Security Mondays with Eva Benn

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. Excited to kick off Season 2 of Security Mondays with the cybersecurity legend Rob T. Lee, the Chief AI Officer and Chief of Research at SANS Institute, a former Air Force officer, founding member of the Air Force's first information warfare unit, former director at Mandiant, and one of the pioneers of digital forensics and incident response.We went deep on what Mythos means for security teams, why AI is compressing the timeline between patch releases and exploitation, and how organizations should rethink vulnerability management in a world where attackers can operate at machine speed. We also explored why security leaders need to normalize uncertainty, invest in talent over tooling, and start preparing for an entirely new cybersecurity playbook.If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Rob: YouTube: https://www.youtube.com/@Rob_T_LeeLinkedIn: https://www.linkedin.com/in/leerob/TikTok: https://www.tiktok.com/@cyber_robbyX: https://x.com/robtleeSubstack: https://robtlee73.substack.com/What you'll walk away with: - The first move from the AI Vulnerability Storm briefing: point agents at your own code, with tools you can run this week (Claude Code Security, Codex Security, OpenAnt, RAPTOR) - What 181 Firefox exploits versus 2 means for your patching SLAs, and why every patch is now an exploit blueprint - The line to use in your next board meeting: “the security program this board has funded is what makes the AI strategy viable” - What to put in front of your board before the EU AI Act takes effect in August 2026 - A minimum viable VulnOps function, plus one Monday action and the Friday check that proves it got done Resources we mention in the video The AI Vulnerability Storm: Building a Mythos-Ready Security Program: https://labs.cloudsecurityalliance.org/mythos-ciso/ Rob's write-up on the briefing: https://robtlee73.substack.com/p/the-mythos-ciso-briefing SANS AI Cybersecurity Summit 2026 (Protocol SIFT demo context): https://www.sans.org/cyber-security-training-events/ai-summit-2026 SANS BugBusters advisory (AI vulnerability discovery, hype vs. reality): https://www.sans.org/mlp/sans-critical-advisory-bugbusters-ai-vulnerability-discovery-hype-vs-reality OpenAnt (Knostic, open source): https://github.com/knostic/OpenAnt RAPTOR (Gadi Evron, open source): https://github.com/gadievron/raptor Find Evil! hackathon: findevil.devpost.com Chapters:Chapters:00:00 — Why Mythos changed the cybersecurity conversation03:30 — The question every CISO is asking right now08:53 — Why security leaders are starting with source code12:01 — The problem AI just made much worse16:08 — The mindset security teams need to abandon22:25 — Where security teams should actually start with AI28:40 — What happens to human analysts in an AI worldWant to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.comP.S. Going to BlackHat? Register here and use EVABENN for $200 Off a Briefings Pass or $100 off a Business Pass.And follow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

If you watch one video on AI security, make it this one.I've summarized the biggest of themes of Season 1 in under 15 minutes for you, that's 10 episodes, 250+ years of combined security leadership experience in 15 mins, leaving you practical guidance you can implement this.After introducing the 10 episodes, add this: 250+ years of experience leaving you practical guidance you can implement this.I just wrapped up Season 1 of Security Mondays.Over the past 10 episodes, I had the privilege of sitting down with some of the brightest minds in AI security and cybersecurity. Different industries. Different experiences. Different perspectives.Yet the same five themes kept coming up again and again.In this episode, I'm bringing those lessons together into one practical recap, along with the actions you can take this week to better secure AI in your organization.A huge thank you to the incredible guests who made Season 1 possible:Chris Cochran – AI governance, Shadow AI, and building practical security programs.Edward Merrett – Visibility into AI adoption, governance, and enabling secure AI use across the business.Sergej Epp – Zero Day Clock, vulnerability management, and why defenders need to move at machine speed.John Sotiropoulos – AI governance, agentic security, and operationalizing AI security programs.Emil Binder Lassen – AIUC-1, AI governance, certification, and secure AI adoption.Rock Lambros – AI red teaming, agent security, and securing enterprise AI.Ken Huang – Threat modeling AI systems with the MAESTRO framework