AI is moving from simple human-to-system interaction to agentic AI, where machines interact with other machines, take actions, exchange data, and influence business decisions.This creates a major challenge for cybersecurity, GRC, audit, compliance, and assurance professionals:

Priyank Sonihttps://www.linkedin.com/in/priyank-soni-iima/How do you audit an AI system when you cannot fully see the model, logic, architecture, or internal decision-making process?In this podcast, Prabh speaks with Priyank Soni, a cybersecurity, AI/ML, digital trust, governance, and assurance leader, about auditing AI systems in critical sectors.Priyank explains why traditional audit approaches are not enough when AI systems become black boxes, especially in sectors where trust, safety, compliance, and accountability matter.In this episode, we discuss:Why AI audit is becoming important in critical sectorsHow AI is moving toward agentic and machine-to-machine interactionsWhy zero-trust architecture must evolve for AI agentsWhy AI systems require stronger documentation and evidenceHow ISO/IEC 42001 is shaping AI governance and audit expectationsWhy auditors must understand data flow, model behavior, and system boundariesHow to audit black box AI systemsWhy AI audits should start with inventory and classificationWhy data mapping is critical for AI assuranceHow to assess AI vendor and supply chain riskWhy SBOM and ABOM may become important for AI system auditsHow to handle trade secret challenges when vendors do not share model detailsWhy auditor, vendor, and internal team collaboration is requiredWhat performance metrics auditors should reviewHow to test bias, fairness, and reliabilityWhy adversarial input testing mattersWhy human oversight must be validated, not just mentioned in policyWhy AI systems need continuous monitoring after deploymentWhy AI audits may need to happen more frequently than traditional IT auditsPriyank also explains that AI auditing is still in an early maturity phase. Many organizations, vendors, and auditors are learning together. That makes documentation, risk assessment, monitoring, and evidence collection even more important.#AIAudit #AIGovernance #ISO42001 #AISecurity #CyberSecurity #GRC #DigitalTrust #ResponsibleAI #CriticalInfrastructure #VendorRiskManagement #CoffeeWithPrabh

AI adoption is accelerating across enterprises, but most security programs were not designed for the speed, scale, and complexity of AI-driven threats.In this CISO Masterclass episode, Prabh speaks with Agnidapta Sarkar, a seasoned cybersecurity evangelist and digital resilience strategist, about how CISOs must evolve their security programs for the AI era.Agni explains why organizations must first understand their digital assets, business impact, material risk, and enterprise architecture before rushing into AI adoption or AI security controls.The discussion goes deep into why traditional visibility-focused security is no longer enough. Modern attackers increasingly use valid credentials, legitimate tools, automation, and faster attack paths. With AI, the challenge becomes even more serious because attacks can happen with greater speed, scale, and depth.In this episode, we discuss:* How CISOs should evolve their security programs for AI threats* Why architecture must come before governance* Why organizations must map digital assets to business impact* How AI changes the speed, scale, and complexity of attacks* Why identity is becoming one of the biggest attack targets* Why Zero Trust needs practical implementation, not just discussion* The role of enhanced identity governance* How micro-segmentation reduces blast radius* Why software-defined perimeters matter in modern defense* Why AI agents need the same access controls as human users* Why proactive governance must monitor ongoing access, not only initial approval* How CISOs should think about resilience before a breach happens* Why incident learnings must feed back into architecture and governance improvementAgni also explains why many organizations struggle with AI security because they do not fully understand their business problems, data flows, access paths, and architectural weaknesses.This episode is highly useful for CISOs, security leaders, enterprise architects, GRC professionals, cyber risk managers, IAM professionals, SOC leaders, AI governance teams, and board-level cybersecurity stakeholders.The key message from this conversation is simple:Before AI governance can succeed, enterprise architecture must be understood, controlled, and resilient.Watch the full episode and comment below:What should CISOs fix first in the AI era — architecture, identity, governance, or resilience?Subscribe for more CISO Masterclass episodes, AI security discussions, cybersecurity leadership insights, GRC content, and practical enterprise security conversations.#aisecurity #ciso #infose #aigovernance

In many organizations, OT security is still discussed at a very high level. But when we go into the real world, the challenge is different:How do we actually assess cyber risk in an OT environment where safety, uptime, legacy systems, plant operations, and business impact all come together?

