Enterprise Security Weekly (Video)

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?

The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.

Segment Resources:

1. Modernize your TPRM program with adaptive risk management for SaaS and AI
2. Nudge Security Unveils Adaptive Risk Management press release
3. The security work nobody wants to do is the risk nobody's watching
4. OAuth grants pile up faster than you can review them BleepingComputer

This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!

Topic Segment - Coordinated Disclosure

An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.

Coordinated disclosure in 2026 is:

• 75% - Too slow for AI world
• 13% - Vendor Credit Race
• 13% - This is fine ????????️????
• 0% - Working as designed
• 0% - Other (tell me)

Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week's vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.

Enterprise Security News

Finally, in the enterprise security news,

1. A little funding
2. making software liable for cyber breaches
3. we have a new biggest bank heist ever!
4. more freezers defrosted
5. a company builds malware into their product on purpose
6. AI pentesting frameworks are lowering the script kiddy bar
7. AI hosting company hacks their competitor
8. there's a new SSH bug that could be very, very bad
9. even MSPaint gets a vulnerability

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-484

Interview with Casey Ellis

Our focus for this interview with Casey Ellis are the massive changes in:

• Vulnerability Discovery
• Vulnerability Disclosure
• Exploitation and Remediation

The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?

Vibe Check

This week's vibe check explores the question, which security project always takes twice as long as planned?

• 55% - Enforcing data classification
• 18% - SOAR automation buildout
• 9% - Rolling out SSO
• 9% - Moving to passwordless auth
• 9% - AI agent discovery
• 0% - Other

News Segment

Finally, in the enterprise security news,

1. funding and M&A
2. PHP2Shell update
3. floods of bugs
4. silent train
5. breaches
6. the script kiddy bar has been lowered
7. the basics continue to be important
8. an AI lab pulls a PR stunt
9. an old squirrel story was a scam!

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-483

Interview with Barrett Lyon

Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.

This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.

Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!

Segment Resources:

• The main website: https://doxx.net
• Doxx.net Discord channel: https://discord.gg/595hAxHH4
• Barrett's previous work mapping the internet for the Opte project: https://www.opte.org

Vibe Check

Which security acronym/phrases deserves to be retired?

• 38% - XDR
• 25% - Zero Trust
• 25% - UEBA
• 6% - CNAPP
• 6% - Non-Human
• 0% - Other (leave a comment)

Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants.

I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"?

I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????

Top Comments

• "Other - The "AI TRiSM" term can go kick the biggest of rocks"
• "Other - Shift left"
• "My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over"

Enterprise Weekly News

Finally, in the enterprise security news,

1. We check out funding
2. There are a lot of acquisitions
3. And a round of layoffs
4. A tech startup goes out of business after two breaches
5. Private keys should be larger than "4"
6. PHP2Shell disrupts everyone's plans this week
7. Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-482

Interview with Michael Jenkins from ThreatLocker

Securing AI on the Endpoint - Zero Trust or Bust

Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given.

We explore how execution control and ringfencing can add some sanity and security to the process.

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Topic Segment: Anthropic Dreams of AI Replicants

Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research.

• It is too loose to be an academic paper, but maybe should have been?
• Is really a pressing AI risk we should be worried about right now?
• Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices?

Weekly Enterprise News

Finally, in the enterprise security news,

1. we discuss the vibes
2. certified organic books
3. don't mess with criminals
4. the history of ShinyHunters
5. building strategies on the wrong lessons
6. crypto wallet supply chain drama
7. Hot refrigerators
8. Reddit is great for breach tracking
9. Microsoft patch Tuesday is on track to hit 12,000 patches by next April

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-481

Interview with Hadar Krasner, Co-Founder and CPO of Bold Security

This week's interview with Hadar is a fascinating dive into the history of data security and why they chose to tackle endpoint-focused data security. We discuss why securing data is traditionally such a challenging task, making it clear why Bold is such a fitting name for the company. After 30 minutes, we barely scratched the surface and are hoping we can have them back soon for another interview!

