Interview with Ankita Gupta, CEO of Akto

How to Navigate Shadow AI Risk in the enterprise

This week, we discuss AI governance in the enterprise, starting with the nuts and bolts of how to discover and understand shadow AI. Following that, we dive into what security and tech leaders should do next with this information: apply guardrails? Limit vendor options?

Ankita has a wealth of experience and anecdotes to share here, from years of working with customers and seeing all the unexpected things that happen with AI in today's workplace.

Segment Resources:

• Website: https://www.akto.io
• Book a Free Demo: https://www.akto.io/agentic-security-demo
• LinkedIn: https://www.linkedin.com/company/akto-io
• YouTube: https://www.youtube.com/@aktodotio

This segment is sponsored by Akto. Visit https://securityweekly.com/akto to secure your AI agents before attackers do.

Topic Segment: Verizon's Breach Impact Study

The same team that delivers the DBIR every year gave us a bonus, based on over 70,000 insurance claims!

Some of my favorite insights:

• Cost of breaches, broken out by SMB, mid-sized enterprise, and large
• The claim amount as a percentage of the company's revenue
• Losses broken down by loss TYPE

This data validates something I think everyone in cyber needs to understand: cyber events are rarely business-ending events. Every cybersecurity professional and vendor, frustrated by companies "not taking security seriously enough" now have data explaining why: breaches don't hurt as much as you thought they did. Maybe you think they should hurt more? Push for regulation/fines/etc.

With that said, the report also shows breach costs increasing significantly over the past 6 years and the quantity of incidents shooting up. Specifically, the median impact has almost doubled.

Security failures aren't getting any cheaper.

Weekly Enterprise News

Finally, in the enterprise security news,

1. A $100M seed round!
2. Accenture acquires 3 security vendors
3. Some thoughts on the government takedown of Fable and Mythos
4. One of the craziest security mistakes I've ever seen, in the software FIFA uses to manage World Cup streams!
5. A Critical Copilot vulnerability
6. 75,000 Fortinet Firewalls get compromised
7. Remediation is broken
8. Using guardrails to evade detection

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-464

Interview with Shiva Pillay from Veeam

Safe AI at Scale

AI investment is exploding, yet nearly 90% of enterprise initiatives fail because the data powering AI cannot be trusted. That's the uncomfortable truth the industry is facing right now. Safe AI at scale requires more than just great models—it demands trusted, governed, and recoverable data.

This segment is sponsored by Veeam. Visit https://securityweekly.com/veeam to learn more about them!

Segment resources:

• Veeam Launches New Data and AI Trust Maturity Model to Help Organizations Benchmark AI Readiness

Topic: Sure, we know how initial access works, but what about lateral movement?

A special topic segment where we're joined by Albert Estevez Polo, field CTO for Zero Networks (a community guest, not a podcast sponsor). Zero Networks just released some very interesting data on what attackers are doing after they gain access to victim's environments and how they're doing it.

Segment Resources:

• Link to report page

Weekly Enterprise Security News

Finally, in the enterprise security news,

1. Funding and acquisitions
2. Good news, Mythos isn't dangerous anymore!
3. An excellent breach analysis
4. Cyber insurance rates are dropping, but there's a catch
5. CISA updates vulnerability remediation guidance
6. Zoom calls are worse than you think, and maybe not for the reasons you think
7. Remember when it was illegal to rip DVDs?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-463

Interview with Filip Stojkovski on the State of AI in SecOps

Filip joins us to talk through the 2+ year rollercoaster that Security Operations tooling has been on since AI entered the chat. We discuss the AI SecOps market, which Filip closely tracks through his SecOps Unpacked project. We also discuss how most of the market has traditionally been focused on the "middle" of the process, which is effectively alert management. Where the conversation really gets interesting is shifting left to discuss building better quality detections.

Segment Resources:

• Be sure to check out SecOps Unpacked - it has more than just vendor information: there are articles, frameworks, podcast episodes, research, and articles/thought leadership

Topic: The Unintended Consequences of Vulnmaxxing

We discuss my latest blog post where I share a theory that perhaps Project Glasswing is a clever exclusive freemium tier, where Anthropic is hoping to ensnare the world's largest producers of software into using its most expensive model to fix their code for the foreseeable future, creating a much needed new revenue stream for the AI giant with a Trillion dollar valuation.

