Hacker Valley Studio

By Hacker Valley MediaTechnology Education Self-Improvement

Hacker Valley Studio episodes

October 26 Your Cloud Backup Won’t Save You with Jake Bernardes
If someone wiped your cloud environment tomorrow, how long until you’re back in business? Not what the plan says. What would actually happen? Ron sits down with Jake Bernardes, CISO at Gambit Security, who got his first CISO job by sneaking into a company’s office and sitting in the CEO’s chair. He has since run security for tech companies and early-stage security vendors, and he hosts the Random Access Memories podcast.
Jake shares the social engineering tricks that got him past security guards. He also explains why voice phishing now takes almost no effort. Then he walks through Gambit’s research on an AI-run attack that cost about $25 per target and needed fewer than ten non-technical prompts. Along the way, he takes on phishing simulations, AI guardrails and cyber insurance.
Then comes recovery, the part of security Jake says is still broken. His take: tabletop exercises are “Dungeons & Dragons for executives.” Instead, figure out your minimum viable business, the systems you can’t live without, and prove you can bring them back. Ron closes by tying it to the grocery chain outage that hit his family’s workplace.
Impactful Moments
00:00 - Introduction
03:20 - Busting the myth: the cloud has your back
05:45 - Seven minutes of agentic ransomware
10:35 - Breaking into a CEO’s office for a CISO job
12:15 - Paying strangers to get past security guards
15:25 - People don’t hack in, they log in
18:55 - The ASOS incident and the short-stock theory
20:00 - Too much exposed to the public internet
23:05 - Anatomy of a $25 AI attack
27:10 - Translating the attacker’s Chinese prompt
29:40 - Can CISOs rely on AI guardrails?
32:25 - Why cyber insurance is a tick box
35:30 - Minimum viable business for 2027
38:25 - Ron digs into the Giant Food outage
Links
Connect with Jake Bernardes on LinkedIn: https://www.linkedin.com/in/jakeleobernardes/

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
46 min
October 14 Voice Phishing Is the New Front Door
What would you do if your phone rang and the caller ID showed your own company? Would you pick up? Would you help the person on the other end?
This Cybersecurity Awareness Month, Ron goes solo to break down a breach that started with that exact call. Attackers spoofed Astrana Health’s main corporate phone number, posed as coworkers, and talked their way into systems connected to roughly 1.5 million patients. Ron starts with a rewind from phone books to data brokers, including a live search on a people-search site that turned up his own family. From there he walks through the SEC filing, sends a swarm of AI research agents after the public record, and lines up the suspects behind the attack.
The uncomfortable part is that we spent a decade training people to spot a bad email while attackers moved to the phone. Voice phishing is now the second most common way attackers get in, and resetting credentials doesn’t fix the instinct to help when a familiar number calls. Ron closes with three practical ways to stop making it easy for them, starting with one simple habit: hang up and call back.
Impactful Moments
00:00 - Introduction
02:25 - The rewind: from phone books to data brokers
03:15 - What a people-search site found on Ron’s family
05:30 - A breach that started with a phone call
06:15 - Inside Astrana Health’s SEC filing
07:55 - Why spoofing the main number changes everything
09:05 - How the attack likely played out
11:35 - Technical fixes for a human attack
12:50 - The time Ron got got
13:35 - Why attackers want healthcare data
15:15 - 1.5 million patients’ worth of exposure
17:15 - Voice phishing climbs to #2 in M-Trends
19:35 - Three ways not to make it easy for them
21:05 - How to run a phone drill
Links
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
23 min
October 07 Securing the Apps Everyone Is Building with Roi Nisimi and Yonatan Levi
What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them.

Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt.

The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.
Impactful Moments
00:00 - Introduction
02:15 - Busting the vibe coding myth
04:40 - Inside Orca's State of AI report
05:55 - The unpatched AI SDK problem
07:40 - What is AppGen?
10:20 - Who builds the backend?
12:25 - Inside Orca's AppGen hackathon
14:10 - Thinking like a citizen developer
15:15 - Who's really building these apps
19:25 - One misconfigured app, every integration exposed
20:45 - Why Supabase is the holy grail
23:00 - Checking your own exposure
24:30 - Why the SDLC is breaking down
26:55 - Prompting for a secure app
28:15 - Don't hand the agent every decision
31:20 - Staying sharp by never stopping learning
33:35 - From protecting environments to protecting apps
Links
Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/
Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/
Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part

Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party
–
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
37 min
September 30 Giving Your AI Agent Its Own Identity with Ashish Rajan
Your newest hire has a Google Workspace account, a Slack login and a laptop. It never sleeps, and it never asks before it acts. So who owns its identity? Ron welcomes back Ashish Rajan, CISO at Techriot.io and researcher with AI Security Lab, who spent 17 years in identity, cloud security and security leadership. His take: vendors haven't solved AI identity, and the open questions are on your side, not the product's.