Segment Resources:

• https://www.bold.security/blog/endpoint-data-ai-human-risk-convergence
• https://www.bold.security/blog/what-is-real-time-endpoint-data-protection-bold-makes-it-a-reality

This segment is sponsored by Bold Security. Visit https://securityweekly.com/bold-security to learn more about them!

Topic - Don't Let AI Ruin Your Talk

In this week's topic segment, we discuss the emerging epidemic of low-effort AI-generated slides. AI can definitely make slide creation less painful, but you still need to put some effort in to make a good looking deck that makes sense. If you don't, your audience WILL notice.

Enterprise Security News

Finally, in the enterprise security news,

1. we discuss the Sawtooth problem
2. cybersecurity is center stage in AI
3. not everyone is a big fan of passkeys
4. Ross Haleliuk is back with some interesting essays
5. insider threats: sometimes the cybercriminal was inside your organization all along
6. AI can now read your mind
7. and as always, we'll kick off with the vibes

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-480

Interview with Aqsa Taylor

Exaforce's Chief Security Evangelist, Aqsa, joins us to discuss the current state of the AI SOC and why it covers so much more than it did over 2 years ago, when our podcast first started covering this market. Exaforce also recently released AI Security and its ExaGo mobile app - we're very excited about the possibility of analyzing incidents at the grocery store!

This segment is sponsored by Exaforce. Visit https://securityweekly.com/exaforce to learn more about them!

Topic Segment - Regulating AI

The AI industry's sandbox escapes have had a big impact on everyone and unsurprisingly, there's a bill proposing to ban some AI products and pause the development of others.

It seems that, increasingly, as pro-AI and anti-AI groups become more polarized and divided, you could start an entire podcast that does nothing but fact-check both sides. We're an emotional species and it seems the more heated debate gets, the more folks on both sides are willing to straight-up fabricate things to help argue their points.

Today's focus is this YouTube video: https://www.youtube.com/watch?v=WXsTCJl7sU4

It's the most on-the-nose type of propaganda - straight up claiming the government is going to break into your house and take your GPUs and LLMs. Could the bill proposed by Bernie Sanders and Greg Casar be characterized as extreme? Sure, but it's nowhere near as extreme as the title of the video, "They're Banning AI Servers at Home" suggests.

The hardest things to swallow about the video:

1. it characterizes Bernie Sanders as "the government", as if he's representative of most of the US government rather than an outlier that has little to no chance to get a bill like this passed
2. it never mentions the fact that the bill establishes a model cutoff, measured in training effort (10^25 flops, which doesn't include the open weight models you're using at home, unless you have an 8x cluster of DGX Sparks - $40k+ worth of AI compute)

Enterprise News

Finally, in the enterprise security news,

1. we check the vibes
2. massive, connected funding
3. NVIDIA OpenShell
4. cars are still hackable
5. a ransomware arrest turned into a murder investigation
6. AI welfare

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-479

Interview with Christopher Crawley - The Value of SecOps

This week, we talk to Chris Crawley about his new book, The Value of Cybersecurity Operations. Chris has been training teams on security operations for years, but found that students often struggled to justify the importance of secops training and even the need for secops in general. This book was written to more broadly arm practitioners with the information they need to communicate why security operations are necessary to leadership.

The book is available in several forms: eBook, hardcover, softcover, and an audiobook read by Chris himself!

You can pick all versions up here: https://shop.montance.com/collections/all and Security Weekly listeners get 50% off with code sw-50!

The Evolving Exploitation of Trust with Josh Davies, Security Strategist at Fortra

Fortra Intelligence and Research Experts (FIRE) is Fortra's emergent threat intelligence identity, created to unify research teams across multiple security disciplines and share intelligence with the wider threat intelligence community. FIRE co-ordinator and security strategist Josh Davies joins us to share insights from original FIRE research like Calphishing, Mirage2FA, RatPressto phishkit and heavily obfuscated campaigns that evade defences. While also digging into trends from big data analysis within phishing, fraud, social engineering and credential theft.

