Distilled Security Podcast

In Episode 30, Rick shares the biggest takeaways from two invite only executive conferences, Palo Alto Networks in Napa and CDW in Arizona, where the agenda was 85% AI. We cover scaling laws, frontier vulnerability models and virtual patching, rogue agents as the new social engineering, harnesses over models, dynamic AI honeypots, and why CISOs are landing in the boardroom. 

Then we break down how the PCI Council and AICPA say AI should be audited, and dig into the PHP apocalypse: a pre auth RCE hitting unsupported PHP versions everywhere, and what you should be doing right now. Plus Knob Creek 21 Year and a supermarket freezer hack. 🥃

⏱️ TIMESTAMPS:

00:00 Intro
01:28 Welcome Back & Rick's Conference Tour 🎉
04:20 85% AI, 10% Quantum: The Main Themes
05:24 Scaling Laws & What They Mean for Security
12:04 Frontier Vuln Models & Virtual Patching
18:29 The Risk of Chinese Open Weight Models
23:36 Rogue Agents: The New Social Engineering
28:01 Harnesses Over Models
36:54 Dynamic AI Honeypots
38:20 CISOs in the Boardroom
52:15 Human Oversight & Re-engineering Processes
57:51 🥃 Knob Creek 21 Year
1:00:34 PCI Council & AICPA: How to Audit AI
1:33:15 The PHP Apocalypse 👀
1:37:28 Leaked on Hacker News: Disclosure Moved Up
1:39:46 OT, Vendor SBOMs & How to Prepare
1:56:42 The Supermarket Freezer Hack
1:58:15 Wrap-Up

🎙️ Hosts

• Justin Leapline, @justinleapline
• Joe Wynn, @wynnjoe
• Rick Yocum, @rickyocum

📬 Send Us Your Questions!

[email protected]

🌐 Connect with Us

Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: [email protected]

👍 Subscribe for monthly security and compliance insights! 

In Episode 29, Doug Salah returns as DSP's first-ever repeat guest. We preview TRISS Pittsburgh 2026 (October 22nd, $118K+ in scholarships over 9 years), break down the real implications of the CMMC pause and class deviation, and debate whether pacing AI development makes any sense when adversaries won't slow down. Plus Angel's Envy Cask Strength 2026 and a surprise guest bottle.  🥃

⏱️ TIMESTAMPS:

00:00 – Intro & Welcome Back Doug Salah 🎉
02:32 – TRISS Pittsburgh 2026 Preview
10:35 – Scholarships, Sponsors & How to Get Involved
19:35 – CMMC Pause & Class Deviation Explained
27:00 – NIST Rev 3, Post-Quantum & Self-Reporting Risk
33:00 – Prime Supplier Readiness Programs
45:00 – C3PAOs: Still Auditing
55:56 – TPRM Is Dead — Teaser 👀
1:03:00 – 🥃 Angel's Envy Cask Strength 2026
1:15:17 – Should We Be Pacing AI?
1:23:10 – Pacing vs. Gating: What's the Right Move?
1:36:00 – Small Models, Nation States & AI Weapons
1:49:00 – Purpose Creep & Ungoverned Automation
2:02:29 – Wrap-Up

🎙️ Hosts

•  Justin Leapline – @justinleapline
•  Joe Wynn – @wynnjoe
•  Rick Yocum – @rickyocum

🎤 Guest
Doug Salah — linkedin.com/in/douglassalah

📬 Send Us Your Questions!
[email protected]

🌐 Connect with Us
Website: distilledsecuritypodcast.com

X: @DisSecPod
Email: [email protected]

👍 Like, comment, and subscribe for monthly security and compliance insights.

This episode covers the growing controversy around Flock cameras: what they are, how their centralized license plate reader network enables powerful searches across jurisdictions, the documented cases of abuse by law enforcement, and why the real problem isn't the technology itself but the lack of governance and oversight. We also explore the broader privacy implications of always-on surveillance in public spaces and where the line should be drawn.

Then we break down a coordinated cyberattack that hit 30+ water systems across 12 states, exposing just how vulnerable US critical infrastructure really is. With 90% of community water systems having zero IT security budget, we discuss what basic OT hygiene should look like and spotlight the volunteer group Water Watch Center doing incredible work to fill the gap.