There are some potential unintended consequences that come along with an expensive vulnerability discovery/remediation process that threatens to raise the security poverty line and leave less wealthy companies behind.

The Weekly Enterprise News

Finally, in the enterprise security news,

1. If you were starting a cybersecurity company today, which category would you pick?
2. layoffs
3. funding
4. the White House AI executive order
5. OpenAI's frontier governance framework
6. Anthropic's Zero Trust for AI agents guide
7. IBM's vulnmaxxing efforts
8. RICO as a service for job seekers
9. Instagram had possibly the most embarrassing hack ever

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-462

Interview with Evan Powell - Generative and agentic AI are improving cyberattacks faster than they're improving cyber defenses.

Offensive folks have been having the most luck with AI so far, which is further eroding any advantage defenders might have had. Evan Powell joins us to share some ideas on how defenders can get some benefits from AI as well, and why open source is important with this approach.

Topic

For this week's topic segment, we've got two very interesting data sources.

The first is Anthropic's first update on Project Glasswing, where they're absolutely tearing through codebases with ultra premium Mythos tokens, but then hitting a human-shaped bottleneck as they attempt to validate all the findings.

The second is the first report from Root Evidence, the latest startup from Jeremiah Grossman and Robert Hansen (aka RSnake), which aims to help organizations filter out all the vulnerabilities that don't matter.

Where these two reports meet in the middle is my concern that the use of AI to scour every last bug out of code is going to be the most Sisyphean task the cybersecurity industry has ever come up with (and we have some deep experience here).

The Weekly Enterprise News

Finally, in the enterprise security news,

1. Less funding, more acquisition
2. the AI SOC startup space is CROWDED
3. your CEO is suffering from AI psychosis
4. Some CISOs are done with the job, IT can have it
5. detecting and removing dangerous secrets from dev workstations
6. 230,000 security advisories roll up to 6 attacker behaviors
7. The FBI's 2025 IC3 report is out
8. When tech billionaires make predictions, they're actually sales pitches

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-461

Interview with Rob Allen from Threatlocker

This week, Rob Allen from Threatlocker is with us to discuss the importance of EDR and MDR visibility. We discuss some real world attacks and anecdotes where EDR was able to save the day when threats were missed by other controls.

Topic: Do the basics, they said. Easier said than done.

Guillaume and Adrian discuss the futility of attempting to do all the foundational work standards, best practices, and regulations expect of organizations. Adrian has given up. Fortunately, Guillaume has some excellent advice and hope to share on this front.

The weekly enterprise news

Finally, in the enterprise security news,

1. a really interesting vibe check
2. funding
3. acquisitions
4. the verizon DBIR
5. we give a tutorial on how to leak AWS keys on github
6. OH NEVERMIND, SOMEONE AT CISA ALREADY MADE THE TUTORIAL
7. agents versus agents
8. exploitbench
9. the vulnpocalypse
10. robot dogs are SO EASY to take out, we don't need to be too scared of them yet

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-460

Interview with Dimitri Sirota from BigID

Most organizations think AI risk lives in the model – or the identity. It doesn't. It lives in the data. In this episode, BigID's CEO reframes the conversation: why legacy access controls are breaking down, why visibility into sensitive data is the missing foundation, and what it takes to govern humans and machines under a single, accountable framework.

Segment Resources:

• BigID's Agent Access Management Guide
• BigID's podcast, CTRL + ALT + AI

This Week's Topic: Cascading Breaches

We're seeing more and more 3rd and 4th party attacks that chain through multiple layers of compromised tools and services. In this topic segment, we discuss the two main aspects of this trend:

1. How we can stop the chain of breaches from a third party library, vendor, or service provider
2. How this might get handled at the legal, contractual, and organizational levels

We discuss two big recent examples:

1. Sonicwall's 2025 breach of their cloud firewall configuration backup service
2. The compromise of Aqua Security's widely used Trivy open source tool

The Weekly Enterprise News

Finally, in the enterprise security news,

1. Funding and M&A courtesy of the Security, Funded newsletter
2. We have evidence that attackers are leveraging AI now (this sounds like old news, but there was little to no evidence before, when people were claiming this)
3. The Angry admin problem emerges again
4. Vulnerability information is getting crazy to keep up with
5. Breach information is getting crazy to keep up with
6. You can give your Agents an allowance now - don't spend it all in one place
7. Are vulnerabilities sparse or dense?
8. Mythos, as a model, isn't all that special
9. Deploy your own deception sensors!
10. Japan made something weird. Again.

