Security Weekly Podcast Network (Video)

Josh Marpet and Doug White talk about AI Ethics, Issues, and Compliance. AI Trolley problems, Rhode Island Drivers, and Post Conventionalism.

Show Notes: https://securityweekly.com/swn-509

In the secure news:

• Automakers respond to Flipper Zero attacks
• More on the unconfirmed Elastic EDR 0-Day
• When Secure Boot does its job too well
• Crazy authenitcation bypass
• Hacker ultimatums
• AI Slop
• Impatient hackers
• Linux ISOs are malware
• Attackers love drivers
• Hacking Amazon's Eero, the hard way
• Exploits will continue until security improves
• The Salesloft breach
• TP-Link Zero Days
• US DoD using Russian software?
• The Lasagna DoS attack

Show Notes: https://securityweekly.com/psw-890

The cybersecurity industry is undergoing a consolidation wave that is moving far faster than many realize. This isn't at all about CISOs wanting fewer tools as much as some would like to think - the changes are happening at the macro level. Ross Haleliuk joins BSW to present the most comprehensive illustration ever made of how our industry has consolidated over the past 20 years, showing how 200 companies turned into just 11.

Then we cover our quarterly Security Money segment. The markets are on a high, but the Security Weekly 25 index dips. What's up? We'll dig into the latest earnings and news for both the public and private security markets.

Show Notes: https://securityweekly.com/bsw-411

I talk to Rinoa Poison about scambaiting, identity, and all sorts of things. Check it out.

Show Notes: https://securityweekly.com/swn-508

In this must-see BlackHat 2025 interview, Doug White sits down with Michael Callahan, CMO at Salt Security, for a high-stakes conversation about Agentic AI, Model Context Protocol (MCP) servers, and the massive API security risks reshaping the cyber landscape. Broadcast live from the CyberRisk TV studio at Mandalay Bay, Las Vegas, the discussion pulls back the curtain on how autonomous AI agents and centralized MCP hubs could supercharge productivity—while also opening the door to unprecedented supply chain vulnerabilities. From "shadow MCP servers" to the concept of an "API fabric," Michael explains why these threats are evolving faster than traditional security measures can keep up, and why CISOs need to act before it's too late. Viewers will get rare insight into the parallels between MCP exploitation and DNS poisoning, the hidden dangers of API sprawl, and why this new era of AI-driven communication could become a hacker's dream. Blog: https://salt.security/blog/when-ai-agents-go-rogue-what-youre-missing-in-your-mcp-security Survey Report: https://content.salt.security/AI-Agentic-Survey-2025_LP-AI-Agentic-Survey-2025.html

This segment is sponsored by Salt Security. Visit https://securityweekly.com/saltbh for a free API Attack Surface Assessment!

At Black Hat 2025, live from the Cyber Risk TV studio in Las Vegas, Jackie McGuire sits down with Apiiro Co-Founder & CEO Idan Plotnik to unpack the real-world impact of AI code assistants on application security, developer velocity, and cloud costs. With experience as a former Director of Engineering at Microsoft, Idan dives into what drove him to launch Apiiro — and why 75% of engineers will be using AI assistants by 2028. From 10x more vulnerabilities to skyrocketing API bloat and security blind spots, Idan breaks down research from Fortune 500 companies on how AI is accelerating both innovation and risk.

What you'll learn in this interview:

• Why AI coding tools are increasing code complexity and risk
• The massive cost of unnecessary APIs in cloud environments
• How to automate secure code without slowing down delivery
• Why most CISOs fail to connect security to revenue (and how to fix it)
• How Apiiro's Autofix AI Agent helps organizations auto-fix and auto-govern code risks at scale

This isn't just another AI hype talk. It's a deep dive into the future of secure software delivery — with practical steps for CISOs, CTOs, and security leaders to become true business enablers. Watch till the end to hear how Apiiro is helping Fortune 500s bridge the gap between code, risk, and revenue. Apiiro AutoFix Agent. Built for Enterprise Security: https://youtu.be/f-_zrnqzYsc Deep Dive Demo: https://youtu.be/WnFmMiXiUuM

This segment is sponsored by Apiiro. Be one of the first to see their new AppSec Agent in action at https://securityweekly.com/apiirobh.

Is Your AI Usage a Ticking Time Bomb? In this exclusive Black Hat 2025 interview, Matt Alderman sits down with GitLab CISO Josh Lemos to unpack one of the most pressing questions in tech today: Are executives blindly racing into AI adoption without understanding the risks?

