Security Weekly (Download Only)

To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we expand from there to challenge whether a focus on vulns and patches is even the right choice for an appsec program. Then it's on to incentives, the role of agents in writing and securing software, and what we should be looking for to bring new appsec practitioners into the industry.

Show Notes: https://securityweekly.com/asw-404

The threat landscape is too massive to treat every vulnerability, control gap, and exposure as equally urgent. In this episode, Heather joins us to explore how exposure management is changing the way organizations prioritize and report cyber risk.

Instead of starting with control effectiveness, teams can begin with key risk indicators: What is actually exposed? What threats are real, tangible, and imminent? What could have the greatest business impact?

From there, organizations can tie those risks back to the controls designed to reduce them. It's a shift from asking "Are our controls working?" to "Are we reducing the risks that matter most?"

Segment Resources: https://www.linkedin.com/pulse/from-green-dashboards-real-exposure-security-kri-framework-ceylan-ho2yc/

This is our final episode of the CISO Stories podcast. Thank you to host Jessica Hoffman, to creator & host Todd Fitzgerald, and most of all, to our audience for tuning in.

This segment is sponsored by Tenable. Visit https://cisostoriespodcast.com/tenable to learn more about them!

Show Notes: https://cisostoriespodcast.com/csp-229

Interview with Hadar Krasner, Co-Founder and CPO of Bold Security

This week's interview with Hadar is a fascinating dive into the history of data security and why they chose to tackle endpoint-focused data security. We discuss why securing data is traditionally such a challenging task, making it clear why Bold is such a fitting name for the company. After 30 minutes, we barely scratched the surface and are hoping we can have them back soon for another interview!

Segment Resources:

• https://www.bold.security/blog/endpoint-data-ai-human-risk-convergence
• https://www.bold.security/blog/what-is-real-time-endpoint-data-protection-bold-makes-it-a-reality

This segment is sponsored by Bold Security. Visit https://securityweekly.com/bold-security to learn more about them!

Topic - Don't Let AI Ruin Your Talk

In this week's topic segment, we discuss the emerging epidemic of low-effort AI-generated slides. AI can definitely make slide creation less painful, but you still need to put some effort in to make a good looking deck that makes sense. If you don't, your audience WILL notice.

Enterprise Security News

Finally, in the enterprise security news,

1. we discuss the Sawtooth problem
2. cybersecurity is center stage in AI
3. not everyone is a big fan of passkeys
4. Ross Haleliuk is back with some interesting essays
5. insider threats: sometimes the cybercriminal was inside your organization all along
6. AI can now read your mind
7. and as always, we'll kick off with the vibes

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-480

Airline Zoom Calls, School Picture Day, Windows, TP-Link, AgentCorruption, OSS Scanner, Josh Marpet, and More on this episode of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-623

In the security news this week:

• BPFDoor
• OpenSSH compresses a little too much
• AI can find bugs. Who gets them fixed?
• TP-Link and the courts
• Cisco NX-API
• ClingSTUN
• LineageOS, Android TV, and a Raspberry PI
• Dell's updater has a privilege problem
• SonicWall SSRF
• U-Boot's LogoFAIL like
• Exploit-DB isn't dead
• MFA passes. The attacker still gets in.
• LakeShark and cool gadgets
• Kasa cameras and an exposed debug interface
• SharePoint hardening is back on the checklist
• Google pauses open-source bug bounty submissions
• NetScaler's latest vulnerability needs a closer look
• Kiteworks tells customers to shut it down
• Exchange gets an unexpected security update
• Do LLMs actually reason?
• disagree on AI risk?
• Anthropic, AI consciousness and the Vatican
• Grok gets involved in foreign policy
• WordPress malware that survives cleanup
• Can spyware vendors stop their own tools?
• When an AI chatbot conversation reaches the police
• Open-weight AI models enter the cyber debate
• AI agents take their attacks shopping

Show Notes: https://securityweekly.com/psw-947

Harvest-Now-Decrypt-Later attacks are already in motion. Unmanaged keys and outdated algorithms are active weaknesses within an organization's infrastructure. When quantum decryption arrives, the fallout will be immediate—compliance gaps, lost trust, and financial impact. How should organizations prepare?