In this session, Sajath walked through a very practical approach to OT cybersecurity risk assessment — not just theory, but how to think through:OT asset identificationBusiness and operational impactThreat scenariosVulnerability and exposureLikelihood and impact scoringRisk matrix creationSafety and reputational impactControl prioritizationPractical documentation for decision-makingWhat I really liked about this discussion was the focus on practical risk thinking.OT cybersecurity is not only about firewalls, segmentation, or compliance checklists. It is about understanding what can stop operations, affect safety, damage reputation, or create real business disruption.A big thank you to Sajath Sathar for sharing his experience and making the session highly practical for learners and professionals Shivhttps://www.youtube.com/watch?v=qjJvK7nB3VI&t=1047s&pp=ygURT1QgU0VDVVJJVFkgUFJBQkg%3DOT Security Program with Manjunathhttps://www.youtube.com/watch?v=nSyAmYgtWeg&t=340s&pp=ygURT1QgU0VDVVJJVFkgUFJBQkg%3DHow to Build OT Security https://www.youtube.com/watch?v=XDA0QGC1W_s&t=3s&pp=ygURT1QgU0VDVVJJVFkgUFJBQkg%3D#OTSecurity #ICSSecurity #CyberSecurity #RiskAssessment #IEC62443 #GRC #IndustrialCyberSecurity #Podcast #PrabhNair #InfosecTrain

In this special cybersecurity podcast episode, Prabh interviews Sarang, a seasoned cybersecurity expert popularly known as “Cyber Insane,” to discuss practical red teaming, enterprise attack simulations, web application security, and real-world attack kill chain thinking.

https://www.linkedin.com/in/sarang-tumne-cyber-insane-a1681827/https://m.youtube.com/@redteamgarage-rtg?ra=m📚 RTG – Practical Red Teaming Book copies are now available!✅ Physical Book: ₹899 (Free delivery across India)✅ PDF Copy: ₹499 (Instant download)🎁 Special for Prabh’s community: Get 15% OFF using coupon code: RTG15📩 DM for physical and PDF copies at +91 9137495772📖 Amazon Kindle Edition (₹499):https://amzn.in/d/0bvHeFaM📖 Google Books Edition (₹499):https://books.google.co.in/books/about/Practical_Red_Teaming_Field_Tested_Strat.html?id=4L_rEAAAQBAJ&redir_esc=y⚠️ Coupon code is applicable only for physical/PDF copies and not for Kindle or Google Books editionsThis session goes beyond theory. Sarang explains how red teamers think, how enterprise attacks are planned, and why organizations must go beyond basic vulnerability scanning and traditional penetration testing.

Are you interested in bug bounty hunting but confused about where to start?In this podcast session, Prabh speaks with Monish about the real beginner roadmap for learning bug bounty, web security, XSS, SQL injection, Burp Suite, vulnerability reporting, and practical web application testing.This session is designed for beginners who want to learn bug bounty the right way. Instead of directly jumping into advanced tools and random payloads, Monish explains why every beginner must first understand how websites actually work.Before you start hunting bugs, you need to understand the basics of HTML, CSS, JavaScript, HTTP requests and responses, cookies, browser developer tools, frontend logic, backend logic, databases, authentication, sessions, and website technology stacks.Monish explains how these foundations help you understand real vulnerabilities like Cross-Site Scripting XSS, SQL Injection, misconfigurations, broken access control, and other common web security issues.The discussion also covers how beginners can use platforms like W3Schools, Juice Shop, OWASP practice labs, PortSwigger Web Security Academy, TryHackMe, Hack The Box, HackTricks, and Burp Suite to build practical skills in a safe and legal way.One of the most important parts of this episode is the discussion on why many bug bounty reports get rejected. Monish explains common mistakes such as submitting duplicate vulnerabilities, depending only on automated scanners, using AI without understanding the finding, missing business impact, weak proof of concept, and losing patience too early.This video is useful for cybersecurity beginners, bug bounty learners, web security students, ethical hacking aspirants, penetration testing beginners, college students interested in cybersecurity, and anyone who wants to learn bug bounty legally and practically.Bug bounty is not about randomly running tools. It is about understanding applications, finding real security impact, documenting evidence properly, and reporting vulnerabilities responsibly.Watch the full session and comment below with the next bug bounty topic you want Monish and Prabh to cover.Subscribe for more practical cybersecurity podcasts, bug bounty learning, ethical hacking guidance, web security training, SOC content, GRC insights, and real-world career advice#BugBounty #EthicalHacking #WebSecurity #CyberSecurity #PenetrationTesting

