Cloud Security Podcast

9 episodes scanned. 93% of ad slots promote the show's own products.

Recent Episodes

1. Using LLMs for Enterprise Threat Modeling

   Oct 27, 2026

   Ben Oster, CPO of ThreatModeler, discusses how LLMs are changing threat modeling from a weeks-or-months project into something that can be produced in minutes or hours. The conversation covers why traditional point-in-time threat models often go stale, the case for continuous, enterprise-wide threat modeling tied to pull requests and architectural drift, and the build-versus-buy tradeoffs. Ashish, the host, presses on how engineering teams, security roles, and entry-level work would change under this model.

2. Mythos Hype vs. Reality: Why You Need an Agentic Harness

   Oct 21, 2026

   Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief, discusses the hype and fear around Anthropic's Mythos model and the "mythos readiness assessment" trend. He argues that access to a powerful model without a multi-stage agentic harness has limited value, and he explains why the "66,000 CVE" figure overstates real risk, since only about 1% of vulnerabilities are exploited in the wild. The conversation also covers Trend's Zero Day Initiative agentic harness, metrics for board reporting, and a three-stage maturity model for enterprise AI security: visibility, observability, and actionability.

3. How Block Solved DNS Vulnerabilities

   Oct 13, 2026

   Ramesh Ramani, a Staff Security Engineer at Block, describes how the company went from a single bug bounty report with 80+ domain takeover findings in 2021 to near-zero takeover reports by 2024. He explains why DNS attribution and ownership are the core obstacles, why registrar consolidation and policy came before automation, and how Block's stateless, AWS-native system routes vulnerable records to application teams. The conversation also covers the limits of AI for signal-critical security tasks such as least-privilege analysis and log parsing.

4. Why AI Security is Actually a Data Security Problem

   Oct 8, 2026

   David Gibson, SVP of Strategic Programs at Varonis, discusses why AI security is fundamentally a data security problem, including the risks of connecting AI copilots and agents to corporate data before access is locked down. The conversation covers emerging threats such as hallucinated package names, untrusted agent inputs, and the role of email and identity security in AI risk. Gibson also outlines the Varonis Atlas framework for inventorying AI systems, applying runtime guardrails, and automating red teaming.

5. Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats

   Sep 11, 2026

   Marcus Hallberg and Samuel Kelemen, security engineers at Lovable (an AI software creation platform), discuss how they detect and defend against insider threats and supply chain attacks targeting AI-generated applications. The episode covers a sophisticated attack where malicious contractors mimicked AI agent commits to inject code into customer projects, along with Lovable's multi-layered defense strategy including predefined tech stacks, integrated security scanners, and tuned coding agents with strict guardrails. They explore the evolution of shared responsibility in the AI era, the importance of Git commit signing and secure sandboxed environments, and how platforms can empower users through AI-assisted security tools like "CISO agents."

6. Why AI Won't Replace Your SOC: Federated Data & APEX Framework

   Sep 1, 2026

   Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl, discusses how AI is transforming detection engineering and security operations. She breaks down Cribl's open APEX framework, which uses behavioral chaining, time-boxing, and clustering to build high-fidelity detections without requiring thousands of individual rules. The conversation covers the shift from IOC-based detections to behavior-based detection, federated data architecture, and practical approaches to securing AI agents in SOC environments.

7. The "Hunt First" AI Security Strategy

   Aug 25, 2026

   Damien Lewke, Founder and CEO of Nebulock, discusses the "Hunt First" mindset in security operations—a proactive approach that prioritizes threat hunting over reactive alert management. He explains how AI is democratizing threat hunting capabilities for organizations of all sizes, enabling even small teams to surface unknown intrusions by analyzing raw telemetry across endpoint, identity, and cloud data. The conversation covers shadow AI detection, the role of AI against AI threats, and why threat hunters' skills are becoming more valuable rather than obsolete in an increasingly sophisticated threat landscape.

8. Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?

   Aug 18, 2026

   Michael Leland, VP Field CTO at Island, discusses the critical need for an Agentic Control Plane to secure AI agent activities across the enterprise. He explains why traditional security tools (EDR, DLP, CASB) fail to provide visibility into autonomous AI agents, the risks of Shadow AI and well-intentioned employees exposing sensitive data to public LLMs, and practical strategies including token brokering, model fit steering, and managing the "two-hop problem" when agents call other agents.

9. How Adobe Uses AI Agents for building a WAF Pipeline?

   Aug 4, 2026

   Ammar Alim, Product Security Engineering Lead at Adobe, discusses how to build an automated, agentic WAF pipeline to respond to vulnerabilities within 24-hour exploit windows. He explains Adobe's approach to managing seven different commercial and open-source WAFs using AI agents, multi-model architectures, and reinforcement learning to generate, test, and deploy virtual patches at scale.

10. Why Runtime Agents Are Replacing Static Posture Checks

    Jul 28, 2026

    Siddharta Tiger, Senior Director of Product Management for Cortex Cloud at Palo Alto Networks, discusses how AI agents and LLMs are fundamentally changing cloud and application security. The conversation covers the convergence of AppSec and cloud security driven by shortened attack windows (as little as 24 hours or less), the shift from static posture checks to runtime agent protection, and why organizations must adopt a unified product security approach that combines infrastructure, identity, data, and application insights rather than maintaining siloed security programs.