and practical AI security guidance.Ankur Shah – Agentic AI security, prompt injection, MCP risks, and runtime protection.Ross Young – Building resilient security programs and shifting from prevention to runtime security.Eric O'Neill – Counterintelligence lessons for the AI era and why least agency matters for AI agents.Every conversation reinforced one thing:AI is changing cybersecurity faster than anything we've seen before.The organizations that succeed won't be the ones trying to block AI. They'll be the ones learning how to adopt it resist, govern it effectively, and empower their teams to use it responsibly.If you take one thing away from this episode, let it be this:Don't try to do everything at once.Pick one lesson. Put it into practice this week.That's how we roll here.-Thank you for watching, commenting, sharing these episodes with your teams, and being part of the Security Mondays community. Your support has meant the world throughout Season 1.Season 2 is coming soon, and I can't wait to share what's next.Until then, I'll be here every Monday with practical AI security guidance you can turn into action.If you enjoyed this episode, I'd really appreciate it if you subscribed, gave the video a thumbs up, and left a comment below.Going to BlackHat? Register here and use EVABENN for $200 Off a Briefings Pass or $100 off a Business Pass: https://blackhat.com/us-26/registration.html?_mc=sm_social_evabennWant to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.comFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. This week I sat down with Eric O'Neill, the FBI counterintelligence operative who brought down Robert Hanssen, founder of The Georgetown Group and NeXasure AI, and the USA Today bestselling author of Spies, Lies, and Cybercrime. They go deep on what the old counterintelligence playbook teaches security leaders about today's AI-driven attacks, why the hiring pipeline is the new front door, and the boardroom conversation CISOs aren't having yet. Eric founded The Georgetown Group and NeXasure AI. His new book Spies, Lies, and Cybercrime came out from HarperCollins in October 2025 and hit USA Today's bestseller list. We talked about what counterintelligence teaches us about today's threats, including the espionage tradecraft now running at machine speed: AI-generated identities, deepfake interviews, North Korean operators inside U.S. companies, and the surveillance stack that can read a heartbeat through a wall. If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Eric: • LinkedIn: https://www.linkedin.com/in/eric-m-oneill • Website: https://ericoneill.net/ • Newsletter (Spies, Lies & Cybercrime): https://spies-lies-cybercrime.ericoneill.net • X / Twitter: https://twitter.com/eoneill • YouTube: https://www.youtube.com/channel/UCPLsW0-H8dfsx_oQXnTVLJg • Instagram: https://www.instagram.com/ericoneill.official/• NeXasure AI leadership page: https://nexasure.ai/about/leaders/eric-oneill/ Resources we mention in the video The Georgetown Group: https://www.georgetowngroup.com/ Books: Spies, Lies, and Cybercrime (HarperCollins, October 2025): https://ericoneill.net/books/spies_and_lies/ Gray Day (Penguin Random House, 2019): https://ericoneill.net/books/gray-day/ Nisos investigation into DPRK remote worker fraud: https://nisos.com/blog/dprk-remote-worker-fraud-interview/ FBI advisory on North Korean IT worker threats (Jan 2026 update): https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-worker-threats-to-u-s-businesses FBI IC3 2025 Internet Crime Report ($21B in losses): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf Palo Alto Networks on AI agents as insider threats 2026: https://www.theregister.com/2026/01/04/ai_agents_insider_threats_panw/ MICE counterintelligence framework: https://thecyberwire.com/glossary/mice Heart rate detection through walls research (Frontiers in Physiology): https://www.frontiersin.org/journals/physiology/articles/10.3389/fphys.2024.1344221/full Chapters:00:00 — The cyber threat most people still underestimate03:29 — What a spy actually looks like in 202605:38 — The dangerous assumption making companies easy targets07:40 — The espionage playbook every cybercriminal now uses11:08 — A simple framework to stay ahead of attackers12:15 — When one attacker can do the work of an entire team16:30 — Why your employees are the new attack surface20:05 — The spy tactics hiding inside modern cybercrime23:28 — The AI agent mistake that can expose your entire company27:24 — The interview scam fooling companies worldwide37:05 — The hidden industry collecting your personal data39:35 — The conversation every board