Summary

This episode dissects the recent Vercel breach, a supply chain attack involving third-party AI tools, OAuth vulnerabilities, and insider risks. It highlights practical steps organizations can take to enhance cybersecurity and prevent similar incidents.

Key  topics

Supply chain attack involving third-party AI tools
OAuth vulnerabilities and permissions management
Best practices for environment variable security
Incident response and credential rotation strategies

Chapters

00:00 The Vercel Breach: An Overview
05:43 The Supply Chain Attack Unfolds
12:45 The Shift in Cybersecurity Paradigms
19:11 The Importance of Trust in Security

Keywords

cybersecurity, supply chain attack, OAuth, Vercal breach, AI security, cloud security, incident response, third-party risk, environment variables, credential rotation

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the groundbreaking capabilities of Anthropic's Mythos AI model, its implications for cybersecurity, and how defenders can adapt to this new threat landscape. We discuss the model's ability to autonomously identify and exploit vulnerabilities, the strategic responses from industry leaders, and the importance of critical evaluation amidst hype.

Key Topics

• Mythos AI capabilities and evaluations
• Industry responses and strategic implications
• Vulnerability discovery and management in the AI era

Chapters

00:00 The Changing Landscape of Cybersecurity
06:38 The Power of Mythos
13:18 OpenAI's Response and Different Approaches
21:46 Strategic Recommendations for Organizations
27:45 The Future of AI in Cybersecurity

Resources

• Anthropic Cloud Mythos
• GPT-5.4-Cyber by OpenAI
• AI Security Institute - Mythos Evaluation
• Heidy Khlaaf's evaluation

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the critical relationship between identity and access management (IDAM) and holistic Governance, Risk, and Compliance (GRC) programs. Hosted by Santosh, it delves into how integrated identity management enhances security, compliance, and organizational resilience in the digital age.

Key Topics

The connection between identity and GRC
The evolution of IDAM and its role in security
Regulatory frameworks and compliance mapping
Risk management lifecycle and identity risk scoring
Future trends: Zero Trust, AI, decentralized identity

Chapters

00:00 The Importance of GRC and IDAM Integration
02:32 The Holistic Approach to GRC
07:50 The GRC Challenge Landscape
11:21 Defining Identity and Access Management (IDAM)
15:46 How IDAM Enables Governance
18:48 IDAM's Role in Risk Management
22:54 IDAM and Compliance
23:17 Compliance and IDAM: Meeting Regulatory Requirements
27:22 Maturity Levels of IDAM Programs
29:54 Common Pitfalls and How to avoid them
32:42 Key Performance Indicators for GRC and IDAM
35:19 The Future..
37:56 Conclusion: The Central Role of Identity in GRC

Keywords

IDAM, GRC, cybersecurity, identity management, compliance, risk management, zero trust, digital transformation, security architecture

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the core tools in application security - SCA, SAST, and DAST and how they form a comprehensive, shift-left security strategy to protect modern applications from vulnerabilities throughout the development lifecycle.

Key Topics

Shift-left security strategy
SCA (Software Composition Analysis)
SAST (Static Application Security Testing)
DAST (Dynamic Application Security Testing)

Chapters

00:00 Introduction to Application Security
05:08 Understanding SCA: Software Composition Analysis
08:22 Exploring SASD: Static Application Security Testing
13:23 Diving into DAST: Dynamic Application Security Testing
17:37 Integrating Security Tools for Comprehensive Protection
21:31 Conclusion and Key Takeaways

Keywords

#Application Security, #SCA, #SAST, #DAST, #Shift-Left Security, #Cybersecurity, #SoftwareVulnerabilities, #OpenSourceSecurity, #DevSecOps, #SecurityTools

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the recent security breach involving Lite LLM, a popular open-source Python library, and discusses the implications for cybersecurity in AI development. Learn how a trusted tool was exploited, the attack's mechanics, and essential security lessons for organizations.

Key Topics

Supply chain attack on Lite LLM
Multi-stage compromise via CI/CD pipeline
Malicious package injection and persistence
Lessons on dependency pinning and credential rotation
The AI tool chain as a new attack surface

Chapters

00:00 The Importance of Speed and Convenience in AI Development
04:16 The Attack Methodology
10:08 Key Lessons Learned from the Incident

Keywords

cybersecurity, AI security, supply chain attack, open source, LiteLLM, credential theft, DevSecOps, dependency management, zero trust, threat intelligence

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the critical importance of Identity Threat Detection and Response (ITDR) in modern cybersecurity. Hosted by Santosh, it covers how identity infrastructure is the most targeted layer in enterprises, the rise of identity-based attacks, and practical strategies to enhance security posture.

