🛡️ This episode is all about vulnerability disclosure, bug bounty programs, and working effectively with security researchers. To build practical offensive security skills, explore LufSec’s cybersecurity courses and hands-on training:👉 https://www.lufsec.com/courses/?utm_source=youtube&utm_medium=onramp&utm_campaign=career-guide-funnel&utm_content=s2e8-course━━━━━━━━━━━━━━━━━━━━Season 2 of Inside Cyber Minds continues with Katie Moussouris — founder and CEO of Luta Security and one of the most influential leaders in vulnerability disclosure, bug bounty programs, and hacker economics.Katie has helped shape how major technology companies, governments, and global organizations work with security researchers. Her career includes launching vulnerability programs at Microsoft, contributing to the creation of Hack the Pentagon, and helping develop international standards for vulnerability disclosure and handling.Her core argument: launching a bug bounty program is not the same as building a mature vulnerability management capability. Organizations must first create the internal processes, resources, ownership, and remediation capacity required to receive and act on vulnerability reports.We discuss how organizations should work with hackers, why some bug bounty programs fail, and how leaders can determine whether their security teams are ready to engage with external researchers.Katie also explains the economics behind vulnerability research, how incentives influence researcher behavior, and why paying for vulnerabilities without fixing the underlying process can create more problems than value.We explore coordinated vulnerability disclosure, researcher relationships, government programs, liability protections, security maturity, and the difference between generating more vulnerability reports and actually reducing organizational risk.Katie also shares her perspective on the future of vulnerability research, how AI may affect bug discovery and exploitation, and what security leaders must understand before scaling a disclosure or bounty program.Topics CoveredKatie’s path into cybersecurity and vulnerability researchThe origins of modern bug bounty programsBuilding vulnerability disclosure programs at MicrosoftThe creation and impact of Hack the PentagonWhy bug bounty programs are not a shortcut to security maturityVulnerability disclosure versus vulnerability managementHow organizations should work with security researchersThe economics of vulnerabilities and hacker incentivesMeasuring the ROI of bug bounty programsCommon mistakes organizations make when launching programsCoordinated vulnerability disclosure and safe harborGovernment collaboration with ethical hackersPreparing internal teams to receive vulnerability reportsHow AI may change vulnerability discovery and exploitationThe future of bug bounties and security researchAbout Inside Cyber MindsA LufSec cybersecurity podcast featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, authors, and industry leaders about mindset, decisions, emerging threats, and the human side of cybersecurity.LinkedIn: https://www.linkedin.com/company/lufsec/Katie Moussouris and Luta SecurityWebsite:https://www.lutasecurity.com/X:https://x.com/LutaSecurityhttps://x.com/k8em0Bluesky:https://bsky.app/profile/lutasecurity.bsky.socialhttps://bsky.app/profile/k8em0.bsky.social#Cybersecurity #BugBounty #VulnerabilityDisclosure #EthicalHacking #HackerEconomics #KatieMoussouris #LutaSecurity #InsideCyberMinds

Season 2 of Inside Cyber Minds continues with David Girvin — offensive security expert, cybersecurity leader, and founder of Honey Badger, focused on securing AI agents at the execution layer.After an injury forced him to leave welding, David discovered hacking and bug bounty programs. That curiosity became a career spanning offensive security, threat modeling, detection engineering, MDR, startup leadership, and AI security.His core argument: AI governance cannot stop at policies, model evaluations, or prompt filtering. As agents gain access to tools, credentials, data, and business processes, organizations need controls that govern what they can actually execute.We discuss adaptive agent governance, runtime enforcement, deterministic controls, and why securing thousands of autonomous agents requires a different security architecture.David also shares lessons from BitDiscovery, 1Password, Red Canary, and Sumo Logic, and explains how offensive security, leadership, detection engineering, and threat modeling shaped his approach.We explore how attackers may target AI agents, why prompt injection is not going away, how attacks could evolve, and which AI security failures may emerge over the next two years.David also predicts that by 2028, AI will handle more repetitive SOC analysis while humans focus on judgment, investigation, and complex decisions.Topics CoveredDavid’s journey from welding to offensive cybersecurityBug bounty programs and early hacksThreat modeling for AI agentsWhy traditional AI governance is not enoughAdaptive agent governance at the execution layerRuntime governance and deterministic controlsSecuring agents with access to tools, systems, and dataPrompt injection and future AI attack techniquesManaging thousands of autonomous agentsHow AI may reshape SOC roles by 2028Expected AI security failures over the next two yearsChapters00:00 Introduction to David Girvin and his background01:14 Early security experiences and breaking into cars02:04 Transition from welding to cybersecurity03:32 Discovering hacking and bug bounty programs04:28 Offensive security work and early hacks06:38 Understanding the defender’s perspective08:42 The impact of AI on cybersecurity10:41 Startup GTM lessons from BitDiscovery12:32 Leadership challenges at 1Password14:00 Threat modeling inside a large organization15:42 Detection engineering and MDR operations18:25 Lessons from Red Canary and Sumo Logic20:00 Founding Honey Badger and focusing on AI security22:15 Hacking agents and securing agent environments25:43 Adaptive agent governance explained36:14 AI governance and deterministic controls40:37 Scaling security across thousands of AI agents45:53 Future agent attack techniques and AI risks51:29 Why prompt injection remains a major threat53:33 Runtime governance and platform integrations58:24 How SOC analyst roles may evolve by 202801:02:46 Expected AI security failures over the next two years01:04:23 Closing remarksAbout Inside Cyber MindsA LufSec cybersecurity podcast featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, authors, and industry leaders about mindset, decisions, emerging threats, and the human side of cybersecurity.Watch & Listen🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc🍎 Apple: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640🎤 Amazon: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1LinkedIn: https://www.linkedin.com/company/lufsec/David Girvin: https://assury.ai/#Cybersecurity #AISecurity #AgentSecurity #PromptInjection #AIGovernance #OffensiveSecurity #DavidGirvin #InsideCyberMinds

