Security Weekly Podcast Network (Video)

The Security Weekly 25 index is back near all time highs as the NASDAQ hits another record high. Funding and acquisitions have shifted to AI as the security industry continues to evolve. We also had a new IPO, Netskope. They will replace CyberArk once the Palo Alto Networks acquisition closes, allowing the index to survive another public company acquisition.

In the leadership and communications segment, Boards Seeking AI Specialists, A CISO's Guide to Navigating the Urgent AI Security Storm, How to Write AI Prompts That Get Results (& Don't Suck), and more!

Show Notes: https://securityweekly.com/bsw-423

Doug talks about AI with Cybersecurity Expert Dr. Shakour Abuzneid from Roger Williams University.

Show Notes: https://securityweekly.com/swn-532

What are your favorite resources for secure code? Co-hosts John Kinsella and Kalyani Pawar talk about the reality of bringing security into a business. We talk about the role of the OWASP Top 10 and the OWASP ASVS in crafting security programs. And balance that with a discussion in what's the best use of everyone's time -- developers and appsec folks alike -- in crafting code that's secure by design rather than just secure from scanner results.

Show Notes: https://securityweekly.com/asw-358

Ravid will discuss why security and engineering misalignment is the biggest barrier to fast, effective remediation, using data from Seemplicity's 2025 Remediation Operations Report. This is costing some teams days of unnecessary exposure, which can lead to major security implications for organizations.

Segment Resources:

• https://seemplicity.io/papers/the-2025-remediation-operations-report/

• https://seemplicity.io/news/seemplicity-releases-2025-remediation-operations-report-91-of-organizations-experience-delays-in-vulnerability-remediation/

• https://seemplicity.io/blog/2025-remediation-operations-report-organizations-still-struggle/

Ex-SC Media journalist Derek Johnson did a great job writing this one up over at Cyberscoop: China's 'autonomous' AI-powered hacking campaign still required a ton of human work

There are a number of interesting questions that have been raised here. Some want more technical details and question the report's conclusions. How automated was it, really?

I found it odd that Anthropic's CEO was on 60 minutes the same week, talking about how dangerous AI is (which is his company's primary and only product).

I think one of the more interesting things to discuss is how Anthropic has based its identity and brand on AI safety. While so many other SaaS companies appear to be doing the bare minimum to stop attacks against their customers, Anthropic is putting significant resources into testing for future threats and discovering active attacks.

Finally, in the enterprise security news,

1. vendor layoffs have started again
2. the sins of security vendor research
3. the pillars of the Internet are burning
4. selling out to North Korea isn't worth what they're paying you
5. ransom payments, in 24 easy installments?
6. a breach handled the right way
7. we probably shouldn't be putting LLMs into kids toys
8. ordering coffee from the terminal

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-434

Emoticons, Sonicwall, Global Protect, Pop-ups, WhatsApp, 7Zip, Roblox, Josh Marpet, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-531

In the security news:

• Cloudflare was down, it was not good
• Logitech breached
• The largest data breach in history?
• Fortinet Fortiweb - the saga continues
• Hacking Linux through your malware scanner, oh the irony
• I never stopped hating systemd
• The ASUS exploit that never existed
• If iRobot fails, can we deploy our own hacker bot army?
• Threat actors deply Claude Code
• Remembering the Viasat hack and why we can't have nice things
• Hacking re-entry sensors
• Sending signals in the wrong direction
• A File Format Uncracked for 20 Years
• And 2026 is the year of the Linux desktop!

Then, high school junior Bryce Owen joins us to discuss how he created the "Space Badge"!

Show Notes: https://securityweekly.com/psw-901

It's a topic we discuss often on Business Security Weekly: CISO Burnout. It's real, but how should you manage it?

Dr. Yonesy Núñez, Global Cybersecurity Executive at Chain Bridge Bank and former Managing Director, Chief Cybersecurity Risk Officer, and Chief Information Security Officer at The Depository Trust & Clearing Corporation (DTCC), joins Business Security Weekly to share his personal insights. An advocate of CISO Health and Wellness, Yonesy will discuss how we can "Optimize the Operator" by creating harmony with mind and spirit.

Segment Resources: https://councils.forbes.com/profile/Yonesy-Nunez-Global-Cybersecurity-Executive-Chain-Bridge-Bank/e79e72a5-4b18-48b1-b5ab-8a0afd47d782

In the leadership and communications segment, CISOs are cracking under pressure, How BISOs enable CISOs to scale security across the business, Great Leaders Empower Strategic Decision-Making Across the Organization, and more!

Show Notes: https://securityweekly.com/bsw-422

Cloudflare, Gh0stRAT, npm, North Korean Employees, Arch Linux Steam Machine, Documentaries, Aaran Leyland, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-530

Secure code should be grounded more in concepts like secure by default and secure by design than by "spot the vuln" thinking. Matias Madou shares his experience in secure coding training and the importance of teaching critical thinking. He also discusses why critical thinking is so closely related to threat modeling and how LLMs can be a tool for helping developers get beyond the superficial advice of, "Think like an attacker."

Show Notes: https://securityweekly.com/asw-357

It's the Year of the (Clandestine) Linux Desktop!

As if EDR evasions weren't enough, attackers are now employing yet another method to hide their presence on enterprise systems: deploying tiny Linux VMs. Attackers are using Hyper-V and/or WSL to deploy tiny (120MB disk space and 256MB memory) Linux VMs to host a custom reverse shell and reverse proxy.

In this segment, we'll discuss strategies and mitigations to battle this novel technique with Rob Allen from Threatlocker.

Segment Resources:

• Pro-Russian Hackers Use Linux VMs to Hide in Windows
• Russian Hackers Abuse Hyper-V to Hide Malware in Linux VMs
• Qilin ransomware abuses WSL to run Linux encryptors in Windows

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

We're entering the age of human-shaped robots, so it seems like a good time to talk about the fact that they ALREADY HAVE CVEs assigned to them. I guess this isn't a terrible thing - John Connor might have had an easier time if he could simply hack the terminators from a distance...

Resources

• https://www.unitree.com/H2 (watch the video!)
• China's humanoid robots get factory jobs as UBTech's model scores US$112 million in orders
• The big reveal: Xpeng founder unzips humanoid robot to prove it's not human
• Exploit Allows for Takeover of Fleets of Unitree Robots - Security researchers find a wormable vulnerability
• 100-page Paper: The Cybersecurity of a Humanoid Robot
• 5-page Paper: Cybersecurity AI: Humanoid Robots as Attack Vectors
• Amazingly, $300 smart vacuums have some of the same exact vulnerabilities and backdoors built into them as the $16,000 humanoid robots! The Day My Smart Vacuum Turned Against Me

Finally, in the enterprise security news,

1. A $435M venture round
2. A $75M seed round
3. a few acquisitions
4. the producer of the movie Half Baked bought a spyware company
5. AI isn't going well, or is it?
6. maybe we just need to adopt it more slowly and deliberately?
7. ad-blockers are enterprise best practices
8. firewalls and VPNs are security risks, according to insurance claims
9. could you power an entire house with disposable vapes?

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-433