"This is the scariest story I've ever had to tell my board."

CISO Jason Loomis on what AI is really doing to security teams.

Aaron sits down with Jason Loomis for a raw, funny, unfiltered conversation about AI's impact on security teams, careers, and the humans caught in the middle. Jason lays out his "farm team" problem: the tier-one SOC, GRC, and help desk roles that grow new talent are being automated away and he's brutally honest with his own team about it.

We get into:

• Why the security fundamentals haven't changed in 20 years, even as velocity explodes
• The hype gap between vendor promises and enterprise reality
• Vulnerability chaining in the era of frontier models
• Why AppSec is the problem actually worth solving
• The build-vs-buy debate for security tooling
• A myth-busting rant on AI data paranoia and security theater
• Why "security is a revenue generator" is a line CISOs need to stop repeating

Guest: Jason Loomis, CISO at Freshworks and co-host of the new "Gen and Tonic" podcast. Find him on LinkedIn (no pitch-slapping, please).

The cyber industry is moving faster than ever and Cris Neckar thinks it's chasing the wrong things.

In the debut episode of Zero Sum, host Aaron Mog sits down with Cris Neckar, security researcher turned entrepreneur turned VC at Two Bears Capital in Whitefish, Montana. Cris traces his unusual path from hardcore offensive work to venture capital, and explains why the biggest roadblocks in security aren't technical but structural: broken incentives, revenue-first boards, and founders who fall in love with cool tech instead of customer problems.

We get into:

• The "scientist vs. salesman" failure mode that kills early-stage security startups
• Why Cris's first diligence question is always "let me talk to your customers"
• How the Cursor playbook rewrote the rules of company-building
• How elite hackers use AI as a force-multiplier, not a replacement
• Why "nobody wants to buy more red on a dashboard"
• FinOps for AI spend, compliance-as-collateral, and betting on power and data centers

Guest: Cris Neckar, Partner at Two Bears Capital. Connect on LinkedIn or pitch via the Two Bears website.

Cris is a Partner at Two Bear Capital.  The views he expresses are his own and do not necessarily reflect the views of TBC or its partners.

Entry-level security jobs are vanishing so how does anyone break in now? Detection engineer and educator Wade Wells has thoughts.

Detection engineer, educator, and B-Sides San Diego organizer Wade Wells joins Aaron for a practical, honest look at entering and surviving in security today. Wade, who teaches cybersecurity students across all levels, admits the field moves so fast he can no longer confidently tell students what to do, since even the old advice can now be faked with AI.

We get into:

• Why networking and a genuine community footprint beat a perfect résumé
• The collapse of entry-level roles and the patience the job market now demands
• The "AI slop" problem: people submitting work they never read
• Why everyone is becoming a developer — or a "data shepherd" who validates what AI builds
• The reckless reality of businesses uploading confidential data to AI
• The coming "AI living off the land" attack and the yes-but approach to security

Guest: Wade Wells, detection engineer and B-Sides San Diego organizer. Catch him at DEFCON or on LinkedIn and Twitter — just mention where you found him.