Season 2 of Inside Cyber Minds continues with Roger Grimes — cybersecurity author, researcher, speaker, and one of the industry’s most experienced voices on malware, social engineering, identity, artificial intelligence, and emerging security threats.

In this episode, Roger shares lessons from decades on the front lines of cybersecurity and explains why organizations continue to be compromised despite investing heavily in security tools.

We discuss the two problems behind most successful cyberattacks, why identity and social engineering remain so effective, and how defenders can focus on the risks that actually cause the majority of real-world breaches.

The conversation also explores the growing impact of artificial intelligence and quantum computing on cyber threats and defenses. Roger explains what security leaders should take seriously today, what is still being exaggerated, and how organizations should prepare for a rapidly changing threat landscape.

This is a practical and strategic discussion about security fundamentals, emerging technology, risk prioritization, and why cybersecurity teams must become more data-driven.

If you care about AI security, quantum computing, identity attacks, social engineering, ransomware, and building more effective security programs, this episode is essential listening.

Topics Covered

• The two root causes behind most successful cyberattacks
• Why social engineering remains one of the biggest security risks
• Identity, credentials, and authentication attacks
• Why organizations often focus on the wrong security problems
• Artificial intelligence as an offensive and defensive security tool
• How quantum computing could affect cybersecurity
• Post-quantum cryptography and organizational readiness
• Malware, ransomware, and modern attacker techniques
• Data-driven defense and risk prioritization
• Lessons from Roger’s decades in cybersecurity
• How security leaders should prepare for emerging threats
• The future of cybersecurity education and awareness

Roger Grimes’ New Book

Roger recently released his 16th book:

How AI and Quantum Impact Cyber Threats and Defenses

Amazon:
https://www.amazon.com/dp/B0GGB7Y855/

Get a Free PDF Copy

Roger is offering podcast viewers a free PDF copy of the book:

https://www.knowbe4.com/hubfs/AI-Quantum-Book-Roger-Grimes.pdf

About Inside Cyber Minds

Inside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, authors, and industry leaders.

The show focuses on mindset, decision-making, leadership pressure, emerging threats, and the human side of cybersecurity.

Watch & Listen

▶️ YouTube: https://youtube.com/@Lufsec

🔗 Listen on your favorite platform
🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc
🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds
🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp
🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640

LinkedIn: https://www.linkedin.com/company/lufsec/

#Cybersecurity #ArtificialIntelligence #QuantumComputing #RogerGrimes #InsideCyberMinds