Ashish got into identity after failing his OSCP three times: if he couldn't break in, he wouldn't let anyone else in. Now he reviews Ron's own setup, where Hacker Valley's AI agent, Jennifer Romani, has her own accounts just like an employee. Ashish explains how that call changes from a one-laptop small business to an enterprise where every developer's machine acts like five. They also cover the Gemini breach headlines, swarms of agents and AI Security Lab, which Ashish describes as what OWASP is for AppSec, but for AI security.

The uncomfortable truth: defenders have the same models attackers do, but attackers don't wait for a pull request review. Ashish calls that a people problem, not a technology problem. He also shares the question he asks before handing anything to an AI agent: can this be reversed?

Impactful Moments
00:00 - Introduction
02:30 - Busting a myth: AI identity isn't solved
05:30 - Three OSCP attempts and a pivot to IAM
07:00 - Why AI identity is more complex than ever
09:15 - Hot or not: giving an AI agent its own accounts
11:10 - One laptop, five machines in the enterprise
12:50 - AI gateways and developer observability
14:05 - Where Ashish would spend his AI security budget
18:20 - Why defenders don't hack themselves first
19:05 - The real problem is people
22:15 - Swarms of agents are coming
23:50 - What AI Security Lab is building
26:35 - Never share your credit card with AI
28:40 - Ron's callback: can it be reversed?
Links
Connect with Ashish Rajan on LinkedIn: https://www.linkedin.com/in/ashishrajan/
Listen to Ashish's first Hacker Valley Studio episode: https://www.podbean.com/pw/pbblog-bpaij-51b280
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
33 min
September 23 From Read Access to Admin with just an AI Agent
What if someone got full admin access to your company's platform, including your CRM, your payments app, and your private messages, and the only tool they used was an AI chatbot? Can AI models really find zero-days on their own, or is that just the headline? And if AI can do the attacker's job, who's actually holding the scissors?
In this solo episode, Ron Eddings shares his own methodology for offensive assessments with AI. He talks about the models he trusts, the tools he uses to get agents working together, and a real assessment where his agents turned SQL read access into admin control and unlocked the API keys stored inside. Ron also calls out what's hype and what's real with today's models, and why the agent still needs a skilled person behind it.
For defenders, Ron covers what attackers go after once they're in, and why the fundamentals like asset inventory are still where every strong security program starts. He closes with the bigger picture: anyone, good or bad, now has powerful intelligence on hand, and it's on all of us to look out for each other.
Impactful Moments
00:00 - Introduction
02:25 - Can AI Really Find Zero-Days Alone?
04:20 - The Real Danger Is Human Intent
05:00 - Why Grok 4.6 Tops Ron's List
07:55 - Ron's Three-Model Assessment Workflow
09:50 - Maestro, Interceptor, and Agent Ensembles
11:20 - Privilege Escalation and Persistence With LLMs
12:50 - Why AI Hacking Feels Like Cheating
14:20 - Ron Called Automated Security in 2015
16:05 - The Lazy Way to Hack
17:55 - From SQL Read Access to Admin
21:05 - What Attackers Want After Getting In
23:40 - Asset Inventory Is Security Flossing
27:05 - Why AI Is Like Scissors
29:05 - Waymos, Robotaxis, and Physical AI Risk
Links
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
32 min
September 16 Do You Know What Your Agent is Doing at 3AM? with Amir Ofek
Every AI agent in your environment inherits someone's permissions, and most teams have no idea what those agents are actually doing with them. Amir Ofek, CEO and co-founder of Aizome, shares how to make every agent accountable before the damage shows up as a $150,000 bill.

In this episode, Amir explains why human and machine identity tools both fail for AI, why agents act more like eager, naive interns than employees, and how a new category called ARISE (Agentic Runtime Identity Security Enforcement) is emerging to fix it.

This one's for anyone building with AI agents right now (so, most of us). Amir's take: the biggest danger isn't a breach. It's agents quietly doing the wrong thing at scale while nobody's watching.

