalog
• Brian Krebs blog
• Health-ISAC Annual Threat Report 
• Health-ISAC Home 
• Health Sector Coordinating Council Publications
• Health Industry Cybersecurity Practices 2023
• HHS Cyber Performance Goals (CPGs) 
• 10 ways to make cyber-physical systems more resilient
• EP193 Inherited a Cloud? Now What? How Do I Secure It?
• EP65 Is Your Healthcare Security Healthy? Mandiant Incident Response Insights
• EP49 Lifesaving Tradeoffs: CISO Considerations in Moving Healthcare to Cloud
• EP233 Product Security Engineering at Google: Resilience and Security
• EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators

Guest:

• Craig H. Rowland, Founder and CEO, Sandfly Security

Topics:

• When it comes to Linux environments – spanning on-prem, cloud, and even–gasp–hybrid setups – where are you seeing the most significant blind spots for security teams today? 
• There's sometimes a perception that Linux is inherently more secure or less of a malware target than Windows. Could you break down some of the fundamental differences in how malware behaves on Linux versus Windows, and why that matters for defenders in the cloud?
• 'Living off the Land' isn't a new concept, but on Linux, it feels like attackers have a particularly rich set of native tools at their disposal. What are some of the more subtly abused but legitimate Linux utilities you're seeing weaponized in cloud attacks, and how does that complicate detection?
• When you weigh agent-based versus agentless monitoring in cloud and containerized Linux environments, what are the operational trade-offs and outcome trade-offs security teams really need to consider? 
• SSH keys are the de facto keys to the kingdom in many Linux environments. Beyond just 'use strong passphrases,' what are the critical, often overlooked, risks associated with SSH key management, credential theft, and subsequent lateral movement that you see plaguing organizations, especially at scale in the cloud?
• What are the biggest operational hurdles teams face when trying to conduct incident response effectively and rapidly across such a distributed Linux environment, and what's key to overcoming them?

Resources:

• EP194 Deep Dive into ADR - Application Detection and Response
• EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines