The Security Strategist

Cybersecurity has traditionally focused on strengthening corporate networks, cloud systems, and devices. However, in the recent episode of The Security Strategist podcast, Dr. Chris Pierson, Founder and CEO of BlackCloak, and host Richard Stiennon, Chief Research Analyst at IT-Harvest, argue that the most significant vulnerabilities are now outside the office perimeter.

As AI-driven attacks increase and cybercrime combines digital, physical, and reputational risks, executives and their close contacts have become prime targets. Protecting the business now involves protecting executives in their personal lives.

Pierson points out that cybercriminals follow basic economic principles. Attacking a company that spends millions on security is costly and time-consuming. Instead, targeting an executive’s personal life—home networks, private emails, family devices—is cheaper, quicker, and often much more effective.

Executives work in various environments–primary homes, vacation properties, private jets, yachts, and remote offices equipped with smart home technology. Each of these locations broadens an attack surface that traditional corporate security programs rarely address. Home automation systems, private Wi-Fi networks, and personal email accounts have become part of the corporate risk landscape, regardless of whether organisations recognise this.

Pierson notes that taking over personal email accounts continues to be the number one attack method, especially for board members who often revert to personal accounts instead of using corporate options. Once attackers gain access, they can steal intellectual property, intercept financial transactions, or link back into the corporate network. The executive home, he states, is no longer just near the perimeter—it is the perimeter.

The discussion becomes even more pressing when addressing AI-enabled threats. Deepfakes, once a possibility, are now practical tools for fraud and extortion. Pierson spotlights a critical incident in early 2024, when a deepfake impersonation of a CFO allowed attackers to move tens of millions of dollars in one event.

AI has removed much of the background work attackers used to do. Public executive biographies, earnings calls, videos, and high-resolution images provide everything needed to imitate a voice or face. What used to take days to research can now happen in mere seconds. This leads to a rise in hyper-realistic business email scams, payment diversion schemes, and reputational attacks that make it hard to distinguish between truth and lies.

Beyond financial losses, the reputational and personal fallout can be significant. Family members can become collateral damage, private moments can turn into leverage, and the risks to physical safety rise when travel plans and locations become known. As Pierson stresses, digital and physical executive protection are now interconnected.

The podcast message relays–high-level threats require specialized defenses. BlackCloak’s strategy, which Pierson refers to as “Digital Executive Protection,” safeguards a small but vital group: board members, the C-suite, executive leaders, and key personnel like patent holders, system administrators, executive assistants, and chiefs of staff. These individuals hold essential information, and attackers are aware of this.

For security leaders, the question is no longer whether this risk exists, but how quickly they can act to mitigate it. In an age of AI-driven cybercrime, reducing the executive attack surface may be the most crucial security investment an organisation can make.

1. Digital Executive Protection is essential for modern security strategies.
2. AI is changing the landscape of cyber threats significantly.
3. Home networks are increasingly becoming targets for cybercriminals.
4. Reputational risks can affect not just individuals but their families, too.
5. Deepfakes pose a new level of threat to corporate executives.
6. Organisations must consider the personal lives of executives in their security plans.
7. The attack surface for executives is expanding beyond the corporate environment.
8. Cybersecurity must evolve to address the vulnerabilities of home networks.
9. Protecting key personnel is crucial for maintaining corporate integrity.
10. BlackCloak specialises in providing Digital Executive Protection services with concierge support.

1. 00:00 Introduction to Digital Executive Protection
2. 02:53 The Evolving Threat Landscape
3. 06:04 AI's Role in Cybersecurity Threats
4. 09:05 Home Networks as New Battlegrounds
5. 11:54 Reputational and Financial Risks
6. 14:56 Extending Protection Beyond Executives
7. 17:01 Final Thoughts and Recommendations

#DigitalExecutiveProtection #Cybersecurity #ExecutiveProtection #AICyberAttacks #Deepfakes #CyberRisk #HomeSecurity #CISOs #CorporateSecurity #TechPodcast #Cybercrime #BlackCloak

Follow: @EM360Tech on YouTube, LinkedIn and X BlackCloak YT: @blackcloakcyber2494 https://www.linkedin.com/company/blackcloak/ BlackCloak LinkedIn: @BLACKCLOAK BlackCloak X: @BlackCloakCyber

For decades, identity security relied on the assumption that identities are static, predictable, and mostly human. However, the growing scale and complexity of identities in the modern enterprise, as well as the increasing adoption of artificial intelligence has changed that perspective recently. With AI agents multiplying in enterprises, acting independently, appearing and disappearing, and using credentials, the foundations of identity and access management are being tested in ways many organisations are not ready for.

In the recent episode of The Security Strategist podcast, Raz Rotenberg, CEO and Co-Founder of Fabrix Security, sat down with host Richard Stiennon, Chief Research Analyst at IT Harvest.

“Everything we knew about identity is about to change,” Rotenberg cautioned Stiennon. “We’ve viewed identities as mostly static. But AI agents are dynamic. They can do various tasks, change their behaviour, vanish, and reappear. Static identity models won’t survive.”

Identity has always been complex, but the scale and variety of identities that security teams face today are unprecedented. Besides employees and contractors, organisations now deal with service accounts, cloud workloads, APIs, and increasingly, AI-driven agents that function on their own.

According to Rotenberg, the challenge isn't just the number of identities; it's their variability. “The number of ways identities can behave is infinite,” he explained. “Every organisation is unique, every system is distinct, and identities are now changing in real time.”

CISOs already see this explosion. Stiennon also noted during the podcast that AI is quickly becoming a major source of new identities, with agents being deployed widely and given credentials to operate at machine speed.

However, most identity programs still depend on static role-based models and periodic reviews, approaches that struggle to keep up with dynamic, non-human agents.

Despite a crowded identity security market with hundreds of vendors in IAM, PAM, IGA, and cloud identity, Rotenberg argues that the main issue is not a lack of tools.

“We’ve had identity tools for decades,” he said. “They do a good job of facilitating operations aimed at reducing risk. But they all miss the same point – they rely too much on the human factor.”

Each tool, he explained, only sees a part of the identity landscape. Identity providers handle authentication, PAM tools manage privileged access, and governance platforms oversee reviews. None provides a unified, real-time view of identity behaviours across systems.

The Fabrix CEO calls it “partial truth.” Security teams dealing with identity issues have to manually gather data from various platforms, piece it together, and make decisions with incomplete information.

“This leads to long review cycles, manual investigations, and over-provisioning by default,” he said. “Permissions get copied and duplicated because people don’t fully grasp who has access to what or why.”

This can often lead to unclear decisions, with the organisation handing out more permissions than fewer. Eventually, it creates sprawling identity landscapes filled with excessive privileges and risky combinations. In some cases, an individual might have limited rights in one system but full control in another without anyone noticing.

“Misconfigurations can occur between systems,” Rotenberg noted. “Things don’t align. And without a unified view, these risks remain hidden.”

Fabrix’s solution to this fragmentation is what Rotenberg calls an identity intelligence layer. This layer brings together existing identity tools without replacing them. They aim to continuously gather signals from IAM, PAM, IGA, cloud platforms, and other sources, then process them in real time.

“It’s not about tearing everything out,” Rotenberg said. “Each tool serves a purpose. But when you connect them through an intelligence layer, you can finally understand your entire identity framework.”

This intelligence layer aims to lessen reliance on manual decision-making. By providing contextual insights and recommendations at the moment decisions need to be made—and eventually automating those decisions—it addresses what Rotenberg sees as identity security's weakest link – human judgment at scale.

“Even if you set good policies, enforcing them continuously and at scale is impossible without automation,” Rotenberg said. “There’s simply too much data.”

Over time, he envisions identity systems that not only provide insights but also manage access automatically. They would revoke permissions, flag anomalies, and adjust as identity behaviours change.

“Rather than enforcing more rules,” Rotenberg added, “we need intelligence layers that constantly understand who has access, why that access exists, and whether it still makes sense.”

Watch the podcast at em360tech.com. For more information, please visit fabrix.security.

1. Identity security is becoming increasingly pivotal in modern organisations.
2. The complexity of managing identities is compounded by the rise of AI agents.
3. An intelligence layer is essential for effective identity security.
4. Automation is crucial for managing identity security at scale.
5. Fragmented identity management systems lead to operational inefficiencies and increase risk.
6. Organisations often have over-permissive identities due to poor management practices.
7. Integrating existing tools with an intelligence layer can enhance security.
8. CISOs need to rethink their identity architecture for future flexibility.
9. Identity security is shifting from a static to a dynamic approach.
10. Continuous monitoring and adaptation of identity access is key.

1. 00:00 Introduction to Identity Security Challenges
2. 02:53 The Role of Identity Intelligence
3. 05:38 Operational Inefficiencies in Identity Management
4. 08:49 Integrating Intelligence into Existing Tools
5. 11:43 Rethinking Identity Architecture for AI Agents

Fabrix Security builds AI Agents designed specifically for identity security. With identities multiplying across SaaS, cloud, and on-prem environments, Fabrix equips IAM teams with the intelligence to make confident, explainable access decisions – right at the moment of decision.

By infusing AI into identity security, Fabrix closes today’s biggest gap: visibility and intelligence. It enhances existing IAM workflows with speed, consistency, and accuracy, cutting through the chaos of manual, context-less decision-making. From user access reviews and access requests to full identity lifecycle management and AI-agents governance, Fabrix delivers intelligent, scalable, and proactive identity security.

#IdentitySecurity #AIagents #Cybersecurity #CISO #IAM #FabrixSecurity #FutureofIdentity #TechPodcast #TechPodcast #CloudSecurity #DynamicIdentity #SecurityIntelligence #FutureofIdentity #InfoSec

Organisations continue to struggle with device management data and fragmented architectures while facing pressure from business and regulators. As the technology landscape changes, the integration of Internet of Things (IoT) devices with Operational Technology (OT) presents both exciting opportunities and significant security challenges. In a recent episode of the Security Strategist podcast, host Christopher Steffen, alongside Dr Juergen Kraemer, Chief Product Officer of Cumulocity, examines the complexities of securing IoT environments and the importance of resilient analytics and accountability.