Are you preparing for CISSP 2026 and wondering how AI security, AI governance, responsible AI, privacy, and model attacks can be tested in the exam?In this video, we break down important CISSP-style AI questions in a practical and exam-focused way. Instead of memorizing definitions, you will learn how to think like a CISSP candidate when facing scenario-based questions on AI systems, governance, risk management, security controls, privacy, and third-party AI platforms.AI is no longer just a technology topic. For CISSP candidates, AI connects directly with Security and Risk Management, Asset Security, Security Architecture, Security Operations, Identity and Access Management, Software Development Security, and Third-Party Risk Management.In this session, we cover AI governance, responsible AI, ethical AI, shadow AI, model poisoning, model inversion, membership inference, prompt injection, differential privacy, AI-SBOM, model cards, AI vendor risk, AI monitoring, risk appetite, risk tolerance, SOC, SIEM, SOAR, and AI security control selection. This video is useful for CISSP 2026 candidates, cybersecurity professionals, GRC professionals, SOC analysts, security managers, risk managers, and AI governance learners who want to understand how AI-related security topics may appear in scenario-based CISSP questions.Watch the full video and try answering each question before checking the explanation. That is how you build CISSP-level judgment.Subscribe for more CISSP exam preparation, cybersecurity concepts, AI security topics, and practical scenario-based questions.CISSP 2026 Coffee Shotshttps://www.youtube.com/watch?v=1krYtSQbMWc&list=PL0hT6hgexlYxKzBmiCD6SXW0qO5ucFO-J&pp=sAgCCISSP Spotify Podcast Domain 1 to Domain 7Domain 1 : https://open.spotify.com/episode/6fggB2lwYA5kzmdmz7BsCh?si=ff488838799b4baeDomain 2 = https://open.spotify.com/episode/4RkQIHgpTUC87TR3UqmkHd?si=ca4f12aea1dc473aDomain 3 = https://open.spotify.com/episode/1b59qRq9vk0hvfa0UiqRm1?si=5f9da0b4cf6545d6Domain 3 Part 2 = https://open.spotify.com/episode/4ncdZBhZEtPCZQYzbLi03m?si=041114030f904c21Domain 3 Part 3 = https://open.spotify.com/episode/3F1S1M8PzVdWMt4egBKFR2?si=dfcdb502cc8049afDomain 4 Part 1 = https://open.spotify.com/episode/6yRGRfpK51II7Od438imNA?si=f94c058f77854f5eDomain 4 Part 2 = https://open.spotify.com/episode/2b3Z8hFII1ypWcVMjqBQlC?si=a16dfb96da6a4addDomain 5 : https://open.spotify.com/episode/1ouhqFPycKwBqMYAF9v4rO?si=u-I7VHQ7Q0CjGmOPfelnSwDomain 6 https://open.spotify.com/episode/0SjIzz6eWO1YKvMg5MVpVK?si=b6980db1afce41a2Domain 7 : https://open.spotify.com/episode/2Ov3RXtw8XMq5R1jJL3o5X?si=2e1bb4ce50fa4516#cisspexam #cissp2026 #CISSP #CISSP2026 #AISecurity #Cybersecurity #aigovernance