Filmed live at the CyberRisk TV Studio in Las Vegas, this eye-opening conversation dives deep into:

• How AI is being rapidly adopted across enterprises — with or without security buy-in
• Why AI governance is no longer optional — and how to actually implement it
• The truth about agentic AI, automation, and building trust in non-human identities
• The role of frameworks like ISO 42001 in building AI transparency and assurance
• Real-world examples of how teams are using LLMs in development, documentation & compliance

Whether you're a CISO, developer, or business exec — this discussion will reshape how you think about AI governance, security, and adoption strategy in your org. Don't wait until it's too late to understand the risks. The Economics of Software Innovation: $750B+ Opportunity at a Crossroads Report: http://about.gitlab.com/software-innovation-report/

For more information about GitLab and their report, please visit: https://securityweekly.com/gitlabbh

Live from Black Hat 2025 in Las Vegas, Jackie McGuire sits down with Chris Boehm, Field CTO at Zero Networks, for a high-impact conversation on microsegmentation, shadow IT, and why AI still struggles to stop lateral movement. With 15+ years of cybersecurity experience—from Microsoft to SentinelOne—Chris breaks down complex concepts like you're a precocious 8th grader (his words!) and shares real talk on why AI alone won't save your infrastructure. Learn how Zero Networks is finally making microsegmentation frictionless, how summarization is the current AI win, and what red flags to look for when evaluating AI-infused security tools. If you're a CISO, dev, or just trying to stay ahead of cloud threats—this one's for you.

This segment is sponsored by Zero Networks. Visit https://securityweekly.com/zerobh to learn more about them!

Show Notes: https://securityweekly.com/asw-346

In this episode, Dave Lewis from 1Password discusses the critical importance of security in mergers and acquisitions, from due diligence through integration. He explores common pitfalls, essential security assessments, and practical strategies for security leaders to protect organizational value throughout the M&A process.

Every industry concerned with safety has a process for publishing the details of accidents, incidents, and failures. Cybersecurity has yet to reach this milestone, and hiding the details of failures is holding us back. This talk will argue for the need for breach details to go public, and share strategies for finding and using some little-known sources of detailed breach data.

Finally, in the enterprise security news,

1. A funding, a few acquisitions, and an IPO for the first time in forever!
2. Attackers are really actually starting to use AI now
3. Some researcher spent all of August poking holes in all the AI tools
4. Someone got Microsoft Copilot to be an accomplice in a coverup
5. Microsoft is making a big change in Azure that will probably break some stuff
6. No, Flipper Zero can't help you steal your car (just the stuff in it)
7. Domain names are free to register now, maybe?
8. Disgruntled former employee goes to jail
9. AI tricked into doing more bad things

All that and more, on this episode of Enterprise Security Weekly.

This segment is sponsored by 1Password. Visit https://securityweekly.com/1password to learn more about them!

Show Notes: https://securityweekly.com/esw-422

Porn bombing the celestial zoom room and Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-507

Rob Allen joins us to discuss the importance of security research teams, and some cool stuff they've worked on. Then, in the Security News:

• Flipper Zero, unlocking cars: The saga continues
• The one where they stole the vulnerabilities
• ESP32 Bus Pirates
• AI will weaponize everything, maybe
• What are in-the-wild exploits?
• Docker and security boundaries, and other such lies
• AI-powered ransomeware
• BadCAM, BadUSB, and novel defenses
• 5G sniffers
• Jeff breaks down all the breach reports
• AI in your browser is a bad idea
• And How to rob a hotel - a nod to the way hacking used to be

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/psw-889

Securing top-tier cybersecurity leadership is not just a necessity but a significant challenge, especially when working within budget constraints. Should you hire a full-time CISO or outsource to a vCISO provider?

Brian Haugli, CEO at SideChannel, joins BSW to discuss how organizations can hire a Virtual CISO (vCISO) to benefit from their expertise without the costs and resource requirements of a full-time hire. Brian will share:

• Current vCISO trends
• What to look for in vCISO services
• Who fits/doesn't fit as a vCISO

vCISOs can be an effective solution for organizations that need to enhance their security program or respond to a breach, but know what to look for. If you're in the market for vCISO services or want to become a vCISO, don't miss this interview.

In the leadership and communications segment, Boards should bear ultimate responsibility for cybersecurity, From WannaCry to AI: How CISOs Became Strategic Leaders, The Best Leaders Edit What They Say Before They Say It, and more!

Show Notes: https://securityweekly.com/bsw-410

Naughty RBG, Docker, RDP, SBOMS, Kullback-Leibler, Oneflip, Youtube, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-506