Security Weekly (Download Only)

AI is reshaping innovation as businesses embed it into core operations and move more processes online. This transformation is often seen as a tradeoff between innovation and data risk, but that assumption is wrong. Businesses can innovate and scale in the AI era while maintaining strong data security, ensuring protection, compliance, and control remain intact.

Segment Resources:

• Check out these assets from Fortra for more information around Data Security for AI.
• Learn more about our Data Security suite: https://www.fortra.com/solutions/data-protection
• Get the ungated guide: Secure AI Innovation > https://www.fortra.com/resources/guides/secure-ai-innovation
• Read the blog: Staying Compliant While Using AI: What CISOs Need to Know https://www.fortra.com/blog/staying-compliant-while-using-ai-what-cisos-need-know

This segment is sponsored by Fortra. Visit https://securityweekly.com/fortra to learn more about them!

In the leadership and communications segment, Lost in translation: Cybersecurity board reporting for CISOs, AI may finally unlock the cyber budgets CISOs have wanted for years, How People Actually Get to the C-Suite in S&P 500 Companies, and more!

Show Notes: https://securityweekly.com/bsw-451

Geinbot, SolarWinds, Brave, UNK_Deaddrop, durabletask, Insta, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-588

Most AppSec teams are working through more findings than their teams can validate. SAST surfaces thousands of potential issues. DAST generates alert volume that outpaces triage capacity. Somewhere in that output are the vulnerabilities that matter, the ones that are actually exploitable in production. This conversation explores why automated testing often stops short of the hardest part of the job: proving what is real. We dig into how business logic flaws and authorization vulnerabilities get missed by tools that scan without reasoning, what exploit validation looks like at runtime, and how security engineers are shifting toward findings that developers will actually act on.

The segment is sponsored by XBOW. Visit https://securityweekly.com/xbow to see how autonomous AI pentesting delivers expert-quality findings in hours with real exploit validation your team can actually act on.

Show Notes: https://securityweekly.com/asw-386

In this episode, former FBI cyber leader Jason Manar joins us to unpack the state of critical infrastructure security and why small and medium-sized businesses are more connected to it than they realize. From power, telecom, healthcare, finance, and supply chains, Jason explains how hidden dependencies can turn "not our problem" into a business-stopping event. With his FBI perspective and CISO experience, Jason shares what organizations should understand about risk, resilience, and protecting the systems we all quietly rely on.

Show Notes: https://cisostoriespodcast.com/csp-225

Interview with Filip Stojkovski on the State of AI in SecOps

Filip joins us to talk through the 2+ year rollercoaster that Security Operations tooling has been on since AI entered the chat. We discuss the AI SecOps market, which Filip closely tracks through his SecOps Unpacked project. We also discuss how most of the market has traditionally been focused on the "middle" of the process, which is effectively alert management. Where the conversation really gets interesting is shifting left to discuss building better quality detections.

Segment Resources:

• Be sure to check out SecOps Unpacked - it has more than just vendor information: there are articles, frameworks, podcast episodes, research, and articles/thought leadership

Topic: The Unintended Consequences of Vulnmaxxing

We discuss my latest blog post where I share a theory that perhaps Project Glasswing is a clever exclusive freemium tier, where Anthropic is hoping to ensnare the world's largest producers of software into using its most expensive model to fix their code for the foreseeable future, creating a much needed new revenue stream for the AI giant with a Trillion dollar valuation.

There are some potential unintended consequences that come along with an expensive vulnerability discovery/remediation process that threatens to raise the security poverty line and leave less wealthy companies behind.

The Weekly Enterprise News

Finally, in the enterprise security news,

1. If you were starting a cybersecurity company today, which category would you pick?
2. layoffs
3. funding
4. the White House AI executive order
5. OpenAI's frontier governance framework
6. Anthropic's Zero Trust for AI agents guide
7. IBM's vulnmaxxing efforts
8. RICO as a service for job seekers
9. Instagram had possibly the most embarrassing hack ever

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-462

Local AI, Salesforce, Fluttershell, Aspose, http/2 bomb, Passwords, Cisco, Used Tech, Josh Marpet, and More on this episode of the Security Weekly News

Show Notes: https://securityweekly.com/swn-587

This week in the security news:

• Security Researchers Are Threat Actors according to Microsoft
• Hands-free malicious firmware
• If you've ever typed "ls" in Windows, this is for you
• Cisco makes more patches, wants you to pay
• Ambiguous Secure Boot bypass
• Threat actors love network edge devices, and I have the chat logs and leaks to prove it
• The downside of chip sanctions
• Your VoIP phone is hacked
• Vulnerability disclosure and incentives
• Claude reccovers Bitcoin wallet
• an Instagram "Exploit"
• Turn the plane around
• The worms will continue
• PAN-OS global protect vulnerability
• The 1-Click Github token stealer
• Data-nuking prompt injection
• Turning Buses into spies
• SymJack
• NIST NVD mistakes, and how CNAs need to up their game

Show Notes: https://securityweekly.com/psw-929

The ultimate goal, scale a company to $100M and go IPO. Easier said than done. We've seen some make it and others that get stuck. What's he difference?

Joshua Gould, CEO at thebigword, joins Business Security Weekly to discuss how to scale to $100M. From startup to platform, Joshua helps us understand the challenges and how to address them. If you're a founder looking to scale, this is an interview you can't miss.

Segment Resources:

• https://en-gb.thebigword.com/
• http://www.youtube.com/@Exec_Craft
• https://www.linkedin.com/in/joshuadgould/

In the Security Money segment, the Security Weekly Index and NASDAQ set new records. After CyberArk's acquisition, the Security Weekly Index is now comprised of the following 24 companies:

SAIL Sailpoint Inc PANW Palo Alto Networks Inc CHKP Check Point Software Technologies Ltd RBRK Rubrik Inc GEN Gen Digital Inc FTNT Fortinet Inc AKAM Akamai Technologies Inc FFIV F5 Inc ZS Zscaler Inc OSPN Onespan Inc LDOS Leidos Holdings Inc QLYS Qualys Inc NTSK Netskope Inc TENB Tenable Holdings Inc OKTA Okta Inc S SentinelOne Inc NET Cloudflare Inc CRWD Crowdstrike Holdings Inc NTCT NetScout Systems Inc VRNS Varonis Systems Inc RPD Rapid7 Inc FSLY Fastly Inc RDWR Radware Ltd ATEN A10 Networks Inc

Show Notes: https://securityweekly.com/bsw-450

Heraclitus Unbound, AI LLMs, SSO, TTP, NetLogon, PAN-OS, AI Cost, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-586

We dedicate an episode to catching up on appsec news with Kalyani Pawar. We see parsing problems that led to the BadHost vuln, which exposed lots of LLMs, MCPs, and agents to potential compromise. We wonder where to look for security education and practice as the camaraderie of the CTF community becomes infiltrated by LLMs. We talk about the tradeoffs in trust between using public packages vs. having agents write replacements from scratch. And we examine some of the appsec details that the Verizon DBIR reveals about how orgs are being attacked -- and how orgs might use that information to protect themselves.

Show Notes: https://securityweekly.com/asw-385