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-459

The Weekly Enterprise News

This week, in the enterprise security news,

1. Copy Fail
2. The hits keep coming for CVE, NIST and NVD
3. Cyber attacks on breathalyzers
4. insurance carriers pulling support for AI
5. Florida Man pleads guilty
6. ignore the humanities at your own peril
7. offense and defense don't scale the same
8. is it okay to be left behind?
9. scientists gave cocaine to salmon

Mind the Gap: Confidence, AI, and the Future of Exposure Management

Former ethical hacker, now founder and CEO of Intruder, Chris Wallis explores whether AI can bridge the divide between finding vulnerabilities and understanding real-world attack context as exploit windows continue to shrink. This conversation dives into the structural "confidence gap" uncovered in Intruder's 2026 Security Middle Child Report, where executive risk appetite is increasingly decoupled from front-line operational reality.

Check out Intruder's Security Middle Child Report at https://securityweekly.com/intruderrsac.

Modern Phishing Attacks Are Under Multi-Channel Siege

Recently, there has been a shift in cybercriminals' behavior, marked by a surge in total phishing attack volume. These attacks are fueled by high-scale automation and a coordinated multi-channel siege targeting corporate collaboration tools. Trusted platforms such as email, Teams, calendars and others are in the cross-hairs, bypassing traditional phishing methods that have worked in the past.

This segment is sponsored by KnowBe4. Visit https://securityweekly.com/knowbe4rsac to learn more about them!

AI is Now Default Enterprise Accelerator

The Zscaler ThreatLabz 2026 AI Security Report reveals that enterprise AI adoption has surged by up to 93% year-over-year, yet 100% of tested AI environments remain vulnerable to breaches that can occur in as little as 16 minutes. It highlights a dangerous shift toward "machine-speed" threats, where attackers use generative AI to automate data exfiltration and create sophisticated deepfakes. To combat these risks, the report urges organizations to move beyond simple blocking and instead implement a Zero Trust architecture for safe, AI-native data protection.

This segment is sponsored by Zscaler. Visit https://securityweekly.com/zscalerrsac to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-458

Interview with Daniel dos Santos: Post-Quantum Cryptography and the Risks No One Is Talking About

Post-quantum cryptography (PQC) is quickly shifting from theory to inevitability. In this segment, Daniel dos Santos, VP of Research at Forescout, explains why PQC isn't the most immediate threat today—but still demands early attention as standards solidify and timelines accelerate.

The discussion highlights overlooked risks beyond encrypted traffic, including digital signatures, firmware integrity, and blockchain systems. Daniel also emphasizes the real challenge: migration. While client-side adoption is already underway, organizations face major hurdles identifying and upgrading servers, legacy systems, and unmanaged assets like IoT and OT.

The bottom line: PQC migration is unavoidable. Starting early—especially with crypto inventory and planning—will make the transition far less painful.

RSAC Interview: Multi-Channel Impersonation: Why Legacy Controls Are Failing

As social engineering expands past just email to include text messages, chat apps, social platforms, and live video calls, traditional point solutions are struggling to keep up. In this segment, Bobby Ford explains how AI-powered impersonation and deepfake-enabled campaigns are exposing critical gaps in legacy defenses, and why organizations must evolve toward a unified social engineering defense platform that connects Digital Risk Management and Human Risk Management. He'll outline what modern security programs need: real-time cross-channel visibility, behavior-driven detection, and strategies designed around how people actually communicate and make decisions today.