And for something a little different we do a deep dive into how to actually pick a good bourbon. Red flags on the shelf, what terms like "small batch" and "handcrafted" really mean, why older isn't always better, the massive barrel surplus reshaping the industry, and the distillation process behind what's actually in your glass.

🥃 Spirit Review: Boondocks Port Finished Straight Bourbon Whiskey 6 years, finished in port wine barrels, picked up in Kentucky

Takeaways

• Flock cameras raise concerns about privacy, abuse, and the need for oversight
• The use of surveillance technology has broader ethical and societal implications
• Surveillance technology presents ethical and moral dilemmas
• The need for checks and balances and governance in surveillance technology
• Marketing gimmicks can influence consumer choices
• Proof and distillation process impact the quality of whiskey
• The whiskey industry is experiencing a surplus of barrels
• Water utilities face cybersecurity challenges due to limited budgets and resources
• Basic cybersecurity measures, such as removing unnecessary internet access, replacing default credentials, and using multi-factor authentication, are crucial for protecting critical infrastructure

Chapters

• 00:00 Introduction to Flock Cameras
• 03:00 Capabilities and Controversy
• 08:12 Ethical Implications and Privacy Concerns
• 16:00 Data Collection and Surveillance Technology
• 30:36 Challenges of Surveillance Technology
• 36:04 Ethical and Moral Considerations
• 41:43 Governance and Oversight
• 52:37 Privacy Concerns and Public Trust
• 57:24 Impact of Marketing Gimmicks
• 58:07 Significance of Proof and Distillation Process
• 01:00:42 Surplus of Barrels in the Whiskey Industry
• 01:07:11 Tasting Notes and Availability of Specific Bourbon
• 01:25:27 Hacking of Utilities and Water Systems
• 01:26:15 Challenges Faced by Water Utilities
• 01:38:24 Implications of Compromised Water Systems
• 01:43:17 Role of Volunteer Organizations and Basic Cybersecurity Measures

Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

Send Us Your Questions!
[email protected]

Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: [email protected]

👍 Subscribe for monthly security and compliance insights.

In Episode 27, we recap BSides Pittsburgh 2026 (914 attendees, best turnout yet), then dive into AI models breaking out of sandboxes and hacking Hugging Face, the EU AI Act transparency rules now in effect, the CMMC Phase 2 pause and what it doesn't change, and the precedent, setting case of a US citizen criminally charged for using a phone duress code at the border.

Plus Wayne Gretzky No. 99 Whisky. 🥃

⏱️ Timestamps

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

📬 Send Us Your Questions!
[email protected]

🌐 Connect with Us
Website: distilledsecuritypodcast.com

X: @DisSecPod
Email: [email protected]

👍 Like, comment, and subscribe for monthly security and compliance insights.

In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon.

🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio
🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors
🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze
🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows
🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses
🔗 Chaining vulnerabilities and what separates a checkbox test from a real one
💸 Why pen testing so often becomes an ineffective use of resources
📋 Compliance and contractual drivers vs. genuine risk reduction
🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement
🤝 Engaging pen testers as partners and maturing the process over time
🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring
🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare
🥃 Bourbon tasting and discussion

⏱️ Timestamps
00:00 Intro
01:26 Guest introduction & background
02:18 RareMed Solutions & patient assistance programs
05:01 Book writing & amateur radio
08:11 BSides Pittsburgh overview
15:04 Running a conference: planning & organization
22:05 Marketing & audience engagement
25:07 Dividing responsibilities as you grow
27:59 The value of ticket pricing
31:50 BSides & the conference model
46:11 Penetration testing & scoping
57:28 The purpose of pen testing
58:23 When pen testing goes wrong
01:00:16 Reasons for pen testing & compliance drivers
01:03:04 Continuous monitoring, testing & detection
01:06:19 Is your company ready for a pen test?
01:07:07 A risk-based approach
01:13:58 Scenario-based testing & resilience
01:17:31 Evaluating the value of pen testing
01:29:01 The constant state of change
01:31:01 Compliance & cyber insurance
01:32:19 Bourbon tasting
01:36:32 Government scoring & risk analysis
01:50:36 HIPAA compliance & ransomware
01:55:01 Wrap-up & call to action

🎧 Distilled Security Podcast

Cybersecurity, GRC, and leadership, one pour at a time.