Key Topics

The rise of identity-based attacks and their impact
The three pillars of ITDR: visibility, detection, response
Real-world examples: SolarWinds, MGM, Striker attack
How AI is transforming cyber threats and defenses
Practical steps to assess and improve your identity security

Chapters

00:00 The Reality of Data Breaches
02:29 Understanding Identity Threat Detection and Response (ITDR)
06:58 The Urgency of ITDR in Today's Landscape
10:33 Case Study: Learning from the Striker Attack
13:18 Key Takeaways for Organizations
16:09 Identity as the New Perimeter

Keywords

cybersecurity, ITDR, identity security, data breaches, identity attacks, zero trust, cloud security, breach prevention, cybersecurity strategy

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

This episode explores the March 2026 cyber attack on Stryker Corporation, a leading medical technology company, highlighting the attack's mechanics, motives, and lessons for organizations worldwide. Learn how nation-state actors target critical infrastructure and how to defend against such destructive threats.

Key Topics

• The timeline and impact of the Stryker cyber attack
• The role of nation-state actors and geopolitical motives
• Technical mechanics of the Wiper malware attack
• Lessons learned: privilege management, network segmentation, and threat intelligence
• Practical cybersecurity measures for organizations

Chapters

00:00 The Calm Before the Storm
02:28 Who are Stryker Corporation
04:07 What really happened?
08:36 Understanding the Attacker: Handala
10:15 How did they do it? Technical breakdown
14:15 Lessons Learned from the Stryker Incident
17:51 Some practical best practices
22:47 Closing thoughts

Keywords

cybersecurity, critical infrastructure, nation-state attack, Wiper malware, privilege management, zero trust, threat intelligence, healthcare cybersecurity

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

In this episode of 'Secured by Design', we discuss the root cause for significant Cloudflare outage that occurred on November 18, 2025, which disrupted major internet services and highlighted the fragility of digital infrastructure. The conversation delves into the causes of the outage, its financial impact on businesses, and the lessons learned regarding cybersecurity and infrastructure reliance.

Chapters

00:00 The Financial Impact of the Cloudflare Outage
03:40 The Role of Cloudflare in Internet Infrastructure
07:16 The Technical Failure Behind the Outage
09:54 Security Implications of the Outage
12:00 Learnings and Conclusions

Cloudflare's official explaination of the outage:

https://blog.cloudflare.com/18-november-2025-outage/

#Cloudflare #outage #cybersecurity #digitalinfrastructure #security #internetreliability #digitalreliance

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

In this episode of 'Secured by Design', we delve into Customer Identity and Access Management (CIAM), exploring its significance in enhancing customer experiences while ensuring security and privacy. The discussion highlights the digital experience gap, the differences between CIAM and traditional IAM, and the core concepts that underpin effective CIAM systems. We emphasizes the importance of a seamless customer journey and the future growth potential of CIAM in the digital landscape.

Chapters

00:00 Introduction to Customer Identity Management
05:22 Understanding Customer Identity and Access Management (CIAM)
12:17 Core Concepts of CIAM
17:29 Enhancing Customer Journey with CIAM

#CIAM, #CustomerIdentity #AccessManagement #DigitalExperience #Cybersecurity #Identity Management #BusinessGrowth #security #privacy

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh

Summary

In this episode of Secured by Design, we discuss the growing prevalence of non-human identities (NHIs) in organisations, which outnumber human identities significantly. We highlight the security risks associated with NHIs, including their lack of oversight and the potential for exploitation by attackers. The conversation emphasises the need for organisations to adopt a modern playbook for managing NHIs, especially in light of the increasing integration of AI technologies. We also outline the steps necessary for effective NHI governance, including discovery, classification, and monitoring, to mitigate risks and protect sensitive data.

Chapters

00:00 The Rise of Non-Human Identities
05:13 The Security Blind Spot of NHIs
09:54 The Business Impact of NHI Compromises

#Non-Human Identities #NHI #Cybersecurity #Identity Management #Digital Security #AI Risks  #NHIGovernance #ZeroTrust

Let’s Stay Connected

📧 Email: [email protected]

🔗 LinkedIn: linkedin.com/in/kssantosh