Visit https://securityweekly.com/doppelrsac to learn how Doppel helps organizations defend against AI-powered impersonation, phishing, and multi-channel social engineering threats with a modern Human Risk Management approach.

RSAC Interview: OT: Segmented Today, Breached Tomorrow

As the worlds of IT and OT converge, traditional network segmentation falls short, exposing risks in the critical environments that keep energy flowing and shelves stocked. Conventional security tools fail to identify these gaps, with serious repercussions for operators. At runZero, we empower defenders to win by default through comprehensive discovery, rapid detection of critical exposures, and unique segmentation analysis that does not depend on span ports, credentials, or on-device agents. runZero provides real-time insights into even the most sensitive environments — quickly, safely, and securely.

This segment is sponsored by runZero. Visit https://securityweekly.com/runzerorsac to learn more about them!

RSAC Interview: Securing the Next Billion Users: Why the Browser is the Front Line for Agentic AI

The enterprise is facing a fundamental shift: the next billion knowledge workers will not be human, they will be AI agents. While these agents offer exponential productivity, they operate at machine speed without human guardrails like MFA or skepticism, creating a massive security blind spot. Ramin Farassat discusses the "Agentic Paradox" and how a new approach to browser security is required to provide architectural immunity for the modern, hybrid workforce of both humans and agents.

Learn more about how Menlo Security protects both humans and agents at https://securityweekly.com/menlorsac.

RSAC Interview: The Threat Curve Has Reset: Why AI Made "Solved" Attacks Dangerous Again

AI hasn't just evolved cyberattacks—it has reset the threat curve entirely. New research shows that even "solved" problems like phishing and business email compromise are immature and dangerous again, with attackers using AI and autonomous agents to launch hyper-personalized, multi-channel attacks at scale. This session explores what Phishing 3.0 really means for security leaders—and why defending trust now requires a fundamentally new approach.

This segment is sponsored by IRONSCALES. Visit https://securityweekly.com/IRONSCALESrsac to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-457

Rethinking Security from the OS Up in the Age of AI

Karen Heart discusses a file-system–first approach to security, arguing that most modern attacks—including ransomware and supply chain compromises—succeed because they inherit user permissions and operate inside overly trusted system structures.

She explains how limiting file access, socket (network) access, and privilege escalation at the operating system level can reduce entire classes of attacks. Rather than relying on reactive detection, her approach emphasizes immutable, allowlisted controls embedded close to the kernel layer, designed to prevent both data exfiltration and malicious code execution at the source.

The conversation also explores how AI agents and contractors expand the attack surface, reinforcing the need for strict isolation, backup protection, and deterministic system boundaries.

Segment Resources:

https://www.simonandschuster.com/books/Zero-Day-Secure/Karen-Heart/9781968865078

​The New Era of DNS Resilience: Breaking down the newly finalized NIST SP 800-81 Craig Sanderson from Infoblox will dive into the newly finalized NIST SP 800-81 as it marks a pivotal shift in DNS security, emphasizing resilience through modernized practices tailored for today's distributed, cloud-driven, and threat-laden environments. This update provides actionable guidance for organizations to strengthen DNS infrastructure against evolving threats like ransomware and data exfiltration, while prioritizing initiatives like DNSSEC, encryption, and protective DNS for immediate risk reduction.

This segment is sponsored by Infoblox. Visit https://securityweekly.com/infobloxrsac to learn more about them!

Agentic AI and the Future of Threat Intelligence Operations Security teams collect large volumes of threat intelligence but often struggle to translate that information into coordinated operational response. This discussion explores how organizations are embedding intelligence directly into security workflows and introducing AI agents to support investigation, enrichment and response. Sachin will discuss Cyware's Agentic Fabric approach and the evolution toward an agent-centric model, where a portfolio of specialized agents assists analysts across threat intelligence, detection engineering and response workflows. The conversation will focus on how AI can support security teams while maintaining human oversight and operational control.

This segment is sponsored by Cyware. Visit https://securityweekly.com/cywarersac to learn more about them!