Critical infrastructure may not always be directly attacked.Sometimes, the real risk comes from vendors, contractors, suppliers, hosting providers, exposed credentials, weak access controls, and data leaked through third-party ecosystems.In this podcast episode, Prabh speaks with Rakesh Krishnan, a threat intelligence researcher, about the Kudankulam Nuclear Power Plant-related data exposure discovered on a dark web data leak site operated by the ransomware group World Leaks.00:00 - 01:04 – Highlights01:04 - 02:54 - Introduction, Guest welcome, his credentials and Agenda02:54 – 04:29 - Discovery of the Breach04:29 – 11:16 - Research Motivation and Initial Investigation11:16 – 13:13 - Risk Assessment of Sensitive Data Leaks13:13 – 15:38 - Technical Analysis and Breach Patterns15:38 – 18:26 - Adversary Attack Life Cycles18:26 – 21:47 - Global Threat Landscape and APT Rankings21:47 – 23:10 - Identifying Nationally Sensitive Data23:10 – 28:06 - Geopolitical Data Logic and Intelligence28:06 – 30:35 - Vendor Security and Leadership Lessons30:35 – 35:45 - Offensive Perspective on Data Classification35:45 – 39:12 - Evolution of Ransomware Tactics39:12 – 44:42 - CISO Incident Response and Negotiation44:42 – 48:06 - Technical Rapid Fire48:06 – 49:40 - End of the conversation by thanking Rakesh Krishnan and looking forward to doing more Podcast.The discussion explains that this was not described as a direct attack on Kudankulam Nuclear Power Plant. Instead, sensitive KKNP-related documents were discovered inside a leaked dataset connected to One of the MNC infrastructure data hosted through a third-party data center.This case is important for every CISO, SOC analyst, threat intelligence team, GRC professional, vendor risk manager, and critical infrastructure stakeholder.Why?Because attackers do not always need to breach the main organization directly.They can study leaked vendor records, engineering drawings, supplier layouts, technical specifications, financial documents, and email records to understand the ecosystem around critical infrastructure.Twitter https://x.com/RakeshKrish12Linkedin Profilehttps://www.linkedin.com/in/rakesh-krishnan-6179a94b/Detailed Bloghttps://theravenfile.com/2026/07/17/kudankulam-nuclear-power-plant-leak-an-accidental-disclosure/In this episode, we discuss:- What was discovered in the Kudankulam-related data exposure- Why the incident points toward third-party and vendor ecosystem risk- How ransomware data leak sites operate- How double extortion works- Why exposed engineering drawings and technical records are dangerous- Why compliance does not always mean security- Why critical infrastructure defenders must monitor dark web leak sites- How attackers weaponize leaked supplier and vendor information- Why no data should be considered useless- How data classification must include business, regulated, and operational data- Why CISOs must investigate exposed VPN, RDP, credential, and access patterns- Why ransomware and data-extortion-only cases must be separated during investigation- How insider threat and credential compromise affect critical infrastructure security- What SOC teams should monitor after dark web exposure- Why vendor vetting must go beyond reputation and compliance certificates- What India’s critical infrastructure ecosystem can learn from this caseWhat should organizations improve first — dark web monitoring, vendor risk assessment, data classification, or SOC detection?#kudankulam #Kudankulamdatabreach #Kudankulamsec

Want to understand how to implement ISO 27701 properly and turn privacy compliance into a working system? In this podcast, we break down the practical implementation of ISO 27701, explain how it relates to ISO 27001, and show how organizations can build a real Privacy Information Management System (PIMS) instead of treating privacy as a one-time compliance exercise.This session covers the structure of ISO 27701, the role of privacy principles, the difference between controllers and processors, and the real steps involved in operationalizing privacy controls across people, process, and technology. It also explores key implementation areas such as data processing assessments, records of processing activity, consent management, privacy impact assessments, vendor risk assessments, cross-border data transfers, training, privacy champions, and continuous monitoring.In this video, you’ll learn:What ISO 27701 is and why it mattersHow ISO 27701 extends ISO 27001 for privacy risk managementThe difference between data controllers and data processorsHow to start a practical PIMS implementationWhy records of processing activity are essentialHow to map privacy controls to regulations like GDPR and DPDPAHow to handle privacy impact assessments and vendor riskWhy privacy implementation takes months, not weeksHow privacy champions, training, and continuous monitoring support long-term complianceThis episode is useful for:privacy professionalsDPOsCISOscompliance leadersGRC teamsISO 27001 practitionersconsultants implementing privacy frameworksWhether you are starting an ISO 27701 implementation, improving your privacy governance model, or trying to align privacy operations with ISO 27001, this discussion gives you a practical roadmap.Data Privacy Professional Videohttps://www.youtube.com/watch?v=76fcelayw00&t=1734s&pp=ygUSZGF0YSBwcml2YWN5IHByYWJo0gcJCQQLAYcqIYzvInterview Serieshttps://www.youtube.com/watch?v=ugHmTNup-ys&list=PL0hT6hgexlYynj0FOvrGCPfiWZFRkMJx4&pp=sAgCGDPR Implementationhttps://www.youtube.com/watch?v=Pf_qQxeubIg&pp=ygUKZ2RwciBwcmFiaA%3D%3DPDPL Implementationhttps://www.youtube.com/watch?v=SgvOkRZgrd0&t=1338s&pp=ygUSZGF0YSBwcml2YWN5IHByYWJoSubscribe for more content on ISO 27701, privacy management, GDPR, data protection, information security governance, and compliance implementation#dataprivacy #iso27701 #cybersecurity #dataprivacyday