should be having right nowFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. The average enterprise is running 45 cybersecurity tools. Analysts actively use less than half of them on any given day. Ross Young, who spent over a decade attacking financial services for the federal government at the CIA, NSA, and Federal Reserve Board, says that gap is where most cyber budgets die. Tools get bought during a panic, never get fully deployed, and never get retired. This week, I sat down with Ross Young, co-host of CISO Tradecraft and creator of the OWASP Threat and Safeguard Matrix. We talked about why most cyber budgets are wasted, how to retire dead tools, and how to apply the OWASP Threat and Safeguard Matrix to the AI risks already running in your environment. In this episode, Ross walks through the Murder Board, the four-question test he runs against every tool in a stack to find the ones quietly burning millions. We get into the patching playbook that took one organization from over 300 days to under 30 without a new product. Then we apply the same discipline to AI: the OWASP Threat and Safeguard Matrix for AI threats, what the LiteLLM supply chain attack means for anyone running agents, and the three questions a CISO should hand their team on Monday morning about agentic dependencies. What you'll walk away with: - The four-question Murder Board test to retire any security tool - How to map one AI threat through the OWASP Threat and Safeguard Matrix in under an hour - A patching process review that cut mean time from 300 days to 30 - Three questions to ask your team about agentic supply chain risk this week - Which of CISO Tradecraft's free templates to download first If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Ross: LinkedIn: https://www.linkedin.com/in/mrrossyoung/ Resources we mention in the video: CISO Tradecraft podcast: https://www.cisotradecraft.com/ CISO Tradecraft Newsletter: https://cisotradecraft.substack.com/ Tools, templates, and Ross's work: Free Cybersecurity Templates (TaSM, Murder Board, Cyber 6 Pack, GenAI Risk Assessment, Toil Register): https://www.cisotradecraft.com/freetemplates OWASP Threat and Safeguard Matrix (TaSM): https://owasp.org/www-project-threat-and-safeguard-matrix/ Cybersecurity's Dirty Secret (the book): https://www.amazon.com/Cybersecuritys-Dirty-Secret-Budgets-Tradecraft%C2%AE/dp/B0G26WHVTG "Don't Just Spend It" newsletter post on budget waste: https://cisotradecraft.substack.com/p/dont-just-spend-it-how-to-stop-your Current events and reports referenced: OWASP Top 10 for Agentic Applications 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ LiteLLM supply chain attack (BleepingComputer): https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/ IBM Cost of a Data Breach Report 2025: https://www.ibm.com/reports/data-breach Verizon 2025 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/ Cloud Security Report 2025 (tool sprawl stats): https://www.cybersecurity-insiders.com/cloud-security-report-2025-ciso-priorities-for-securing-the-modern-cloud/ Follow along for more free cybersecurity education. LinkedIn: https://www.linkedin.com/in/evabenn/ Instagram: https://instagram.com/evabenn_ TikTok: https://www.tiktok.com/@evabennofficial Website: https://www.evabenn.com/

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. AI agents are already in most enterprises, with access to email, files, and code. Few security teams can say how many they have or what those agents can reach. The attacks aren't theoretical. Straiker's research team has documented an agentic browser wiping a Google Drive from a single email, a coding agent hijacked just by opening a repository, and a malicious MCP server cloned to push credential-stealing malware into developer machines. This episode is about getting ahead of that. Not a six-month program. The moves a security leader can start this week to see their agents, test them, and contain one if it goes wrong. I'm doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and resources you can go use this week. This week, I sat down with Ankur Shah, Co-Founder and CEO of Straiker. We talked about what actually breaks in production agent deployments, and what security leaders should do about it before an attacker does. What you'll walk away with: - The most common AI security gaps across 500-plus enterprises, and where regulated industries really stand - What the Claude Code source leak means for any team running coding agents - How to get a real count of your AI agents and MCP servers this week - The two or three agent controls missing from a standard LLM security stack - How to run a first AI red-team exercise with your existing team If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Ankur: LinkedIn: linkedin.com/in/ankur-shah-aisec Resources we mention in the video: Straiker: https://www.straiker.ai/Straiker STAR Labs Research: https://www.straiker.ai/researchClaude Code Source Leak: https://www.straiker.ai/blog/claude-code-source-leak-with-great-agency-comes-great-responsibilityNomShub — Cursor remote tunnel breakout: https://www.straiker.ai/blog/nomshub-cursor-remote-tunneling-sandbox-breakout From Inbox to Wipeout — Perplexity Comet: https://www.straiker.ai/blog/from-inbox-to-wipeout-perplexity-comets-ai-browser-quietly-erasing-google-driveSmartLoader clones Oura Ring MCP: https://www.straiker.ai/blog/smartloader-clones-oura-ring-mcp-to-deploy-supply-chain-attackWhy 94% of AI Agents Are Vulnerable to Prompt Injection: https://www.straiker.ai/blog/why-94-of-ai-agents-are-vulnerable-to-prompt-injection----and-what-to-do-about-itOWASP's First Top 10 for Agentic AI: https://www.straiker.ai/blog/owasp-just-released-its-first-top-10-for-agentic-ai-and-heres-what-you-need-to-know10 Hard-Won Lessons Building an AI Security Company: https://www.straiker.ai/blog/10-hard-won-lessons-from-building-an-ai-security-company-in-2025Securing Agentic AI in Banking & Financial Services: https://www.straiker.ai/blog/securing-agentic-ai-in-banking-financial-servicesStraiker named to CB Insights 2026 AI 100: https://www.straiker.ai/blog/straiker-named-to-the-2026-cb-insights-list-of-the-100-most-innovative-artificial-intelligence-startupsAnd follow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Welcome to Security Mondays. I’m Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what’s actually top of mind, the threats they’re seeing, the tools they’re using, and the decisions they’re making right now.Every episode is designed to give you practical things you can go and implement in your organization this week.John Sotiropoulos chairs the OWASP Top 10 for Agentic Applications, the community standard for securing autonomous, tool-using AI.In this episode we get into governance that keeps pace with agents, how to turn the OWASP Agentic Top 10 from a download into an outcome, the shadow AI problem nobody fully sees, and supply chain risk in an agent stack after a March that hit LiteLLM and the Axios npm package back to back.If you find this helpful, I’d appreciate a thumbs up, subscribe, and share. It helps more people find the show.Connect with JohnLinkedIn:https://www.linkedin.com/in/jsotiropoulos/Resources we mention in the videoOWASP GenAI Security Project team page:https://genai.owasp.org/team/john-sotiropoulos/OWASP Top 10 for Agentic Applications (2026). Released December 2025, built with input from 100+ researchers and practitioners.https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/Implementation Guide for the AI Cyber Security Code of Practice, written by John, commissioned by DSIT (UK government). This is the work that fed the ETSI standard.https://assets.publishing.service.gov.uk/media/679cae441d14e76535afb630/Implementation_Guide_for_the_AI_Cyber_Security_Code_of_Practice.pdfUK AI Cyber Security Code of Practice (GOV.UK landing page), the Code itself, published by DSIT, 31 January 2025.https://www.gov.uk/government/publications/ai-cyber-security-code-of-practiceDeepCyber, John’s UK practice working on national-scale AI security in government, healthcare, and finance.https://deepcyber.ai/DeepCyber AI Readiness assessment (Offerings page):https://deepcyber.ai/offerings/Adversarial AI: Attacks, Mitigations and Defense Strategies, John’s book (Packt, 2024). Amazon bestseller in the AI category.https://www.amazon.com/Adversarial-Attacks-Mitigations-Defense-Strategies/dp/1835087981Adversarial AI book, GitHub code repo (companion code, organized by chapter):https://github.com/PacktPublishing/Adversarial-AI---Attacks-Mitigations-and-Defense-StrategiesStandards and frameworks mentioned in the showETSI EN 304 223: first globally applicable European standard for AI cybersecurity, published January 2026. The “European standard” John refers to. 13 principles across 5 lifecycle phases.https://www.etsi.org/newsroom/press-releases/2627-etsi-secures-artificial-intelligence-baseline-cybersecurity-standardETSI TS 104 223: the earlier Technical Specification that the EN builds on. This is the “ETSI lifecycle” / “ETSI baseline security” John tells leaders to slice the Top 10 against.https://www.etsi.org/newsroom/press-releases/2521-etsi-technical-specification-sets-international-benchmark-for-securing-artificial-intelligenceOWASP Agentic