Segment Resources:

• Art of Security Podcast
• Fortra Research

This segment is sponsored by Fortra. Access FIRE Research here: https://securityweekly.com/fortrabh

Why Agentic AI Security Requires a Defense-In-Depth Strategy with Kaushik Shanadi, CTO and Co-Founder of Helmet Security

Many organizations are approaching agentic AI security by stitching together individual controls, assuming that identity, network, endpoint, or application security alone is enough. Each address only one part of the problem. As AI agents become more autonomous, move across systems, and take actions on behalf of users, organizations need a true defense-in-depth strategy that combines every layer of the security stack. Kaushik can discuss how each security layer provides a different piece of the puzzle and how individually, none of the controls are sufficient. But together, they create the layered governance needed to securely deploy agentic AI.

For more information about Helmet Security, please visit https://securityweekly.com/helmetbh

Above Security on Why Legacy Tools Don't Cut It for Modern Insider Risk with Tricia Howard, Head of Marketing at Above Security

As organizations rush to adopt agentic AI, agents are often given broad access to critical business systems and sensitive data. Legacy insider risk management tools weren't built for this, and organizations have spent years on insider risk posturing and investments that leave security teams inundated with false positives while the real risk slips through undetected. In this segment, Tricia Howard draws on her decade in cybersecurity, including years watching user and entity behavior analytics (UEBA) overpromise and underdeliver, to unpack why understanding human – and now AI – intent is the missing piece.

Segment Resources:

• Blog Post: Redefining Insider Threat
• Blog Post: What I wanted UEBA to be, Years Ago

To learn more about Above Security and insider risk management in the era of agentic AI, visit: https://securityweekly.com/abovebh

The Identity Crisis Your Security Team Didn't See Coming: Governing AI Agents with Darren Guccione, CEO and Co-Founder of Keeper Security

AI agents outnumber human identities in enterprise environments, and traditional security software was never built to govern them. 89% of cybersecurity decision-makers recently surveyed by Keeper Security said that AI adoption has made identity management harder.

In this Black Hat USA conversation with Cyber Risk TV, Darren Guccione, CEO and Co-Founder of Keeper Security, shares a practical framework for extending identity governance to non-human identities and AI agents before the access gap becomes a breach.

Segment Resources:

• Privileged Access Management
• Identity Security at Machine Speed

To learn more about Keeper Security, visit: https://securityweekly.com/keeperbh

Show Notes: https://securityweekly.com/esw-478

Interview with Rob Sadowski from Cohesity

Global Cyber Resilience Report: Cyber Recovery Plans Weren't Designed for this Moment

Cyber recovery plans weren't designed for this moment. Most were built around assumptions that made sense when they were written: incidents could be understood, dependencies mapped, recovery could follow a predictable sequence, and decision-makers would have enough information to act.

In practice, major cyber incidents unravel those assumptions. AI and autonomous agents are creating new paths to compromise, while cloud and SaaS expansion increases the systems, services, and dependencies involved in recovery. Vulnerabilities are discovered and weaponized faster than ever, and AI is accelerating that cycle. As incidents unfold, scope expands, dependencies appear only when they break, and recovery plans no longer match reality.

With assumptions under greater strain, confidence is beginning to erode. This year, the percentage of survey respondents reporting complete confidence in their cyber resilience strategy fell.

To understand how recovery unfolds today, Cohesity commissioned Vanson Bourne to survey 3,200 IT and security decision-makers at organizations with 1,000 or more employees across 11 countries.

This report examines where recovery becomes more difficult than expected, the obstacles organizations encounter, how they define and test a Minimum Viable Company (MVC), and how AI is reshaping cyber threats and cyber resilience.

https://www.cohesity.com/dm/global-cyber-resilience-report/

This segment is sponsored by Cohesity. Visit https://securityweekly.com/cohesity to learn more about them!

Topic: When should we use AI for writing and when should we avoid it?

I've had an essay in draft form for a month now, trying to get my feelings across on why AI writing drives me so crazy. I struggled to put it into words.

Fortunately, Charity Majors figured out how to put it into words and I think she nailed not just how I feel about AI, but the reasons why I feel so strongly about it. She uses a scale to help explain this, with "personal" at one end and "functional" at the other.

https://charity.wtf/p/confessions-of-an-unrepentant-slop

When I ask AI to create a company profile for me, 10 minutes before I meet with them, I don't need poetry - just facts. But when I read something that is supposedly someone's opinions and analysis on a topic, and it's clearly 100% AI-generated, I angrily dismiss it.

