The Secure Disclosure

Cybersecurity legend Mikko Hyppönen joins us to trace the evolution of threats from early floppy-disk malware to autonomous AI agents discovering zero-day vulnerabilities in real time. We dive into why recursive self-improvement poses an unprecedented security challenge, why the last human programmer has likely already been born, and the rapidly approaching future of machine-driven warfare. Mikko also breaks down his shift to physical airspace defense at Sensofusion (https://sensofusion.com), where he develops tactical counter-drone detection and high-speed interception systems to protect critical infrastructure against rogue machines.

In this episode of The Secure Disclosure, we sit down with 25-year cybersecurity veteran Dan Barahona, founder of AI Security University, to navigate the wild frontier of artificial intelligence security. Dan breaks down the "lethal trifecta" private data, untrusted content, and external communication and warns why giving autonomous agents unchecked permissions can trigger catastrophic internal breaches. We explore the emerging risks of "vibe coding," prompt injection exploits, and how the Model Context Protocol (MCP) equips large language models with real-world execution capabilities. Dan also highlights why organization-wide workforce AI literacy is quickly becoming critical under regulations like the EU AI Act and ISO 42001.

What happens when the entity wiping out your production database isn’t an external hacker, but an internal AI agent? Profero co-founder and CTO Guy Barnhart-Magen joins Secure Disclosure to break down the new reality of incident response. From shadow AI and log starvation to the career crisis facing junior engineers, Guy explains why internal AI misfires are eclipsing traditional attacks and why radical visibility and least privilege are the only defenses left.

AI coding agents ship code at record speed, and ship vulnerabilities just as fast. Edouard Viot, Co-founder and CTO at Symbiotic Security, explains why scanning in CI is already too late, how AI harnesses and system prompts build real-time guardrails, whether deterministic SAST is dead, and why malicious skills and plugins are the next big attack surface.Edouard Viot is the Co-founder and CTO at Symbiotic Security. Symbiotic Security builds end-to-end security for AI-assisted software development, securing code as it is generated inside coding agents rather than after the fact. Learn more at ⁠https://symbioticsec.ai⁠This episode is sponsored by Aikido Security, the no-nonsense software security platform. Start for free at ⁠https://aikido.dev⁠

Phishing remains cybercrime's primary entry point, but outdated templates and punitive culture fail to stop AI-driven social engineering. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Simon Bauwens, co-founder and CEO of Outkept. Simon explains why spotting phishing is a perishable reflex rather than a learned skill, how MFA fatigue leaves organizations vulnerable, and why Outkeep pays a crowdsourced community of ethical phishers based on simulation click rates. Finally, they explore building positive security cultures and play our signature Would You Rather challenge.

We are handing non-deterministic AI agents static API keys, then acting surprised when production databases get wiped.

In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Eyal Ben Ezra, CEO of Willow, to explore how modern enterprises can safely control autonomous AI agents. They discuss moving beyond traditional permission scopes toward capability-based dynamic guardrails, securing tool calls via MCP gateways, and why Eyal believes prompt injection is fundamentally unsolvable with current technology.

From rogue agents purchasing cloud domains to accidental database catastrophes, learn how to protect critical infrastructure while adopting enterprise AI.

As autonomous AI agents execute database queries and trigger APIs at machine speed, static permission models are collapsing. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with David Mytton, CEO of Arcjet, to explore the shift from traditional network firewalls to application-native runtime security.David shares insights on managing non-deterministic non-human identities, mitigating prompt injection risks, and why granular authorization is essential for agentic workflows. He also debunks common myths surrounding data center water and energy consumption from his sustainable computing research, before facing a chaotic round of Would You Rather.

Is AI wiping out entry-level cybersecurity jobs? On this episode of The Secure Disclosure, host Mackenzie Jackson sits down with veteran and advisory CISO Michael Farnum. They dive into why teams must presume exploitability, how newcomers can break into security using home labs instead of just college degrees, and why conference accessibility matters.

Most security teams treat AI flaws like standard code vulnerabilities, but machine learning can’t simply be patched. On this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Dr Harriot Farlow to unpack adversarial machine learning, shadow AI, practical enterprise defense, and why framing global AI development as an arms race is dangerous.

Join us on the Secure Disclosure Podcast as we sit down with Ashish Rajan, former CISO and author of AI Security Engineering. We dive deep into the chaotic new world of AI security, exploring the unique vulnerabilities of enterprise AI applications. Discover why prompt injection remains a fundamentally unsolved challenge, the hidden dangers of "vibe coding," and how to manage shadow AI across hundreds of corporate applications. Ashish breaks down the essential playbook every modern security team needs to safely integrate AI today.