Vijay Viswanathan, Vice President of Product at ISARA Corporation, joins Business Security Weekly to discuss quantum safe security. For most organizations, cryptography is hidden, therefore it's risk is hidden or unknown. Vijay will discuss how to prepare for Q day, including the steps that should be taken now:

• Cryptographic discovery and posture analysis
• Executive communication on cryptographic risks
• Mitigation and migration strategies
• Crypto agility for ongoing maintenance

Segment Resources:

https://isara.com/blog-posts/enterprise-buyers-guide-for-quantum-safe-security/?utmsource=podcast&utmmedium=segment-resource&utm_campaign=bsw

This segment is sponsored by ISARA Corporation. Visit https://securityweekly.com/isara to learn more about them!

In the leadership and communications segment, AI Governance Frameworks Won't Save You, but an Ethically Engaged Workforce Might, Cyber Skills Diminish Quicker than Organizations Can Build Readiness, The Mindsets Leaders Need as AI Accelerates the Pace of Business, and more!

Show Notes: https://securityweekly.com/bsw-468

Typing, textGrain, NetScaler again, Fortinet, Copilot, LibreOffice, Dots, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-622

The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approaching new standards, guidelines, and practical deployment patterns to make it easier for orgs to establish more refined and correct access policies. It's a problem that predates LLMs, but also one that agents and MCPs made all the more acute. We talk about what intent means when trying to constrain agents' activities, what role LLMs have in policy decisions, and how LLMs can help create a much-needed inventory of access controls.

Segment Resources:

• https://www.cerbos.dev/blog/dimmer-switch-not-a-kill-switch-rethinking-ai-agent-governance
• https://www.cerbos.dev/blog/multi-hop-delegation-ai-agents
• https://openid.net/wg/authzen/

Show Notes: https://securityweekly.com/asw-403

Interview with Aqsa Taylor

Exaforce's Chief Security Evangelist, Aqsa, joins us to discuss the current state of the AI SOC and why it covers so much more than it did over 2 years ago, when our podcast first started covering this market. Exaforce also recently released AI Security and its ExaGo mobile app - we're very excited about the possibility of analyzing incidents at the grocery store!

This segment is sponsored by Exaforce. Visit https://securityweekly.com/exaforce to learn more about them!

Topic Segment - Regulating AI

The AI industry's sandbox escapes have had a big impact on everyone and unsurprisingly, there's a bill proposing to ban some AI products and pause the development of others.

It seems that, increasingly, as pro-AI and anti-AI groups become more polarized and divided, you could start an entire podcast that does nothing but fact-check both sides. We're an emotional species and it seems the more heated debate gets, the more folks on both sides are willing to straight-up fabricate things to help argue their points.

Today's focus is this YouTube video: https://www.youtube.com/watch?v=WXsTCJl7sU4

It's the most on-the-nose type of propaganda - straight up claiming the government is going to break into your house and take your GPUs and LLMs. Could the bill proposed by Bernie Sanders and Greg Casar be characterized as extreme? Sure, but it's nowhere near as extreme as the title of the video, "They're Banning AI Servers at Home" suggests.

The hardest things to swallow about the video:

1. it characterizes Bernie Sanders as "the government", as if he's representative of most of the US government rather than an outlier that has little to no chance to get a bill like this passed
2. it never mentions the fact that the bill establishes a model cutoff, measured in training effort (10^25 flops, which doesn't include the open weight models you're using at home, unless you have an 8x cluster of DGX Sparks - $40k+ worth of AI compute)

Enterprise News

Finally, in the enterprise security news,

1. we check the vibes
2. massive, connected funding
3. NVIDIA OpenShell
4. cars are still hackable
5. a ransomware arrest turned into a murder investigation
6. AI welfare

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-479

RAM, Muse, CloudSyncD, Springsteen, Who Owns Your Software?, Persistence, Michael Jenkins, CTO of ThreatLocker, and More on this episode of the Security Weekly News.

Segment Resources: https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/swn-621