Season 2 of Inside Cyber Minds continues with Hector Monsegur, also known as Sabu — the former Anonymous and LulzSec hacker whose story became one of the most controversial and widely discussed chapters in modern hacking history.In this episode, Hector shares his journey from the underground hacking world to the realities of consequences, accountability, transformation, and cybersecurity today.We discuss the rise of Anonymous and LulzSec, the culture of hacking during that era, what motivated many of those operations, and how the line between activism, cybercrime, ego, and chaos can become dangerously blurred.This conversation goes beyond the headlines.It is about identity, pressure, loyalty, mistakes, consequences, reinvention, and what the cybersecurity community can learn from people who have lived on both sides of the keyboard.If you care about hacking culture, Anonymous, LulzSec, cybercrime, redemption, and the human side of cybersecurity, this episode is essential listening.Topics Covered* Hector Monsegur’s journey as Sabu* The rise of Anonymous and LulzSec* Hacking culture and online movements* Hacktivism, cybercrime, and blurred lines* The psychology of hacking communities* Mistakes, consequences, and accountability* What the media often gets wrong about hackers* Life after the underground hacking world* Redemption, reinvention, and second chances* Lessons for young hackers and cybersecurity professionals* Why the human side of cybersecurity mattersAbout Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and industry leaders. The show focuses on mindset, decision-making, leadership pressure, and the human side of cybersecurity.Watch & Listen▶️ YouTube: https://youtube.com/@Lufsec🔗 Listen on your favorite platform🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640LinkedIn → https://www.linkedin.com/company/lufsec/Hector MonsegurSafehill: https://safehill.comLinkedIn: https://www.linkedin.com/in/hxmonsegur/

Season 2 of Inside Cyber Minds continues with JP Calabio — cybersecurity executive, CISO, and security leader at Grainger.In this episode, JP shares a practical look at modern cybersecurity leadership from the perspective of someone responsible for protecting a large, complex enterprise environment.We discuss what it really means to lead security inside a business, how CISOs balance risk, operations, communication, and executive expectations, and why cybersecurity leadership is no longer just about technology.This conversation goes beyond tools and frameworks.It is about decision-making, business alignment, security culture, leadership pressure, vendor noise, resilience, and the reality of defending organizations where security must enable the business without slowing it down.If you care about CISO leadership, enterprise security, cyber risk, executive communication, and the human side of cybersecurity, this episode is essential listening.Topics CoveredThe role of the modern CISOCybersecurity leadership inside a large enterpriseRisk management and business alignmentCommunicating security to executives and the boardBuilding security programs that support the businessThe difference between technical security and leadershipSecurity culture and organizational influenceVendor noise and how security leaders evaluate solutionsResilience, incident readiness, and operational pressureLessons for the next generation of cybersecurity professionalsHow CISOs think about trust, accountability, and executionAbout Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and industry leaders. The show focuses on mindset, decision-making, leadership pressure, and the human side of cybersecurity.Watch & Listen▶️ YouTube: https://youtube.com/@Lufsec🔗 Listen on your favorite platform🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640LinkedIn → https://www.linkedin.com/company/lufsec/JP Calabio / LinksCISOXC Chicago 2026: https://www.cisoxc.com/chicago-2026Grainger: https://www.grainger.com/

Season 2 of Inside Cyber Minds continues with Toni de la Fuente — founder and CEO of Prowler, creator of the open-source Prowler project, and a cloud security leader focused on helping organizations secure cloud environments with transparency, automation, and practical security engineering.

In this episode, Toni shares the story behind Prowler, how an open-source cloud security tool became a widely used platform for security and compliance, and why cloud security needs to be practical, continuous, and accessible.

We discuss the evolution of cloud security, the challenges of securing AWS, Azure, Google Cloud, Kubernetes, GitHub, Microsoft 365, Infrastructure as Code, and other modern environments, and why visibility remains one of the hardest problems for security teams.

This conversation is about more than one tool.

It is about open source, cloud security posture management, compliance automation, engineering culture, startup building, community, and the future of securing complex cloud environments.

If you care about cloud security, open source, compliance, automation, and how security tools are built from real-world engineering problems, this episode is essential listening.

Topics Covered

• The story behind Prowler
• Open-source cloud security
• Cloud security posture management
• Security and compliance automation
• AWS, Azure, Google Cloud, Kubernetes, GitHub, Microsoft 365, and multi-cloud visibility
• Why cloud security needs to be continuous
• The role of open source in cybersecurity
• Building a security product from a community project
• The challenge of making cloud security simple, scalable, and useful
• What security teams often get wrong about cloud security
• Toni’s journey as a founder and security engineer
• The future of cloud security and AI-driven security workflows

About Inside Cyber Minds

Inside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and industry leaders. The show focuses on mindset, decision-making, leadership pressure, and the human side of cybersecurity.