Impactful Moments
00:00 - Introduction
02:30 - Busting the Myth: "I Know What My Agents Are Doing"
05:30 - The Samurai Story Behind Aizome's Name
08:25 - Why Not All AI Agents Are Born Equal
11:15 - Where Enterprises Are Actually Deploying AI Agents Today
14:25 - What Claude Cowork Inherits Without You Realizing It
17:15 - Machine Identity vs. Human Identity vs. AI Identity
19:35 - Treating AI Agents Like Eager, Naive Interns
23:00 - The Biggest AI Risk Isn't Security, It's Cost
25:45 - Meet Ito: Aizome's Supervisor Agent
26:40 - Inside the New ARISE Category
33:35 - What Aizome Actually Does
35:30 - The Callback: Was the Myth Wrong, or Dangerously Wrong?
Links
Connect with Amir Ofek on LinkedIn: https://www.linkedin.com/in/amirofek/

Learn more about Aizome: https://www.aizome.ai/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
39 min
September 09 Cloud Broke My World Before AI Did with Dr. Jay Abdullah
Cybersecurity has survived cloud, mobile, and a dozen other "biggest disruptions of our lifetime," and each one felt unprecedented in the moment. In this episode, Ron sits down with Alyssa "Dr. Jay" Abdullah, Deputy CISO at MasterCard, who started her career as a radio DJ and has since worked inside the White House, Lockheed Martin, Stryker, and Xerox before landing in payments security.
Ron and Dr. Jay trace her path from spinning records to securing global payment infrastructure, and dig into why she'd argue cloud, not AI, was the real turning point in her career. They cover what convergence actually looks like when AI, cloud, and synthetic identity start overlapping, why curiosity matters more than fast answers, and what it means when employees start bringing their own trained AI agents to work.
The conversation closes on something most teams haven't fully reckoned with yet: AI agents that carry their own identity, independent of the humans who built them, and what that shift demands from the people responsible for securing them.
Impactful Moments
00:00 - Introduction
02:25 - Busting the AI hype myth
04:40 - From radio DJ to Dr. Jay
06:10 - A day in the life as Deputy CISO at Mastercard
07:25 - Why AI hasn't disrupted her world
08:50 - White House tech through the decades
12:30 - Smartphones, wearables, and what's next
13:30 - Defining convergence for 2026
14:50 - When AI meets quantum computing
17:20 - Bring your own AI agent to work
19:00 - Negotiating salary in tokens
21:05 - Teaching curiosity over answers
23:50 - Overhype equals overtrust
27:10 - The future of tier one and autonomous SOC
29:50 - Hot take: AI in the SOC
31:35 - Predictions: AI identities and the human outside the loop
Links
Connect with Alissa "Dr. Jay" Abdullah on LinkedIn: https://www.linkedin.com/in/dralissajay/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
37 min
September 01 The Dashboard Is Dead, Long Live the Harness with Myke Lyons
Security teams spent decades begging for more logs. Now the enterprise is generating petabytes a day, and the thing drowning in it isn't just the SOC anymore, it's your AI agents too. In this episode, Ron sits down with Myke Lyons, CISO at Cribl, who cut his teeth in telemetry and logging decades ago and has landed right back there in the age of AI.
Ron and Myke dig into why most telemetry failures aren't data problems at all, they're decisions nobody made about why the logs are being collected in the first place. Myke breaks down what to track on every agent in your environment, why token spend belongs on the security team's plate, why dashboards are quietly dying, and why treating an AI agent like just another employee is a mistake that's going to bite security teams hard.
Underneath it all is one question Myke keeps circling back to: do you actually know what normal looks like for every agent in your environment?
Impactful Moments
00:00 - Introduction
01:50 - Myth Busting: AI Agents Aren't Just Another User Account
04:25 - Meet Myke Lyons, CISO at Cribl
05:05 - What it means to run security at a telemetry company
06:10 - From gigabytes of logs at GE to petabytes today
07:45 - MITRE ATT&CK, Cribl's new APEX framework, and orienting telemetry
10:20 - Why most telemetry problems are decision problems, not data problems
13:20 - OCSF and how security teams are rethinking their schemas
14:25 - Why the dashboard is dying
17:35 - What Myke wants to track about every AI agent
20:10 - How to spot an agent going rogue
23:15 - Making your data AI-ready and the case for schematizing everything
27:10 - Tokenomics: treating AI spend as a security responsibility
29:05 - The non-negotiable logs every org should be collecting
31:50 - Hot takes: build vs. buy, tier two to three, and Myke's daily AI briefing
33:35 - Closing thoughts and outro
Links
Connect with Myke Lyons on LinkedIn: https://www.linkedin.com/in/mykelyons/