Beyond the Audit: Making Cyber Risk Continuous, Quantified, and Actionable Most companies assess cyber risk once a year and call it done — but for organizations managing dozens of subsidiaries or portfolio companies, that's a costly blind spot. In this RSA interview, Resilience's VP of Customer Engagement explores why measuring risk in dollars (not color-coded charts) changes the conversation at the board level, and why the organizations best positioned to prevent losses are the ones treating cyber risk as a continuous discipline rather than an annual exercise.

See it in action. Request a demo at https://securityweekly.com/resiliencersac.

Delinea: Redefining Identity Security for the Agentic AI Era As enterprises scale agentic AI and automation, privileged access is increasingly required by non-human identities (NHIs) that operate autonomously across hybrid and cloud-native environments, introducing risks that static, credential-based models were never designed to govern. Delinea's recent of acquisition of StrongDM.

This segment is sponsored by Delinea. Visit https://securityweekly.com/delinearsac to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-456

Interview with Jim Spignardo

What does it take to build AI workflows that work? Why do so many fail?

Jim isn't a typical ESW guest. I think it's essential for security folks to regularly step outside the security bubble and understand other perspectives and mindsets. That's what we're doing today with Jim.

He specializes in building custom AI architecture and workflows for his clients. We discuss the state of AI in the enterprise and why so many of these efforts fail. We'll discuss the elements of AI success and whether security plays a role in helping AI efforts succeed or contribute to failures.

Segment Resources:

• https://www.proarch.com/
• Cowork vs Cowork - Why Microsoft 365 Copilot Cowork Is the One Built for Enterprise

RSAC Exec Interviews, Part 1

Trends Revealed in Fortinet's FortiGuard Labs 2026 Global Threat Landscape Report

Fortinet's Global Director of Threat Intelligence and Adversarial AI Research explores the trends revealed in the latest Global Threat Landscape Report from FortiGuard Labs, including a surge in AI-enabled cybercrime. As AI optimizes and accelerates attack techniques, here's how cyber defenders should respond.

This segment is sponsored by Fortinet . Visit https://securityweekly.com/fortinetrsac to learn more about them!

X-PHY Delivers Hardware-Enforced Security for the Age of AI Agents

Camellia Chan, CEO and Co-Founder of X-PHY, discusses how Model Context Protocol (MCP) is making it easier for AI agents to plug into enterprise apps and operate with elevated permissions—creating new opportunities for attacks and data exfiltration. She explains how X-PHY's hardware-enforced monitoring and detection sit beyond the OS trust boundary to enforce immutable limits on what agents can do and stop threats before data is lost, so organizations can adopt agentic AI with confidence.

Security leaders looking to deploy AI agents safely can request a demo or briefing with X-PHY at https://securityweekly.com/xphyrsac.

RSAC Exec Interviews, Part 2

Introducing Legion Investigator: Goal-Oriented AI Investigations

Traditional security playbooks often fail because they cannot capture the fluid, context-dependent reasoning required when a routine investigation hits a non-scripted "judgment point." Legion Investigator addresses this gap by employing goal-oriented AI agents that move beyond rigid scripts to interpret findings and execute complex, multi-step investigations based on your team's unique environment and expertise. By bridging the divide between automated execution and human-level reasoning, the platform ensures that every alert (no matter how unpredictable) is handled with the depth and consistency of a senior analyst.

This segment is sponsored by Legion Security. Visit https://securityweekly.com/legionrsac to learn more about them!

The Missing Layer in Zero Trust: The Security Policy Control Plane

Zero Trust has become the dominant security architecture for hybrid and cloud environments, but many organizations are discovering that deploying enforcement technologies alone does not deliver operational control. Firewalls, cloud security groups, and microsegmentation platforms enforce access decisions, yet the policies behind those controls are often fragmented, difficult to validate, and constantly changing. In this conversation, FireMon CEO Jody Brazil discusses why modern security architectures increasingly require a security policy control plane: a layer that continuously validates how policy is enforced across firewalls, cloud networks, and segmentation platforms. The discussion explores why policy drift occurs in real environments, how enforcement systems become difficult to coordinate at scale, and what organizations must do to ensure Zero Trust policies remain consistent as infrastructure evolves.

This segment is sponsored by FireMon. Visit https://securityweekly.com/firemonrsac to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-455