I love that this writeup isn't just an "I hate slop" rant - it actually quantifies why a personal touch matters and how to gauge when it is necessary and when outsourcing the task to AI is totally fine.

In both cases, Charity notes that quality matters. My most recent complaints come from cases where things are not only clearly written by AI, but where quality went out the window and they're unrecognizable as a human-readable language.

And yes, I brought an example: https://dispatch.cybersecurityhq.com/p/escalation-voided-on-construct-failure-timing-condition-placed-under-review

Weekly Enterprise News

Finally, in the enterprise security news,

1. We check the vibes, funding, and acquisitions
2. Tenable now has Mythos built-in???
3. We check in on how vulnerability remediation is going
4. Microsoft is creating a code of conduct for AI
5. OpenAI just got called to the principal's office
6. Booz Allen created new cybersecurity AI benchmarks
7. 50% of CISOs see Mythos as a sign to resign???
8. Ayman read the latest Anthropic AI misuse report
9. MIT explains the 12 possible AI outcomes (very ominous)
10. a 9-year old decided to promote his YouTube account… with his dad's corporate card

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-477

Interview with Snehal Antani

Snehal Antani, CEO and co-founder of Horizon3 joins us to talk about how automated validation can help with exposure management. As vulnerability counts spike, security teams are looking for a way to prioritize. Automated penetration testing offers a way to quickly separate exploitable vulnerabilities from the rest.

This segment is sponsored by Horizon3. Visit https://securityweekly.com/horizon3 to learn more about them!

Topic Segment - SmartTVs and Privacy

For this week's topic segment, we explore privacy and TVs. LG has been in the news for allegedly collecting data from its customers, but the facts are unclear.

We share our recent experiences and dive into some of the primary concerns and theories about what's going on here.

If you want to opt out of some of your TV's data collection, Consumer Reports has a collection of instructions for a variety of TV platforms.

Weekly Enterprise News

Finally, in the enterprise security news,

1. We check the vibes
2. We check finding and acquisitions
3. Nightmare Eclipse or Good Night of Sleep Eclipse?
4. Update on Anthropic's Glasswing project
5. How long would it take for a mobile phone worm to spread?
6. Don't expose SSH to the public Internet
7. Massive amounts of cryptocurrency continue to get stolen
8. Did you actually read your third party's SOC 2?
9. Your boss may be reading your AI chat history

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-476

Interview - Amit Assaraf

As employees rapidly adopt local AI models, autonomous agents, and browser extensions to boost productivity, enterprise endpoints are quietly accumulating unchecked security risks. This episode explores how traditional EDR solutions miss non-binary software, leaving critical blind spots for prompt injection and data exfiltration. Discover how Cortex Agentic Endpoint Security (AES) uses LLM-based classifiers and an AI powered risk engine to surface shadow AI and protect the modern workspace without stalling innovation.

This segment is sponsored by Palo Alto Networks. Visit https://securityweekly.com/paloalto to learn more about them!

Topic - The British Library Cyber-Attack

For this week's topic segment, we're discussing the British Library cyber-attack.

In October 2023, the British Library, one of the largest libraries in the world, was breached by the Rhysida ransomware group. The attack encrypted systems across the organization, led to over 500,000 files being leaked, and set off a recovery effort that consumed a significant portion of the Library's £17.5 million cash reserves. With no clear end date, this is a story of what could happen when all of an organization's tech debt comes due at once.

Resources

• https://www.defendersinitiative.com/p/breach-lessons-the-2023-british-library

The Weekly Enterprise News

Finally, in the enterprise security news,

1. We check the vibes
2. the funding
3. the acquisitions
4. and the closures
5. is the vulnpocalypse real, or not?
6. TeamPCP finds out why being perpetually online isn't great if you're doing cybercrimes
7. millions of IDs get leaked online
8. What's the bigger story: Huggingface and NVIDIA or Microduck?
9. Dyson enters a new product category. Try to guess what it is without cheating and looking it up before the end of the episode!

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-475