As time passes, the historical divide between IT and OT persists. As highlighted by Dr Kraemer, the operational technology sector has traditionally prioritised physical safety and availability over data confidentiality. This disconnect has created a significant gap in security policies, leaving IoT devices vulnerable to exploitation. The conversation emphasises that as organisations connect these previously isolated systems to IT networks, they inadvertently expose themselves to new risks, demanding a reevaluation of security strategies.

Dr Kraemer points out that securing data access is critical, especially for organisations that deploy IoT devices across multiple sites. For instance, managing security for an elevator company with installations worldwide presents unique challenges. Organisations must navigate various networks and ensure compliance with new legislative requirements, such as the Cyber Resilience Act and NIS2 directive. These regulations demand a structured approach to security that many legacy OT environments struggle to meet.

As IoT solutions proliferate, organisations often find themselves managing a patchwork of legacy systems and newer platforms. Dr Kraemer advocates for a hybrid approach, suggesting businesses create a unified data plane that integrates new and old systems. This strategy allows organisations to maintain operational continuity while gradually transitioning to modern platforms, ultimately leading to enhanced innovation and efficiency.

A significant takeaway from the podcast is the concept of “buy and build.” Instead of choosing between purchasing a platform or developing one in-house, organisations should leverage established platforms like Cumulocity while also building innovative applications tailored to their specific needs. This dual approach allows businesses to focus on high-value projects without getting bogged down by the complexities of underlying infrastructure.

The dialogue sheds light on the pressing need for organisations to adapt their cybersecurity strategies to accommodate the complexities of IoT and OT environments. By understanding the historical disconnect, addressing security challenges, and adopting a buy and build approach, enterprises can improve their cybersecurity posture and drive innovation in an increasingly interconnected world.

To find out more, visit https://www.cumulocity.com/

• IoT devices are often treated as secondary in security policies.
• The historical divide between IT and OT creates security challenges.
• Organisations struggle with integrating legacy and modern IoT systems.
• A buy-and-build strategy allows for innovation while ensuring security.
• Deployment flexibility is crucial for global IoT operations.
• Data silos hinder effective analytics and AI integration.
• A unified data lake can enhance insights from IoT data.
• Regulatory compliance is a growing concern for IoT security.
• Organisations need to enforce strong security measures across the entire IoT lifecycle.
• IoT should be viewed as a data-driven business opportunity rather than just a connectivity issue.

00:00 Introduction to IoT Security Challenges

04:01 The Disconnect Between IT and OT Security

10:00 Challenges in Integrating IoT Platforms

17:09 Buy and Build Strategy for IoT

20:08 Modern Data Pipelines and AI Integration

24:07 Bridge between AIOT and IOT

28:02 Best Practices for IoT in Risk Management

Security leaders are rethinking how detection and response work in practice in 2026 owing to growing complexities in cybersecurity technology and the threat landscape.

On this episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, spoke with Daniel Martin, Director of Product Management at Rapid7. They discussed how modern Security Operations Centres (SOCs) are evolving, where AI truly adds value, and why outcomes—not features—should guide cybersecurity teams.

A recurring theme in their discussion was that while the threat landscape continues to evolve, many core challenges for SOCs remain unchanged. According to Martin, security teams still struggle with alert fatigue, lack of context, and the pressure to respond quickly—all while juggling increasingly complicated domains.

Organisations now require detection and response that is tailored to their specific environment, not generic threat models. Such a shift explains the rise of Managed Detection and Response (MDR) and the decline of one-size-fits-all managed security services. Customers want results, not noise, and they seek partners who understand their business context.

Martin says that this philosophy lies at the heart of Rapid7’s approach to Incident Command, its modern Security Information and Event Management (SIEM) offering. Instead of treating SIEM, Security Orchestration, Automation, and Response (SOAR), and threat intelligence as separate tools, Incident Command integrates them directly into the analyst workflow. The aim is to provide decision support in real-time—delivering relevant context, threat intelligence, and recommended actions exactly when needed, without making analysts switch between different systems.

Martin emphasised that a modern SIEM's success isn’t measured by the amount of data it can handle, but by how effectively it helps analysts make high-quality decisions quickly. Automation is important, but only if it’s applied thoughtfully. Deterministic automation, which includes actions that are predictable, auditable, and repeatable, remains vital for security operations. AI is most useful when it aids reasoning, summarisation, and prioritisation instead of completely replacing human judgment.

“There’s a lot of excitement around autonomous security,” Martin noted, “but chaining unpredictable decisions together is not something customers can trust.” Instead, Rapid7 focuses on using AI to assist analysts at specific moments in an investigation, such as summarising activity, adding context to alerts, or helping decide if more data collection is needed.

Also Watch: Is Your Attack Surface a Swiss Cheese? Solving Attack Surface Management (ASM) Challenges

A key aspect of Rapid7’s product development is its “customer zero” approach. By running its own global MDR SOC, Rapid7 continuously incorporates real analyst feedback into product design. Martin shared that an early mistake was putting AI-driven insights in a separate interface to avoid disrupting workflows; this was quickly corrected after analysts indicated they wouldn’t leave their main view to check a secondary opinion. The lesson was clear: if context matters, it must be available where decisions are made.

Looking ahead to 2026, Martin sees the next step in detection and response as increased visibility combined with better management of the environment. Customers expect MDR providers and security platforms to gather signals beyond traditional EDR and cloud alerts—without overwhelming analysts with extra noise. He believes that achieving this balance is where AI-assisted automation and context-aware workflows will have the greatest impact.

When asked for a final takeaway for CISOs and IT leaders, Martin returned to a theme that ran throughout the conversation: focus on results. It’s easy to be distracted by flashy new features or the latest AI trends, but security improves only when organisations clearly define their goals. When customers express their priorities and vendors align with them, trust increases—and meaningful progress follows.

In a landscape full of tools and promises, Martin believes the future of security operations isn’t about removing humans from the process. It’s about empowering them with the right context, effective automation, and AI that enhances—not replaces—the most important decisions.

1. Organisations are still facing the same core challenges in cybersecurity despite technological advancements.
2. There is a growing demand for more environmental context in detection and response.
3. MDR services are evolving to focus on partnerships rather than just product delivery.
4. Rapid7's Incident Command aims to improve decision support in SOC operations.
5. Automation should be frictionless and integrated into the analyst's workflow.
6. Deterministic automation is crucial for reliable security outcomes.
7. Analysts need to learn from real-time data to enhance response strategies.
8. The future of detection and response will involve broader visibility and ownership of customer environments.
9. Building trust with customers is essential for effective cybersecurity partnerships.
10. Focusing on customer outcomes is key to improving security operations.

1. 00:00 Introduction to Cybersecurity and AI Innovations
2. 02:01 Shifts in SOC Operations and Customer Challenges
3. 04:29 MDR Services: A New Approach to Cybersecurity
4. 06:02 Rapid7's Incident Command: Enhancing SIM with Context
5. 08:26 Automation in Cybersecurity: Balancing Efficiency and Control
6. 11:01 Learning from Analysts: Enhancing Response and Automation
7. 12:43 The Future of Detection and Response in Cybersecurity
8. 14:23 Key Takeaways for Security Leaders

#Cybersecurity #Rapid7 #SecurityStrategistPodcast #AIinSecurity #SecurityOperations #SOC #MDR #SIEM #SOAR #IncidentCommand #ThreatDetection #Response #Automation #HumanLedAIDriven #TechPodcast #FutureofSecurity #CISOTakeaways #ITLeaders

Podcast: The Security Strategist

Guest: John Amaral, Co-Founder & CTO, Root.io

Host: Chris Steffen, VP of Research, Enterprise Management Associates (EMA)

For over a decade, shift-left security has been the leading idea in DevSecOps. The concept was straightforward: move security earlier in the software development process so vulnerabilities could be fixed more quickly and cheaply.

However, new benchmark data suggests that the reality is quite different.

In the latest episode of The Security Strategist podcast, Chris Steffen sat down with John Amaral, Co-Founder and CTO of Root.io, to discuss why shift-left has stalled and why autonomous remediation and “shift-out” security is the best option moving forward.

One striking data point mentioned in the episode comes from the Shift-Out Benchmark Report by Root. It reveals that 82 per cent of organisations say they are confident in their shift-left strategy; however, only four per cent have achieved zero CVE backlog.

“That four per cent shocked me,” Steffen expressed during the conversation. “Honestly, it felt high.”

Amaral explained that this gap exists because the industry has focused on detection instead of remediation. “We built CVE detection at computer speed,” Amaral noted. “But remediation has never scaled beyond human speed.”

Modern pipelines can quickly identify vulnerabilities, open tickets, and generate extensive lists. However, the actual work of fixing those vulnerabilities still falls on engineering teams.

Shift-left claimed that developers could fix security issues faster because they work closely with the code. In reality, that assumption falls apart, particularly for third-party and open-source dependencies.

The Root CEO added that developers are being asked to fix code they didn’t write, don’t own, and don’t understand. “They want to build features, not reverse-engineer open-source libraries.”

With over 90 per cent of modern applications built by leveraging open-source models, fixing vulnerabilities often depends on upgrades. Often, this ends up forming a risky trade-off.

Upgrading dependencies has long been the go-to remediation strategy. However, recent supply-chain attacks—like “Sha1-Hulud-style malware injections”—have shown how dangerous blind upgrades can be.

“If you compromise a popular repository at the right moment, malware can spread to millions of downstream projects in minutes,” Amaral warned.

Organisations now face a difficult choice between upgrading automatically and risking a malware spread or pinning dependencies that build CVEs hard to fix quickly. “Pinning protects you from supply-chain attacks,” Amaral says, “but now you’ve created a CVE backlog you don’t have the resources to clear.”

Instead of focusing remediation efforts earlier (shift-left), Amaral suggests organisations need to shift it out—removing the responsibility from developers entirely.

Shift-out security stresses on pinned dependencies to prevent untrusted upgrades, automated backporting and patching for known CVEs and AI-backed remediation that operates independently of engineering teams.

“Remediation shouldn’t be done by your engineers,” the co-founder of Root tells Steffen, “It should be managed by technology that operates at the same speed as detection.”

This method allows organisations to keep tight control over dependencies while still meeting service level agreements for critical and high-severity vulnerabilities.

“In 2026, you need a real dependency management strategy—one that assumes supply-chain attacks will keep happening,” Amaral added.

With state actors increasingly targeting open-source environments, the stakes continue to rise. “Sha1-Hulud is just the tip of the iceberg,” Amaral concluded. “This will happen again and again. You need to be ready.”

Shift-left helped organisations identify their risk, but it didn’t eliminate it. As vulnerability backlogs increase and engineering teams face burnout, autonomous remediation and shift-out security are becoming the next step in DevSecOps.

To learn more about this approach, visit Root.io or listen to the full episode of The Security Strategist podcast on EM360Tech.

1. The shift left approach is not yielding the expected results.
2. Only 4% of teams have achieved zero CVE depth, indicating a significant gap in vulnerability management.
3. Remediation processes have not scaled with the speed of detection, leading to a backlog of vulnerabilities.
4. Engineers prefer to work on first-party code rather than third-party open source libraries, complicating remediation efforts.
5. Burnout among engineers is a critical issue due to the overwhelming vulnerability management tasks.
6. Security is increasingly viewed as a business problem, impacting organisational success.
7. Effective vulnerability management requires a shift towards autonomous remediation.
8. Pinning dependencies can help mitigate risks associated with open source vulnerabilities.
9. The Shia Lute attack exemplifies the risks of automated upgrades in software supply chains.
10. Organisations need a cogent strategy for managing software dependencies to stay ahead of security threats.

1. 00:00 Introduction to Cybersecurity Challenges
2. 03:00 The Shift Left vs. Shift Out Debate
3. 05:48 Understanding Vulnerability Management
4. 08:58 The Role of Open Source in Security
5. 11:40 Impact of Vulnerability Remediation on Engineering Teams
6. 15:00 The Business Perspective on Security
7. 18:02 Autonomous Remediation and Its Importance
8. 20:47 Strategies for Effective Vulnerability Management

#Shift-leftsecurity #vulnerabilitymanagement #autonomous

remediation #softwaresupplychainsecurity #CVEbacklog #DevSecOps #Root.io #EM360Tech #dependencymanagement #shift-outsecurity

As companies speed up their adoption of AI, an old but increasingly serious problem is resurfacing: lack of visibility. In the recent episode of The Security Strategist podcast, Eric Schwake, Director of Cybersecurity Strategy at Salt Security, joined analyst Richard Stiennon to discuss why APIs, which have long been the backbone of modern applications, have become essential for AI-driven businesses.

They particularly dive deep into the critical importance of API visibility and discovery in the context of rising AI integration within enterprises. They discuss the challenges organisations face in securing APIs, the significance of understanding the attack surface, and the role of governance in managing risks.

The conversation also covers the emerging Model Context Protocol (MCP) and its implications for API security, as well as the future landscape of cybersecurity as AI systems become more autonomous. Schwake emphasises the need for CISOs to be proactive in engaging with AI projects to ensure security is prioritised.

If this system isn’t secured, the entire organisation faces risks.

APIs have been vital to business structures for years, especially with the growth of microservices. However, Schwake argues that AI has changed the scale of the issue significantly.

“We saw a big increase in the number and usage of APIs when microservices became popular,” Schwake explained. “Now, with AI, it’s just 10 times or even 100 times whatever it is for APIs.”

While much of the industry talk has centred on large language models (LLMs), Schwake emphasised that the real actions—and risks—occur one layer below.

“Everything happening is driven by APIs. The AI agents, the MCP servers, the agents communicating with the LLMs—all of it is API traffic.” In essence, AI may represent innovation, but APIs are the mechanisms that enable it.

As companies rush to implement copilots, agents, and automation, security often takes a back seat. Schwake warned that this creates a dangerous blind spot. “You need to ensure that you’re securing that underlying nervous system of this new world—and that relies on APIs.”

This lack of attention has resulted in a surge of unknown, unmanaged, and “shadow” APIs, many of which were never documented or designed with security in mind. Without continuous discovery, security teams might not even know what they are trying to protect.

“Visibility is a challenge in security. If you don’t have visibility, you can’t see what you’re protecting—you’re essentially out of luck.”

For the Director of Cybersecurity Strategy, API security begins with understanding the attack surface. This principle hasn’t changed in 20 years, but AI has made it more crucial. “With AI, the attack surface on APIs could grow tenfold. If you don’t have a grasp of that attack surface, you won’t be able to protect it.”

After identifying APIs, the next step is governance. This includes finding owners, setting rules, and reducing risks before attackers exploit vulnerabilities. “You want to ensure that there isn’t a big open gap inviting attackers.”

This becomes even more important as AI tools start writing code and generating APIs, raising both speed and risk.

Schwake concluded the discussion with a clear message for security leaders. “From a CISO perspective, ensure that you engage as early as possible with these projects.”

AI initiatives often start outside of traditional security processes, increasing risk by default. CISOs need to insert themselves early, understand business developments, and safeguard the underlying APIs. “You want to support business success and speed, but also ensure it’s secure.”

API security is no longer a secondary issue. It’s essential for determining whether innovation can scale safely or risks becoming the next major breach story.

1. API visibility and discovery have become crucial due to the rise of AI.
2. Organisations are experiencing a massive increase in APIs.
3. Visibility is essential for effective security management.
4. Understanding the attack surface is key to protection.
5. Governance is necessary to mitigate risks after discovery.
6. MCP serves as a foundational layer for AI communication.
7. The future of API security is rapidly evolving and uncertain.
8. CISOs must engage early in AI projects to ensure security.
9. Security should be integrated into AI development from the start.
10. Organisations need to be aware of AI-related security threats.

1. 00:00 Introduction to API Security and Visibility
2. 01:24 The Rise of APIs and AI in Cybersecurity
3. 05:04 Challenges in Securing APIs and AI Integration
4. 07:08 Discovery and Governance of APIs
5. 09:02 Understanding MCP and API Interactions
6. 11:04 Future of API Security in an AI-Driven World
7. 13:37 Key Takeaways for CISOs

#AI #Cybersecurity #APISecurity #AIAgents #AutonomousAI #techpodcast #CISO #APIVisibility #ShadowAPIs #DigitalTransformation #SecurityStrategist

AI agents are evolving into capable collaborators in cybersecurity, acting as operational players. These agents read sensitive data, trigger workflows, and make decisions at a speed and scale beyond human capability.

Matt Fangman, Field CTO at SailPoint, explains on The Security Strategist podcast that this new power has costs. AI agents have turned into a new, mostly unmanaged identity type. Enterprises are just starting to realise how far behind they are.

In the recent episode of The Security Strategist podcast, guest Fangman sat down with Alejandro Leal, Senior Analyst at KuppingerCole. They talked about the implications of AI agents for identity security and the rapid evolution of AI agents, the challenges of visibility and governance, and the need for operational control in managing these agents.

The conversation highlights the importance of just-in-time permissions, the evolution of identity controls, and strategic moves for CISOs to manage the risks associated with agent-based operations.

Fangman notes a turning point in the last 12 to 18 months, driven by the fast development of large language models (LLMs). These models gave agents the reasoning and autonomy to change from toys in a sandbox to real virtual workers.

Organizations can now train agents with goals, equip them with tools, and connect them to one another. Since these agents do not tire, slow down, or forget, companies see a chance to grow their workforce without hiring new people.

The issue is: They didn’t establish identity controls for these AI workers.

“They’ve created a brand-new layer of identities,” Matt says, “but without the protections, ownership, or visibility that exist for humans.”

Shadow agents, sometimes numbering in the thousands, operate unnoticed. Identity teams are unaware of them, security teams can’t monitor them, and cloud teams might spot them briefly in a dashboard, thinking they are someone else’s issue. Meanwhile, the agents themselves explore, share tools, and adapt.

It’s a governance gap that keeps widening.

When Leal asks how the industry should respond, Fangman answers: “Start by treating agents like people. Give them roles. Define what they can access. Apply entitlements. Enforce policy.”

When asked for advice for CISOs and what they should do before agents start to overwhelm security programs?

The SailPoint Field CTO recommends beginning with inventory. If an organisation does not know what agents exist, what they access, or what they are doing, nothing else matters. Assigning each agent a corporate identity and tracking its behaviour is the essential foundation for everything that follows.

1. AI agents are becoming operational actors in business systems.
2. The lack of visibility into agents creates governance risks.
3. Just-in-time permissions are essential for managing agents.
4. Agents are evolving into peer systems within organisations.
5. Identity management is shifting towards relationships and context.
6. CISOs need to inventory and track agent behaviour.
7. Behaviour logging is crucial for ensuring agent compliance.
8. Identities for agents will be a new focus area.
9. Control of basic identity management practices is vital.
10. The evolution of AI agents is reshaping identity security.

1. 00:00 The Rise of AI Agents in Identity Security
2. 03:14 Challenges of Visibility and Governance
3. 05:51 Building an Operational Control Plane
4. 09:03 Evolving Identity Controls for Multi-Agent Systems
5. 12:08 Strategic Moves for CISOs in Managing Agents

As businesses approach the holiday season, security teams feel the pressure while online activity increases. At the same time, AI is quickly changing how attacks are launched and how organisations function daily.

In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, sits down with Pascal Geenens, VP of Threat Intelligence at Radware, to discuss why CISOs need to rethink their long-held beliefs about attackers, users, and what “web traffic” really means in an AI-driven world.

They talk about the dual nature of AI in cybercrime, the emergence of new tools that facilitate attacks, and the importance of automated pen testing as a defence strategy. The conversation also highlights vulnerabilities associated with AI assistants, such as indirect prompt injection, and emphasises the need for organisations to adopt best practices to safeguard against these threats.

Also Watch: From Prompt Injection to Agentic AI: The New Frontier of Cyber Threats

Geenens tells Stiennon that AI’s biggest effect on security is not a new type of futuristic attack but rather its scale and accessibility. Tools like WormGPT, FraudGPT, and advanced platforms like Xanthorox AI provide reconnaissance, exploit development, data analysis, and phishing as subscription-based services. For a few hundred dollars each month, attackers can access AI-assisted tools that cover the entire cyber kill chain.

This “vibe hacking” model resembles vibe coding. Attackers describe their goals in natural language, and the AI generates scripts, reconnaissance workflows, or data extraction logic. While these tools have not fully automated attacks from start to finish, they significantly lower the skills needed to engage in cybercrime. As Geenens explains, attackers can now target hundreds or thousands of organisations simultaneously, a task that once required large teams.

Attackers can now afford to fail repeatedly as part of their learning process, while defenders cannot. Even flawed AI-generated exploits speed up scanning, vulnerability detection, and phishing at levels that security teams find challenging to handle. The result is a threat landscape that uses familiar techniques but operates with greater speed and intensity.

Also Watch: How Do You Stop an Encrypted DDoS Attack? How to Overcome HTTPS Challenges

The second, and more alarming, change that the VP of Threat Intelligence emphasises occurs within companies themselves. As organisations use AI assistants and AI-powered browsers, they delegate authority along with convenience. These tools require access to emails, documents, and business systems to be effective, and this access creates new risks.

Indirect prompt injection, shadow leaks, and echo leaks turn normal workflows into potential attack vectors. For instance, an AI assistant summarising emails may unintentionally process hidden commands within a message. These commands can lead the model to inadvertently leak sensitive information without the user clicking any links or noticing anything unusual.

In some cases, the data doesn't even leave the endpoint; it exits directly from the AI provider's cloud infrastructure, completely bypassing established data loss prevention and network monitoring.

Meanwhile, Geenens points to a fundamental shift in traffic patterns. The web is moving from human-to-website interactions to machine-to-machine communications. AI agents browse, conduct transactions, and query on behalf of users.

Bot traffic is growing rapidly, surpassing human traffic, and traditional controls, such as CAPTCHA or login challenges, are no longer effective. Defenders must now focus on behaviour rather than identity—understanding what a machine is trying to do and whether that behaviour matches business intent.

For CISOs, the message is straightforward: AI is unavoidable, but it needs to be used with proper governance, monitoring, and behavioural security measures. Understand what data AI assistants can access, log their activities, and get ready for a future where most traffic is automated. Attackers have already adapted.

Also Watch: Can You Stop an API Business Logic Attack?

1. The holiday season sees an increase in cyber threats.
2. AI tools like Worm GPT and Fraud GPT are changing the threat landscape.
3. Automated pen testing can help organisations defend against AI-driven attacks.
4. Indirect prompt injection poses significant risks to data security.
5. Organisations must monitor AI assistant interactions closely.
6. Vibe hacking is a new trend that lowers the barrier to entry for cybercriminals.
7. Behavioural analysis is crucial as machine-to-machine communication increases.
8. Pen testing remains essential to identify vulnerabilities before attackers do.
9. AI can automate parts of attacks, but is not fully autonomous yet.
10. CISOs need to implement strict controls when deploying AI technologies.

1. 00:00 Introduction to Cybersecurity Threats During Holidays
2. 02:37 AI's Role in Evolving Cyber Threats
3. 05:45 The Impact of AI Tools on Cybercrime
4. 08:59 Automated Pen Testing and AI's Defensive Role
5. 11:45 Indirect Prompt Injection and AI Vulnerabilities
6. 14:37 Best Practices for CISOs in the Age of AI
7. 21:39 The Future of Cybersecurity: Machine-to-Machine Communication

Industrial enterprises are undergoing significant transformation as connected devices reshape the way they operate. IoT platforms provide new opportunities for automation, predictive maintenance, and more efficient device management. But these benefits come with challenges. In this episode of the Security Strategist podcast, host Trisha Pillay speaks with Bernd Gross, CEO of Cumulocity, about how enterprises can navigate these complexities and scale their operations successfully.

Gross emphasises that the foundation of successful enterprise transformation is having the right data. Organisations need accurate information, clear visibility into device status, and meaningful context to make informed decisions. Without this foundation, even the most advanced platforms cannot deliver their full potential.

As the number of connected devices grows, resilient cybersecurity and cloud security are critical. Bernd shares practical insights for protecting enterprise systems while maintaining smooth operations, from managing access to ensuring device integrity across distributed networks. Alongside security, lifecycle management ensures devices are monitored, maintained, and retired efficiently. Organisations that integrate lifecycle management into daily operations see fewer disruptions and higher overall reliability.

Connected platforms are only as valuable as the data they generate and the processes they support. Bernd explains that a clear data strategy is essential for enriching information, understanding device performance, and driving operational decisions. Automation also plays a key role, allowing enterprises to act quickly, scale efficiently, and maintain control over complex systems. By connecting device management, enriched data, and automated processes, organisations can respond to challenges faster, optimise performance, and create a foundation for long-term transformation.

This episode provides practical guidance for technology leaders looking to improve operational efficiency, strengthen security, and optimise connected platforms. For more insights and resources on connected platforms, visit Cumulocity.

• Cumulocity is a leading IoT platform focused on B2B industrial use cases.
• Security in connected operations requires both IT and OT security measures.
• No open ports towards the internet is a critical security rule.
• Device certificates are essential for secure communication.
• Lifecycle management is crucial for maintaining connected devices.
• On-premise systems may not be as secure as perceived compared to cloud solutions.
• Automation can significantly reduce maintenance costs and improve efficiency.
• Data enrichment is necessary for effective AI model training.
• Many enterprises struggle with the data challenge in AI deployment.
• Clear business outcomes should guide IoT and AIoT initiatives.

00:00 Introduction to IoT and AIoT Transformation

04:40 Security Challenges in Connected Enterprises

13:01 On-Premise vs Cloud Security Perceptions

17:44 The Value of Automation in Device Management

21:34 Operational Challenges in Deploying AI at Scale

26:11 Transitioning from IoT to AIoT Data Management

31:18 Practical Advice for Successful IoT and AIoT Initiatives

Scaling technology globally is one of the most complex challenges for Chief Technology Officers and enterprise leaders. It requires balancing infrastructure, operations, regulatory compliance, and user trust, all while delivering systems that are reliable, secure, and effective across diverse regions.

In this episode of Security Strategist, host Trisha Pillay explores these challenges with Grant McWilliam, Chief Technology Officer at Aura. They discuss how enterprises can overcome regulatory compliance, technology infrastructure, and operational challenges while delivering trusted, reliable systems globally.

Global expansion introduces different regulatory landscapes, from data privacy laws to communications standards. While some see these as hurdles, they can become strategic advantages: As Grant says, “Regulatory challenges can be opportunities.” He further explains that building a global framework with room for local adaptation, “design globally, implement locally,” ensures compliance while maintaining operational flexibility.

Reliable technology infrastructure is just as important for platforms operating across regions with varying telecom networks, mapping systems, and technical capabilities. In mission-critical contexts such as emergency response, reliability is non-negotiable, and technology should never limit service. Redundancy, failovers, and multi-region deployments ensure platforms remain responsive under pressure.

Gary notes that operational pressures grow as organisations scale. Teams need to act efficiently while respecting local regulations and cultural contexts. He emphasises: “Trust is essential in emergency response and emergency response must prioritise user needs.” By embedding processes as backups to the backups and adapting technology to local conditions, organisations build resilience and maintain user confidence. He adds, “Collaboration enhances operational efficiency.”

1. Global standards and local adaptation: Establish frameworks that scale but allow local execution.
2. Reliability and trust: Ensure mission-critical systems function under any circumstances.
3. Cultural and operational alignment: Integrate local knowledge and collaboration to make technology sustainable and effective.

Scaling technology globally requires balancing cybersecurity, infrastructure, regulatory compliance, and operational agility. In this episode of Security Strategist, the discussion highlights that success comes from combining technical excellence with strategic empathy, ensuring platforms are trusted, resilient, and effective for every user, in every region.

• Scaling technology globally requires navigating regulatory complexity and infrastructure demands.
• Building trust is essential for emergency response technology to be effective.
• Global standards must be adapted to local needs for successful implementation.
• Adapting to different infrastructure environments is crucial for maintaining service quality.
• Cultural understanding is key to adapting technology for different regions.
• Regulatory challenges can be opportunities for improvement.
• Collaboration with local teams enhances operational efficiency.

• 01:20 Introduction to Grant McWilliam
• 04:39 Challenges of Scaling Emergency Response Globally
• 08:39 Technical Challenges in Global Infrastructure
• 11:38 Maintaining Reliability and Redundancy in Emergencies
• 18:30 Strategies for Operational Efficiency and Security at Scale
• 22:26 Top Priorities for Enterprise Leaders and CISOs

Grant Macwilliam serves as Chief Technology Officer at Aura, leading the development and scaling of a global emergency response platform that connects users with vetted security and medical responders worldwide. An electrical engineer by training, he is passionate about creating technology and teams that deliver real-world impact. Under his leadership, Aura has expanded its platform across continents, supporting partners in ride-sharing, insurance, and public safety sectors while maintaining high standards of reliability, trust, and operational excellence.