Security Initiative resources John mentioned in the showOWASP Agentic Security Initiative hub: landing page for all the agentic guides, including the MCP cheat sheets and the Practical Guide for Securing Agentic Applications.https://genai.owasp.org/initiatives/agentic-security-initiative/OWASP GenAI resources archive:https://genai.owasp.org/resources/A Practical Playbook for Adopting the OWASP Top 10 for Agentic Applications, my 90-day plan for turning the Agentic Top 10 into outcomes.https://youtu.be/MHy118Ei87MAnd follow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Welcome to Security Mondays. I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now.Every episode is designed to give you practical things you can go and implement in your organization this week.So here's what this week is about.The attackers we face today are no longer human. In November last year Anthropic reported a cyber espionage campaign against about 30 organizations that was almost entirely ran by AI. The tools we use to threat model still assume the attacker on the other side is a person.Ken Huang has spent the last year building for the version where it isn't. He created MAESTRO, a seven-layer threat modeling framework for agentic AI that the Cloud Security Alliance published in February 2025. He leads the OWASP AIVSS project, which scores the security risks that are specific to autonomous agents. And he is putting both into the daily workflow of security teams, from CI/CD pipelines to runtime governance.In this episode we go layer by layer through MAESTRO, get into why CVSS can't score agent risk, and land on one concrete thing you can do Monday morning.I'm doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and resources you can go use this week.Resources we mention in the video:• Anthropic full report (PDF):https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf• Ken's deep-dive, Agentic AI in Offensive Security:https://kenhuangus.substack.com/p/agentic-ai-in-offensive-security• The Register coverage of the campaign:https://www.theregister.com/2025/11/13/chinese_spies_claude_attacks/• CSA: Agentic AI Threat Modeling Framework MAESTRO:https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro• Seven-layer agentic AI reference architecture:https://kenhuangus.medium.com/7-layered-agentic-ai-reference-architecture-20276f83b7ee• MAESTRO labs landing page:https://labs.cloudsecurityalliance.org/maestro/• MAESTRO to CI/CD pipeline (with Steven Leath):https://cloudsecurityalliance.org/blog/2026/02/11/applying-maestro-to-real-world-agentic-ai-threat-models-from-framework-to-ci-cd-pipeline• OWASP AIVSS v0.8 release announcement:https://kenhuangus.substack.com/p/owasp-aivss-project-announces-the• AIVSS project home:https://aivss.owasp.org/• AIUC-1 / AIVSS crosswalk:https://aivss.owasp.org/aiuc-aivss-crosswalk• From Oslo to Action, OWASP Agentic Skills Top 10:https://kenhuangus.substack.com/p/from-oslo-to-action-how-the-owasp• DefenseClaw, MAESTRO, and the missing security boundary:https://kenhuangus.substack.com/p/defenseclaw-maestro-and-the-security• DefenseClaw GitHub repo (Cisco AI Defense):https://github.com/cisco-ai-defense/defenseclaw• Securing AI Agents (Springer, Oct 2025):https://books.google.com/books/about/Securing_AI_Agents.html?id=Rx2LEQAAQBAJConnect with KenLinkedIn: https://www.linkedin.com/in/kenhuang8Substack: https://kenhuangus.substack.com/Medium: https://kenhuangus.medium.com/Chapters00:00 – AI Agents Are Already Running Cyber Attacks01:12 – Intro: Why Agentic AI Changes Security Forever04:07 – The Anthropic Attack That Changed Everything08:15 – Why Traditional Threat Models No Longer Work10:32 – Maestro: The New Threat Modeling Framework for AI Agents14:42 – Live Demo: How to Threat Model AI Systems with Maestro22:08 – AI Vulnerability Scoring Explained (AIVSS vs CVSS)28:44 – The New Attack Surface Most Teams Don’t Understand31:05 – OpenClaw, Malicious Skills & AI Supply Chain Risks34:10 – What CISOs Should Do This Week to Prepare for AI Threats