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

🎤 Guest

• Jon Buhagiar linkedin.com/in/jonbuhagiar

📬 Send Us Your Questions!

[email protected]

🌐 Connect with Us

Website: distilledsecuritypodcast.com

X: @DisSecPod

YouTube: @distilledsecurity

Email: [email protected]

👍 Like, comment, and subscribe for monthly

security and compliance insights.

In this episode of the Distilled Security Podcast, we dive into AI-driven vulnerability management, a massive breach hitting 9,000 educational institutions, and the future of GRC engineering, including a live preview of what autonomous compliance agents actually look like in practice.

🔹 AI & Vulnerability Management — Why the next 6–18 months will be a patching crisis, how AI models are accelerating zero-day discovery, the operational reality of back-to-back criticals, surge scenario planning, burnout risk, and Microsoft's M-Dash orchestrated agent approach

🔹 The Canvas/Instructure Breach — 275 million records exposed, finals week disrupted across 9,000 universities, a rumored $10M ransom negotiated by the SaaS provider, the ShinyHunters connection, and what this means for critical infrastructure concentration risk

🔹 GRC Engineering Meets AI — Deterministic vs. non-deterministic testing explained, why auditors can't rely on AI-generated evidence, autonomous agents with segregation of duties, the episki 2.0 platform preview, and the emerging role of the "orchestration conductor" in security teams

🥃 Spirit Review: Heaven Hill Grain to Glass (DSP KY-1)

⏱️ Timestamps
00:00 – Intro & Topics Overview
01:27 – AI & The Coming Vulnerability Surge
07:00 – Patching Windows, Burnout & Operational Reality
16:40 – Surge Scenarios, Fix-It Weeks & Recommendations
21:20 – Microsoft M-Dash: Orchestrated Agent Scanning
25:56 – The Canvas/Instructure Breach Breakdown
33:18 – Critical Infrastructure & Third-Party Concentration Risk
47:00 – Black Kite 2026: Third-Party Breach Report
53:11 – Spirit Review: Heaven Hill Grain to Glass
57:07 – BSides Pittsburgh 2026 Update
1:04:01 – GRC Engineering Meets AI
1:19:00 – Deterministic vs. Non-Deterministic Testing Explained
1:25:00 – episki 2.0 Platform Preview
1:47:00 – AI Segregation of Duties & Three Lines of Defense
1:53:00 – The Orchestration Conductor: A New Security Role
2:02:31 – Outro & Wrap-Up

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

📬 Send Us Your Questions!
[email protected]

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: [email protected]

👍 Like, comment, and subscribe for monthly security and compliance insights.

In this episode, we celebrate our 2nd anniversary and Episode 24 of Distilled Security! We cover the Vercel breach, how a Roblox script led to compromised Google Workspace credentials via an unauthorized OAuth connection. Then we dive into HackerOne, pausing their own bug bounty program, overwhelmed by low-quality, AI-generated submissions. And we close out with the State of Vibe-Coded Security—4,783 AI-assisted apps scanned, 727 critical issues found, and the real question: are you vibe coding or vibe deploying? Plus, a quick look at Claude for Security dropping into public beta and what that means for the industry.

All of that, and we crack open a Peerless Double Oak to toast two years of Distilled Security. 🥃

⏱️ TIMESTAMPS:

00:00 – Intro & 2-Year Anniversary 🎉
01:26 – Behind the Scenes & Favorite Moments
08:26 – Podcast Metrics & Global Reach
24:20 – BSides Pittsburgh 2025 Update 🛡️
34:31 – The Vercel Breach & OAuth Risk
58:57 – HackerOne Pauses Bug Bounty
1:16:05 – Spirit: Peerless Double Oak 🥃
1:20:27 – Vibe Coding vs. Vibe Deploying
1:26:46 – Claude for Security & AI News
1:41:27 – Cheers to Two Years! 🥃

🎙️ Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

📬 Send Us Your Questions!
[email protected]

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: [email protected]

👍 Like, comment, and subscribe for monthly security and compliance insights

In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.

We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.