Are LLMs and AI apps really secure? In this podcast, we break down LLM security, prompt injection, LLM penetration testing, and the real vulnerabilities attackers look for when testing AI systems. From reconnaissance and enumeration to payload manipulation and lab-based exploitation, this session shows how traditional web application security testing differs from LLM security testing in real-world environments.Youtube : https://m.youtube.com/@darshanhackzInstagram : https://www.instagram.com/darshanhackzX : https://x.com/darshanhackzSecurity researcher Darshan Naik joins the discussion to explain common LLM vulnerabilities such as prompt injection, hallucinations, excessive agency, information disclosure, insecure integrations, and API misuse. The session also explores how weak validation, poor segmentation, and insecure AI workflows can expose sensitive data or create paths to unauthorized access. Practical examples and lab walkthroughs make the concepts easy to understand for both security professionals and learners.In this video, you’ll learn:How LLM penetration testing is different from traditional web app pentestingHow attackers identify whether a target is using a real LLM or static AIWhat prompt injection looks like in practiceWhy hallucinations, insecure permissions, and excessive agency create riskHow API integrations and AI agents can increase the attack surfaceWhy validation, segmentation, and secure implementation matterHow to use labs and practical exercises to improve AI security testing skillsWhat defenders should do to reduce LLM security vulnerabilitiesThis episode is useful for:penetration testersbug bounty huntersAI security researchersAppSec professionalsred teamersdevelopers building LLM applicationssecurity leaders exploring AI riskWhether you are testing AI chatbots, reviewing LLM security posture, or learning how modern attackers abuse AI systems, this conversation gives you a practical starting point.Subscribe for more content on AI security, LLM hacking, prompt injection, penetration testing, AppSec, and cybersecurity research.GEN AI Securityhttps://www.youtube.com/watch?v=aTJPKifa1VM&t=489s&pp=ygUPZ2VuIGFpIHNlY3VyaXR5#LLMSecurity #PromptInjection #AISecurity #Pentesting #CyberSecurity

AI governance is no longer optional. In this podcast, we break down a practical 5-step AI governance framework for managing high-risk AI systems from intake and inventory to risk assessment, documentation, vendor review, and continuous monitoring.Using a fictional HR hiring model at a multinational financial institution, this session explains how organizations can build a real-world AI governance process that addresses bias, compliance, privacy, vendor risk, model drift, and regulatory expectations. We also explore how governance teams can align AI systems with business objectives, legal obligations, and frameworks such as the EU AI Act, GDPR, and the NIST AI Risk Management Framework.What you’ll learn in this video:How to create an AI governance intake processWhy AI inventory and system classification matterHow to assess data lineage, bias, and privacy risksWhat to check in AI vendor and third-party risk assessmentsHow to perform AI risk assessments for high-risk systemsWhy model cards, documentation, and audit readiness are essentialHow to implement continuous monitoring for drift, fairness, and performanceKey governance challenges when deploying AI in regulated industriesThis episode is especially useful for:AI governance professionalsrisk and compliance teamsCISOs and security leadersprivacy professionalsdata governance teamsinternal auditorsorganizations deploying high-risk AI systemsWhether you are building an AI governance framework, preparing for AI compliance, or trying to manage AI risk in enterprise environments, this conversation offers a practical roadmap you can apply.Other Videos on AI Governacehttps://www.youtube.com/watch?v=mDuqzICOZZI&t=11shttps://www.youtube.com/watch?v=PT7xmnn8FFIhttps://www.youtube.com/watch?v=OhxAdrfHVs8https://www.youtube.com/watch?v=i721IZkpG8I&t=423shttps://youtu.be/skJNr6C6O18?si=itgrpjoY9viovfL6https://www.youtube.com/watch?v=dQUML9vnlY4&t=3180shttps://www.youtube.com/watch?v=LgFBi5XD-Ow&t=5668sSubscribe for more content on AI governance, cybersecurity, privacy, compliance, risk management, and emerging technology frameworks.#AIGovernance #AIRiskManagement #EUAIAct #GDPR #AICompliance