64% of billion-dollar companies have already lost over $1M to AI failures.Emil Binder Lassen, lead behind the AIUC-1 standard, explains why AI agents introduce entirely new security risks from hallucinations and privilege escalation to MCP supply chain attacks and what companies must do before AI incidents become impossible to contain.Resources & Links→ AIUC-1 Standard:https://aiuc-1.com/→ Get AIUC-1 Certified:https://aiuc.com/→ Download the AIUC-1 Requirements Spreadsheet:https://aiuc-1.com/→ Google DeepMind “AI Agent Traps” Paper:https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438→ UiPath AIUC-1 Certification:https://www.uipath.com/newsroom/uipath-achieves-aiuc-1-certification→ Beginner Explainer on AIUC-1:https://www.schellman.com/blog/ai-services/what-is-aiuc-1GUEST LINKS https://www.linkedin.com/in/emilbenderlassen/CHAPTERS00:00 Introduction to AI Agent Security Risks03:18 What Is AIUC-1? (SOC 2 for AI Agents)05:23 How AIUC-1 Certification Actually Works09:32 Biggest AI Failures: Hallucinations, PII Leaks & Privilege Escalation17:16 How AI Agent Red Teaming & Simulations Work18:46 MCP Supply Chain Risks & Third-Party Agent Security21:18 First Steps to Prepare for AIUC-1 Certification25:52 Continuous Monitoring vs Static AI Security31:32 How to Build MCP Governance & VisibilityFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

We used to have a year to patch in 2021. In 2026, 1 day. One hour is projected this year. One minute by 2028. Sergej Epp, creator of the Zero Day Clock, explains why this is happening and what leaders must do before the window closes. RESOURCES Zero Day Clock live dashboard: https://zerodayclock.com Sysdig 2025 Cloud-Native Security Report: https://www.sysdig.com/2025-cloud-native-security-and-usage-report Falco open source runtime threat detection: https://falco.org Sysdig Sage AI cloud security analyst: https://www.sysdig.com/products/sysdig-sage CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog VulnCheck exploit intelligence: https://vulncheck.com GUEST LINKS Sergej Epp LinkedIn: https://www.linkedin.com/in/sergejepp Sysdig: https://www.sysdig.com CHAPTERS00:00 - Exploitation Windows Are Collapsing Fast00:41 - Introducing Sergei and His Background03:24 - What Is Zero Day Clock and Why It Matters07:13 - How Zero Day Clock Was Built09:11 - Walking Through the Zero Day Clock Dashboard12:18 - What CISOs Should Do This Week19:49 - Five Questions to Ask Your Security Team26:20 - How to Present This Data to Your Board29:24 - Is Offense Winning the AI Arms RaceFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Chris Cochran is Field CISO and VP of AI Security at SANS Institute. Before that: Head of Threat Intelligence at Netflix, Mandiant, NSA, U.S. House of Representatives, and active-duty Marine Corps intelligence. Over the past six months he has spoken personally to around 300 security leaders globally about AI security — what they’re doing, what they’re missing, and where the gaps are widest.In this episode, Chris shares the key takeaways from those 300 conversations and gets practical about what security leaders need to do now. We cover four things: why shadow AI is the default condition in most enterprises and what an AI governance council actually does about it; what Anthropic’s research on data poisoning means for your stack (250 samples is enough to poison a model at any size); why vendors who passed your third-party risk review before they added AI are now an open question; and how to think about the line between machine work and human judgment in a SOC that’s trying to adopt AI without skipping steps.Chris also previews the SANS AI Security Maturity Model, his forthcoming ebook, out May 12 — which maps a five-stage path from where most organizations are now to a program that can hold up under the threat picture he describes. Reserve your copy at the link below.SANS AI Security Maturity Model ebook — reserve your copy: https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook?utm_medium=Organic_Social&utm_source=LinkedIn&utm_content=AISMM26&utm_campaign=AI_Security_Maturity_Model_eBook_2026&utm_rdetail=Global&utm_goal=Leads&utm_type=Global_Campaign&utm_term=Chris Cochran — SANS profile: https://www.sans.org/profiles/chris-cochranChris Cochran on LinkedIn: https://www.linkedin.com/in/chrishvm/Hacker Valley Media: https://hackervalley.comOWASP AI Exchange: https://owasp.org/www-project-ai-security-and-privacy-guide/OWASP Agentic Top 10 2026: https://genai.owasp.org/Pentera AI Security & Exposure Benchmark 2026: https://pentera.io/resources/reports/ai-security-exposure-survey-2026/Chapters00:00 – Shadow AI Is Already a Problem (Even If You Don’t See It)00:55 – Intro: Why This Conversation Matters Right Now02:21 – Meet Chris Cochran (AI & Cybersecurity Leader)04:07 – Why Every Company Has a Shadow AI Problem06:40 – What Shadow AI Actually Looks Like Inside Organizations09:27 – The “Calm Before the Storm” in AI Security12:00 – What Leaders Must Fix Before AI Threats Explode15:21 – Why You Can’t Afford to Be an AI Skeptic18:18 – Emerging AI Threats: Data Poisoning & New Attack Vectors23:05 – Where Security Leaders Should Invest Right NowAnd follow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/