Watch & Listen

▶️ YouTube: https://youtube.com/@Lufsec

🔗 Listen on your favorite platform
🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc
🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds
🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp
🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640

LinkedIn → https://www.linkedin.com/company/lufsec/

Toni de la Fuente / Prowler

Prowler: https://prowler.com/
Prowler GitHub: https://github.com/prowler-cloud/prowler
Prowler Docs: https://docs.prowler.com/
Toni’s website: https://blyx.com/

The Season 2 premiere of Inside Cyber Minds features a conversation with Dmitri Alperovitch — co-founder and former CTO of CrowdStrike, co-founder and chairman of Silverado Policy Accelerator, founder of the Alperovitch Institute for Cybersecurity Studies at Johns Hopkins SAIS, and author of World on the Brink: How America Can Beat China in the Race for the 21st Century.In this episode, Dmitri goes beyond traditional cybersecurity conversations to explore how cyber conflict now fits into a much larger global picture: nation-state competition, geopolitical power, deterrence, intelligence, China, Russia, Taiwan, Ukraine, and the future of American leadership.We discuss how cyber operations have changed over the years, why the line between cybersecurity and national security has almost disappeared, and what security leaders need to understand about the new era of global conflict.This is not a tactical “how-to” episode. It’s a strategic conversation about power, cyber statecraft, geopolitical risk, and where cybersecurity is heading next.If you care about cyber war, national security, threat intelligence, and the people shaping the future of global cybersecurity, this episode is essential listening.Topics Covered- Cybersecurity as a national security issue- Cyber war, cyber espionage, and state-sponsored operations- China, Taiwan, and the race for the 21st century- Russia, Ukraine, and lessons from modern conflict- The evolution of threat intelligence- What cyber leaders often misunderstand about geopolitics- Deterrence, power, and strategic competition- Dmitri’s journey from CrowdStrike to Silverado Policy Accelerator- The role of cybersecurity professionals in a world of great-power competition- How the next generation should think about cyber, policy, and global riskAbout Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and industry leaders. The show focuses on mindset, decision-making, leadership pressure, and the human side of cybersecurity.Watch & Listen▶️ YouTube: https://youtube.com/@Lufsec🔗 Listen on your favorite platform🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640LinkedIn → https://www.linkedin.com/company/lufsec/Dmitri:Book: https://www.amazon.com/World-Brink-America-Twenty-First-Century/dp/1541704096/Podcast: https://podcast.silverado.org/Social: @DAlperovitch

The Season 1 finale of Inside Cyber Minds features a conversation with Bruce Schneier — one of the most influential thinkers in cybersecurity, cryptography, and digital trust.In this episode, Bruce goes beyond headlines and buzzwords to explore how security actually works in the real world. We discuss the limits of technology, the role of policy and incentives, the risks and promises of artificial intelligence, and why complexity — not hackers — is often the real enemy of security.This conversation also dives into Bruce’s long-standing involvement with the Electronic Frontier Foundation (EFF), the responsibility of successful leaders to give back, and why community engagement matters more than ever in shaping the future of cybersecurity.This is not a tactical “how-to” episode. It’s a strategic, philosophical, and deeply practical discussion about trust, power, systems, and where cybersecurity is heading next.If you care about the future of security — and the people who shape it — this episode is essential listening.Topics CoveredThe future of cybersecurity and digital trustAI, automation, and systemic riskWhy most security failures are incentive failuresComplexity as the hidden threat in modern systemsThe role of policy vs. technology in securityBruce Schneier’s work with the Electronic Frontier Foundation (EFF)Why experienced leaders should give back to the security communityOne word to describe today’s security communityAbout Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by Lufsec, featuring deep, unscripted conversations with hackers, CISOs, researchers, and industry leaders. The show focuses on mindset, decision-making, leadership pressure, and the human side of cybersecurity.Watch & Listen▶️ YouTube: https://youtube.com/@Lufsec🎧 Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc

Welcome to Episode 5 of Inside Cyber Minds, part of the Lufsec Podcast — conversations that shape the way we think about security.In this episode, I’m joined by James Lim, founder of BQG Security Consulting and a cybersecurity leader with more than 15 years at Deloitte, where he led complex global security programs across industries. James shares what he learned during his time at one of the world’s top consulting firms, the challenges of building a security consultancy from the ground up, and what it takes to deliver real impact for clients in today’s threat landscape.🧠 Key themes:Lessons from 15+ years in cybersecurity consultingWhat large enterprises actually struggle withBuilding and scaling BQG SecurityTrust, relationships, and business fundamentals in cyberThe shift from corporate leadership to entrepreneurship🎙️ Host: Luciano Ferrari💬 Guest: James Lim📅 Premiere: [Insert Release Date]🎧 Podcast: Lufsec / Inside Cyber Minds S1E5👉 Subscribe for more episodes:https://youtube.com/@LufsecFollow Lufsec Podcast on:🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc