Guests:

• Gal Ordo, Co-founder & CPO @ Native

Topics:

• In Episode 186, we debated 'Native vs. Third-Party' as a binary choice. Native seems to be a third-party vendor whose entire existence depends on the belief that cloud-native controls are superior. Does your platform validate the 'Cloud Provider' side of the debate (that their controls are enough), or does the fact that you exist prove the 'Third-Party' side (that native interfaces aren't enough)?
• A key argument against native controls is an AWS WAF and a Google Cloud Armor don't behave the same way. If your tool manages native controls across multi-cloud, how do you handle the 'lowest common denominator' problem? Do you dumb down the policy to fit all clouds, or do you expose the unique complexity of each one?
• GuardDuty and SCC produce similar but meaningfully different results. How do you abstract across that so an analyst or IR team isn't having to dig into the exact meaning of the different JSON fields in their output?
• We often say native tools are 'good enough' for 80% of use cases but lack the depth of specialized third-party vendors (like a dedicated CNAPP or DLP). By betting your company on orchestrating native controls, are you effectively betting that 'good enough' is the future of the market? What happens when a customer needs a feature that the CSP hasn't built yet?
• What fraction of your users are taking this from a "I'm 80% this one cloud, I need great coverage there and good enough elsewhere" vs "I'm truly multi-cloud" or even scarier "I have a workload that is active spanning clouds"?
• Do your customers push you towards helping with the kinds of SaaS platforms that SSPM vendors cover?
• If AWS and Google Cloud suddenly decided to make their native security UIs perfect and unified tomorrow, would your company cease to exist? Or is the complexity of the cloud strictly increasing, guaranteeing you job security forever?

Related:

• Video version
• EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim
• EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again!
• The Great Cloud Security Debate: CSP vs. Third-Party Security Tools
• native.security blog

Guest:

• Matt Gregson, Principal - PwC Cyber Security

Topics:

• What is the state of the art of "agentic SOC" in 2026? Can you describe the most agentic SOC you've seen so far?
• In your experience, what are the main measurable benefits of AI agents in a SOC and IR?
• Imagine a 2030 SOC, what do humans do?
• Tell us more about how you judge if a client SOC is ready for AI and agents? What is the "Ouch" moment where most organizations realize their data isn't ready for that level of autonomy?
• Should we be more afraid of "AI hallucinations" or "Human fatigue" in the SOC?
• If a team has an agentic teammate making its own decisions based on emergent reasoning, how do you audit its "thought process"?
• Everyone loves to talk about "Time Saved," but in an agentic SOC, we care about "Decision Quality." What is the one metric PwC uses to prove that a SOC agent deployment is actually reducing risk?
• We often hear about "human-agent teaming." Are they still looking at alerts, or are they just approving "Action Plans" generated by the AI?

Resources:

• Video version
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success
• EP264 Measuring Your (Agentic) SOC: Two Security Leaders Walk into a Podcast
• All SOC and SIEM episodes

Guest:

• Arvin Bansal, CISO, C&S Wholesale Grocers

Topics:

• Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Can you produce the receipts for why this isn't a story of dry goods but rather a very meaty topic with beefy adversaries?
• How are you as the CISO enabling C&S's journey into AI and LLM driven work? Securing AI is a bit harder than securing classic analytics tools, right?
• In addition to securely rolling out AI, how is your defense team using AI to secure C&S? Are you into the era of agentic triage and response? What metrics for AI is your D&R lead surfacing up to you?
• You have AI in the business process that - if failed - will leave people hungry. How do you approach AI resilience?
• How do you approach resilience in general? Is cloud part of your resilience strategy?
• You worked at Citigroup for a long time. What's it like having grocery margin budgets for security instead? How does your thinking change? Does this shift your build/buy/outsource for security?
• If your IoT stack falls over, you've got literal ice cream melting in a warehouse. How do you balance your investments in cyber risk with physical operational risk? Should I be scared of forklifts?

Resources:

• EP275 Google Cloud Next 2026: The AI Earthquake, "SOC-home" Syndrome, and the Ragged Edge of Reality
• EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion
• EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?)
• EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps

Episode co-host:

• Marina Kaganovich, Enterprise Trust Lead, Office of the CISO, Google Cloud

Guest:

• James Sherer, Partner at BakerHostetler

Topics

• Is AI just an emerging technology or something bigger, deeper and different? Is this another emerging technology or a fundamental shift?
• How to effectively govern something that is rapidly changing at unprecedented velocity? We navigated the governance of the Internet and SaaS. What makes AI governance fundamentally different from the "Classic IT" or Data Governance models of the past?
• As we move toward Agentic AI, the line between tool and teammate blurs. Should we be governing AI agents through the lens of Technical Controls or Human Resources and behavioral contracts?
• What if we hand even more responsibility to AI? Where are the tipping points as we shift from assistance to autonomy?
• How to avoid unintended, negative consequences when setting policy, contrasting risk-based vs. rights-based regulation and regulatory expectations
• Give us some practical takeaways for a defensible AI program - if an organization had to defend its AI program to a regulator or a judge tomorrow?

Related episodes:

• Video version
• EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom
• EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud
• EP237 Making Security Personal at the Speed and Scale of TikTok

Guests:

• No guests

Topics:

• So what have we seen at Google Cloud Next 2026?
• Any closing loops for our 2023-2025 Cloud Next observations?
• We are seeing that AI security is not an island ... what does that tell us about the difference between cloud and AI adoption?
• What does "ragged edge of AI adoption" mean for security?
• Why do people want agents in their SOC? Do they know what gets better?
• What are the most notable and fun announcements?
• With patching speed, are we looking at something which can be overcome by engineering and courage? Or are we looking at something that is truly an impossibility?

Resources:

• Video version
• EP221 Special - Semi-Live from Google Cloud Next 2025: AI, Agents, Security ... Cloud?
• Next '26: Redefining security for the AI era with Google Cloud and Wiz
• Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So?
• EP169 Google Cloud Next 2024 Recap: Is Cloud an Island, So Much AI, Bots in SecOps
• Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever
• EP137 Next 2023 Special: Conference Recap - AI, Cloud, Security, Magical Hallway Conversations
• 260 things we announced at Google Cloud Next '26 – a recap

Guest:

• Grant Dasher, ex-CISA, ex-Google, Distinguished Engineer, Google (again)

Topics:

• Why is the "Secure-by-Design" movement gaining so much momentum now, and is it a response to the failure of "bolted-on" security, or just a natural evolution of cloud maturity?
• In a future Secure-by-Design world, is identity the only perimeter that actually matters anymore? Or is this a cliche?
• As we move toward a world of autonomous agents, how does our approach to machine identity need to change? Are we just talking about more complex Service Accounts, or do we need a fundamental shift in how we authorize "intent"
• What is your advice to people who want to move fast and cannot wait for Secure by Design / Default AI to be decided by consensus or IETF, NIST or OASIS committee?
• We love the argument that modern AI agents are effectively repeating the mistakes of 1960s payphones - mixing the data plane and the control plane. What is your rebuttal? How do we build "Agentic Security" that doesn't fall for 60-year-old traps?
• Customers are torn between their Zero Trust implementations and their AI adoption. Is Zero Trust now "legacy," or is it the prerequisite for everything we're trying to do with AI agents?
• Is there Zero Trust for AI? Is this a fake buzzword or technical reality?

Resources:

• Video version
• EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance
• EP133 The Shared Problem of Alerting: More SRE Lessons for Security
• EP85 Deploy Security Capabilities at Scale: SRE Explains How
• Google SRE books
• "Atomic Accidents" book (yes, really)