Security Weekly Podcast Network (Audio)

How to Navigate Shadow AI Risk in the enterprise

This week, we discuss AI governance in the enterprise, starting with the nuts and bolts of how to discover and understand shadow AI. Following that, we dive into what security and tech leaders should do next with this information: apply guardrails? Limit vendor options?

Ankita has a wealth of experience and anecdotes to share here, from years of working with customers and seeing all the unexpected things that happen with AI in today's workplace.

Segment Resources:

• Website: https://www.akto.io
• Book a Free Demo: https://www.akto.io/agentic-security-demo
• LinkedIn: https://www.linkedin.com/company/akto-io
• YouTube: https://www.youtube.com/@aktodotio

This segment is sponsored by Akto. Visit https://securityweekly.com/akto to secure your AI agents before attackers do.

The same team that delivers the DBIR every year gave us a bonus, based on over 70,000 insurance claims!

Some of my favorite insights:

• Cost of breaches, broken out by SMB, mid-sized enterprise, and large
• The claim amount as a percentage of the company's revenue
• Losses broken down by loss TYPE

This data validates something I think everyone in cyber needs to understand: cyber events are rarely business-ending events. Every cybersecurity professional and vendor, frustrated by companies "not taking security seriously enough" now have data explaining why: breaches don't hurt as much as you thought they did. Maybe you think they should hurt more? Push for regulation/fines/etc.

With that said, the report also shows breach costs increasing significantly over the past 6 years and the quantity of incidents shooting up. Specifically, the median impact has almost doubled.

Security failures aren't getting any cheaper.

Finally, in the enterprise security news,

1. A $100M seed round!
2. Accenture acquires 3 security vendors
3. Some thoughts on the government takedown of Fable and Mythos
4. One of the craziest security mistakes I’ve ever seen, in the software FIFA uses to manage World Cup streams!
5. A Critical Copilot vulnerability
6. 75,000 Fortinet Firewalls get compromised
7. Remediation is broken
8. Using guardrails to evade detection

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-464

Doug and Rob Allen talk about Identity, EDR, Your Great Aunt Ida Meets some hot firefighters, and more.

Segment Resources:

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools: https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-591

In the security news this week:

• GPS spoofing and satellite jamming are getting way too accessible
• Rekeying satellites in orbit sounds terrifying
• Cyber extortion and whether criminals still have ethics
• AI helping cybersecurity research... and drug discovery
• Data centers eating regional power grids
• Nuclear, solar, natural gas, and the future of AI infrastructure
• What happens when GPS stops being trustworthy?
• Satellite constellations as the next critical infrastructure target
• AI guardrails and why sci-fi warned us first
• Cyber ranges that don't simulate reality anymore
• The weird morality line between hackers, scammers, and criminals
• Future satellite warfare without calling it warfare
• Security standards for infrastructure nobody thought would be online
• Historical cybersecurity stories that suddenly feel very current
• Why AI changes both offense and defense simultaneously
• And how much of modern cyber defense is just educated guessing

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-931

The browser has become the primary gateway to work, data, and AI. In this episode, Arunesh Chandra, Head of Product, Microsoft Edge for Business at Microsoft Edges for Business, will discuss why security and IT teams are rethinking the role of the browser and what sets Edge for Business apart as a secure, enterprise-ready solution. Arunesh cover how built-in security, native integration with existing IT tools, and centralized management can simplify operations, reduce risk, and support modern work across managed devices, BYOD, and contractors. A must listen for IT pros and security experts navigating browser sprawl and AI adoption.

This segment is sponsored by Microsoft Edge for Business. Visit https://securityweekly.com/edgeforbusiness to learn more about them!

In the leadership and communications segment, CISO role changes as cyber-risk appetites in the C-suite grow, AI is exposing the biggest weakness in cybersecurity: We never built a health model. Until now!, 6 Ways Leaders Harness Stress, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-452

TSME, ARCH, Maine, Fable, PANOS, Doug's Grandma, Vienna Sausages, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-590

Agents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But if we're focused on determining whether code is secure, where do we focus our attention on ensuring a secure outcome? Matias Madou talks about the challenges of finding metrics to help answer these questions. We walk through many of the questions we'd like to see answered and our desire to see appsec (finally?) shift out of a find-and-fix mode into a future of secure design.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-387

Safe AI at Scale

AI investment is exploding, yet nearly 90% of enterprise initiatives fail because the data powering AI cannot be trusted. That’s the uncomfortable truth the industry is facing right now. Safe AI at scale requires more than just great models—it demands trusted, governed, and recoverable data.

This segment is sponsored by Veeam. Visit https://securityweekly.com/veeam to learn more about them!

Segment resources:

• Veeam Launches New Data and AI Trust Maturity Model to Help Organizations Benchmark AI Readiness

A special topic segment where we're joined by Albert Estevez Polo, field CTO for Zero Networks (a community guest, not a podcast sponsor). Zero Networks just released some very interesting data on what attackers are doing after they gain access to victim's environments and how they're doing it.

Segment Resources:

• Link to report page

Finally, in the enterprise security news,

1. Funding and acquisitions
2. Good news, Mythos isn’t dangerous anymore!
3. An excellent breach analysis
4. Cyber insurance rates are dropping, but there’s a catch
5. CISA updates vulnerability remediation guidance
6. Zoom calls are worse than you think, and maybe not for the reasons you think
7. Remember when it was illegal to rip DVDs?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-463

Bad Phones, Sarlaccs, Maine, Chinese Sites, Ivanti, GreatXML, Bitlocker, Peoplesoft, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-589

In the security news:

• Trolling Microsoft With Vulnerabilities
• Fable 5 loves guardrails
• Binwalk vulnerability
• EMBA and local models
• EDRChoker
• AI worms
• Interesting Arista vulnerability added to KEV
• BOD 26-04 and stakeholder specific vulnerability categorization
• Bring your own execution environment
• Homelab tips
• MikroTik routers as interceptors
• Ivanti Sentry and irony
• Smart TV botnets
• Privacy laws
• Solarwinds Serv-U lives on
• More Cisco SD-WAN fun!
• Russia can jam GPS
• No nudes for you says UK Government
• "Why would someone want to learn code when AI does it better and faster?"

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-930

AI is reshaping innovation as businesses embed it into core operations and move more processes online. This transformation is often seen as a tradeoff between innovation and data risk, but that assumption is wrong. Businesses can innovate and scale in the AI era while maintaining strong data security, ensuring protection, compliance, and control remain intact.

Segment Resources:

• Check out these assets from Fortra for more information around Data Security for AI.
• Learn more about our Data Security suite: https://www.fortra.com/solutions/data-protection
• Get the ungated guide: Secure AI Innovation > https://www.fortra.com/resources/guides/secure-ai-innovation
• Read the blog: Staying Compliant While Using AI: What CISOs Need to Know https://www.fortra.com/blog/staying-compliant-while-using-ai-what-cisos-need-know

This segment is sponsored by Fortra. Visit https://securityweekly.com/fortra to learn more about them!

In the leadership and communications segment, Lost in translation: Cybersecurity board reporting for CISOs, AI may finally unlock the cyber budgets CISOs have wanted for years, How People Actually Get to the C-Suite in S&P 500 Companies, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-451