Learn more about Cribl: https://cribl.io/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
36 min
August 25 The AI Already Inside Your Company with Russell Spitler & Richard Penshorn
A year ago, the average employee held about 30 OAuth grants. Today that number has risen to 88, and it isn't slowing down. Ron sits down with Russell Spitler, co-founder and CEO of Nudge Security, and Richard Penshorn, a senior security engineer at a top financial services company, to talk about the AI already living inside your business.
Ron, Russell, and Richard dig into why shadow AI doesn't behave like shadow IT, how one forgotten grant became the door into a real world breach, and whether AI agents should ever get access to a corporate inbox.
Underneath all of it is the one thing Russell and Richard keep coming back to: ownership. Give an AI agent access with no owner attached and it becomes invisible. Give every employee an approved, low-friction path to use AI and they stop wandering off it. Find out how you can get ahead of the AI already running inside your walls.
Impactful Moments
00:00 - Introduction
02:00 - Busting the "shadow AI is just shadow IT" myth
03:45 - Meet Russell Spitler and Richard Penshorn
05:50 - The surprising long tail of AI tool usage
07:00 - Entertainment vs. finance: build vs. buy culture
08:50 - How 30 OAuth grants became 88 in 2026
10:25 - Why manual OAuth audits became untenable
11:30 - The Canva example: what "click to connect" really grants
15:20 - Benign vs. malicious: how a stolen OAuth grant gets exploited
17:00 - Shadow IT vs. Shadow AI: what's actually different now
21:00 - Hot take: should AI agents ever touch corporate email?
25:10 - The three buckets of AI agent discovery
27:55 - Russell's best practices for locking down agents
31:00 - Fundamentals for the next 18 months: visibility and easy paths
Links
Connect with Russell Spitler on LinkedIn: https://www.linkedin.com/in/russell-spitler/
Connect with Richard Penshorn on LinkedIn: https://www.linkedin.com/in/richardpenshorn/
Learn more about Nudge Security: https://www.nudgesecurity.com/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
36 min
August 19 Humans First: Adobe's Rule for Building AI Security Tools with John Gillis
Imagine how much investigation time your SOC could get back if the busywork just disappeared. Ron sits down with John Gillis, Staff Security AI Engineer at Adobe, who built an in-house AI investigation platform from scratch.
John's system runs on more than 30 specialized agents that reason through cases instead of following a script. In one run, that meant over 140 detections investigated in under four hours at an 80 to 85% quality rating. Ron and John dig into the hard lesson that made John rip out his own tooling and rebuild it around function calling, why "humans first" drives every decision his team makes, and whether AI SOC is actually different from SOAR or just the same promise with way better marketing.
Underneath all of it is the one thing John says decides whether any of this actually works: context. Give the AI too little and it's guessing, give it too much and it drowns just like a human would. Listen to find out what it actually takes to build an AI SOC that reasons instead of just automates.
Impactful Moments
00:00 - Introduction
02:05 - The rewind: how SOAR promised to save the SOC in 2015
03:35 - Meet John Gillis, Adobe's Staff AI Security Engineer
05:30 - What cybersecurity looked like before AI at enterprise scale
07:00 - The "humans first" strategy behind Adobe's AI investigator
09:30 - Why careless context management is the biggest pitfall in agent design
14:45 - Solving the speed problem: is it tooling, process, or people?
17:10 - From monolith to microservices: rebuilding the platform for scale
24:05 - What actually makes an AI agent's "persona" work
26:00 - John's prediction for the SOC three years from now
28:50 - The three skills every security practitioner needs for 2026
32:10 - Final verdict: is AI SOC really different, or SOAR with new branding?
Links
Connect with John Gillis on LinkedIn: https://www.linkedin.com/in/john-gillis/
If you're a researcher ready to make an impact, check out the announcement about Adobe’s new home for the Adobe Bug Bounty Program here: https://blog.adobe.com/security/a-new-home-for-the-adobe-bug-bounty-program
Check out Adobe’s Bug Bounty profile on Intigriti: https://app.intigriti.com/programs/adobe/adobepublic/detail
Learn more about Adobe: https://www.adobe.com/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/
35 min

About Hacker Valley Studio

From the publisher's feed

Welcome back to the show! Hacker Valley Studio podcast features Host Ron Eddings, as he explores the world of cybersecurity through the eyes of professionals in the industry. We cover everything from…