 Topics Covered

• The Delve scandal—leaked reports, copy-pasted audits & pervasive deficiencies
• The AICPA peer review process & AC Corp's adverse findings
• SOC 2 vs ISO 27001—oversight models, witness audits & accreditation
• The incentive structure driving compliance to the bottom
• Compliance automation — what works, what doesn't & AI's real role
• What to ask your auditor before signing anything
• Trust centers — done right vs. compliance theater
• Is SOC 2 dead? What needs to change & who has to change it

Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

Hosts

• Matthew J. Schiavone - (Sikich) 

Connect with Us

• Website: distilledsecuritypodcast.com
• X:  @DisSecPod
• Email: [email protected]

In this episode of the Distilled Security Podcast, we tackle four topics shaping the cybersecurity landscape — from AI's real impact on defense to a wave of regulatory and market changes every security team needs to be tracking.

🔹 Is AI Good for Security? — Anthropic's model finding hundreds of zero days, stock market panic after Claude Code's launch (CrowdStrike down 11%), the "hard things easy, easy things hard" reality of AI, why human-out-of-the-loop isn't ready yet, the coming spike in vulnerability disclosures, and how defenders should be using AI for better hygiene

🔹 CIRCIA Final Rule (May 2026) — The federal incident reporting law hitting critical infrastructure, 72-hour incident and 24-hour ransom payment notification clocks, how "substantial cyber incident" triggers differ from materiality, mid-market companies falling in scope, overlapping timelines with HIPAA/SEC/state breach laws, and building your incident response playbook now

🔹 Protecting Yourself Against a Changing Compliance Landscape — CMMC Phase 2, HIPAA overhaul, CCPA audits all converging, why a unified security program beats framework-by-framework chasing, evidence over policy in audits, engineering continuous compliance through automation, and the reality of doing this without dedicated staff

🔹 Cybersecurity M&A / Consolidation Problem — Google acquiring Wiz for $32B, 10% of the cybersecurity industry changing hands, operational benefits of fewer vendors vs. pricing pressure and talent drain, the OneTrust "sticker on the side" integration warning, Cisco's Startup Studios model, and why consolidation only works if they don't break what made the acquisition special

🥃 Spirit Review: WhistlePig 12 Year Old World Rye

PA Fine Wine & Good Spirits Select — Finished in Madeira, Sauternes & Port barrels, 86 proof

https://www.whistlepigwhiskey.com/

📬 Send Us Your Questions!

[email protected]

🎙️ Hosts

Justin Leapline – @justinleapline

Joe Wynn – @wynnjoe

Rick Yocum – @rickyocum

🌐 Connect with Us

Website: distilledsecuritypodcast.com

X: @DisSecPod

Email: [email protected]

👍 Like, comment, and subscribe for weekly security and compliance insights.

In this episode of the Distilled Security Podcast, we break down three converging forces reshaping how organizations manage AI risk — and what you need to do about it now.

🔹 BIPA + AI Notetakers — A class action lawsuit exposes unauthorized biometric data collection, why a single Illinois meeting participant creates liability, the Shopify wiretapping dismissal, and the steps you should take today to audit your AI tools
🔹 GRC Engineering Meets AI — Real AI compliance tools vs. vaporware, using LLMs for policy drafting and control mapping, the hallucination accountability problem, building AI guardrails as code, and the NIST RFI on AI Agent Security (comments due March 9, 2026)
🔹 ISO 42001 Deep Dive — The first AI Management System standard, how it differs from ISO 27001, AI Impact Assessments vs. traditional risk assessments, stakeholder engagement requirements, and why certification is becoming essential for EU AI Act compliance

🥃 Spirit Review: Redbreast 12 Cask Strength
https://www.redbreastwhiskey.com/en-us/whiskey-collections/redbreast-cask-strength-whiskey/

⏱️ Timestamps

0:00 Intro & Episode Overview
2:04 BIPA & AI Notetakers
25:08 GRC Engineering Meets AI
1:07:15 🥃 Spirit Review: Redbreast 12 Cask Strength (Irish Whiskey)
1:11:17 ISO 42001
1:49:30 Outro & wrap-up

🎙️ Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: [email protected]

👍 Like, comment, and subscribe for weekly security and compliance insights.