Episodi
-
Guests:
Gal Ordo, Co-founder & CPO @ NativeTopics:
In Episode 186, we debated 'Native vs. Third-Party' as a binary choice. Native seems to be a third-party vendor whose entire existence depends on the belief that cloud-native controls are superior. Does your platform validate the 'Cloud Provider' side of the debate (that their controls are enough), or does the fact that you exist prove the 'Third-Party' side (that native interfaces aren't enough)? A key argument against native controls is an AWS WAF and a Google Cloud Armor don't behave the same way. If your tool manages native controls across multi-cloud, how do you handle the 'lowest common denominator' problem? Do you dumb down the policy to fit all clouds, or do you expose the unique complexity of each one? GuardDuty and SCC produce similar but meaningfully different results. How do you abstract across that so an analyst or IR team isn't having to dig into the exact meaning of the different JSON fields in their output? We often say native tools are 'good enough' for 80% of use cases but lack the depth of specialized third-party vendors (like a dedicated CNAPP or DLP). By betting your company on orchestrating native controls, are you effectively betting that 'good enough' is the future of the market? What happens when a customer needs a feature that the CSP hasn't built yet? What fraction of your users are taking this from a "I'm 80% this one cloud, I need great coverage there and good enough elsewhere" vs "I'm truly multi-cloud" or even scarier "I have a workload that is active spanning clouds"? Do your customers push you towards helping with the kinds of SaaS platforms that SSPM vendors cover? If AWS and Google Cloud suddenly decided to make their native security UIs perfect and unified tomorrow, would your company cease to exist? Or is the complexity of the cloud strictly increasing, guaranteeing you job security forever?Related:
Video version EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again! The Great Cloud Security Debate: CSP vs. Third-Party Security Tools native.security blog -
Episodi mancanti?
-
Guest:
Matt Gregson, Principal - PwC Cyber SecurityTopics:
What is the state of the art of "agentic SOC" in 2026? Can you describe the most agentic SOC you've seen so far? In your experience, what are the main measurable benefits of AI agents in a SOC and IR? Imagine a 2030 SOC, what do humans do? Tell us more about how you judge if a client SOC is ready for AI and agents? What is the "Ouch" moment where most organizations realize their data isn't ready for that level of autonomy? Should we be more afraid of "AI hallucinations" or "Human fatigue" in the SOC? If a team has an agentic teammate making its own decisions based on emergent reasoning, how do you audit its "thought process"? Everyone loves to talk about "Time Saved," but in an agentic SOC, we care about "Decision Quality." What is the one metric PwC uses to prove that a SOC agent deployment is actually reducing risk? We often hear about "human-agent teaming." Are they still looking at alerts, or are they just approving "Action Plans" generated by the AI?
Resources:
Video version EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success EP264 Measuring Your (Agentic) SOC: Two Security Leaders Walk into a Podcast All SOC and SIEM episodes -
Guest:
Arvin Bansal, CISO, C&S Wholesale GrocersTopics:
Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Can you produce the receipts for why this isn't a story of dry goods but rather a very meaty topic with beefy adversaries? How are you as the CISO enabling C&S's journey into AI and LLM driven work? Securing AI is a bit harder than securing classic analytics tools, right? In addition to securely rolling out AI, how is your defense team using AI to secure C&S? Are you into the era of agentic triage and response? What metrics for AI is your D&R lead surfacing up to you? You have AI in the business process that - if failed - will leave people hungry. How do you approach AI resilience? How do you approach resilience in general? Is cloud part of your resilience strategy? You worked at Citigroup for a long time. What's it like having grocery margin budgets for security instead? How does your thinking change? Does this shift your build/buy/outsource for security? If your IoT stack falls over, you've got literal ice cream melting in a warehouse. How do you balance your investments in cyber risk with physical operational risk? Should I be scared of forklifts?Resources:
EP275 Google Cloud Next 2026: The AI Earthquake, "SOC-home" Syndrome, and the Ragged Edge of Reality EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps -
Episode co-host:
Marina Kaganovich, Enterprise Trust Lead, Office of the CISO, Google CloudGuest:
James Sherer, Partner at BakerHostetlerTopics
Is AI just an emerging technology or something bigger, deeper and different? Is this another emerging technology or a fundamental shift? How to effectively govern something that is rapidly changing at unprecedented velocity? We navigated the governance of the Internet and SaaS. What makes AI governance fundamentally different from the "Classic IT" or Data Governance models of the past? As we move toward Agentic AI, the line between tool and teammate blurs. Should we be governing AI agents through the lens of Technical Controls or Human Resources and behavioral contracts? What if we hand even more responsibility to AI? Where are the tipping points as we shift from assistance to autonomy? How to avoid unintended, negative consequences when setting policy, contrasting risk-based vs. rights-based regulation and regulatory expectations Give us some practical takeaways for a defensible AI program - if an organization had to defend its AI program to a regulator or a judge tomorrow?Related episodes:
Video version EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP237 Making Security Personal at the Speed and Scale of TikTok -
Guests:
No guestsTopics:
So what have we seen at Google Cloud Next 2026? Any closing loops for our 2023-2025 Cloud Next observations? We are seeing that AI security is not an island ... what does that tell us about the difference between cloud and AI adoption? What does "ragged edge of AI adoption" mean for security? Why do people want agents in their SOC? Do they know what gets better? What are the most notable and fun announcements? With patching speed, are we looking at something which can be overcome by engineering and courage? Or are we looking at something that is truly an impossibility?Resources:
Video version EP221 Special - Semi-Live from Google Cloud Next 2025: AI, Agents, Security ... Cloud? Next '26: Redefining security for the AI era with Google Cloud and Wiz Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So? EP169 Google Cloud Next 2024 Recap: Is Cloud an Island, So Much AI, Bots in SecOps Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever EP137 Next 2023 Special: Conference Recap - AI, Cloud, Security, Magical Hallway Conversations 260 things we announced at Google Cloud Next '26 – a recap -
Guest:
Grant Dasher, ex-CISA, ex-Google, Distinguished Engineer, Google (again)Topics:
Why is the "Secure-by-Design" movement gaining so much momentum now, and is it a response to the failure of "bolted-on" security, or just a natural evolution of cloud maturity? In a future Secure-by-Design world, is identity the only perimeter that actually matters anymore? Or is this a cliche? As we move toward a world of autonomous agents, how does our approach to machine identity need to change? Are we just talking about more complex Service Accounts, or do we need a fundamental shift in how we authorize "intent" What is your advice to people who want to move fast and cannot wait for Secure by Design / Default AI to be decided by consensus or IETF, NIST or OASIS committee? We love the argument that modern AI agents are effectively repeating the mistakes of 1960s payphones - mixing the data plane and the control plane. What is your rebuttal? How do we build "Agentic Security" that doesn't fall for 60-year-old traps? Customers are torn between their Zero Trust implementations and their AI adoption. Is Zero Trust now "legacy," or is it the prerequisite for everything we're trying to do with AI agents? Is there Zero Trust for AI? Is this a fake buzzword or technical reality?Resources:
Video version EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance EP133 The Shared Problem of Alerting: More SRE Lessons for Security EP85 Deploy Security Capabilities at Scale: SRE Explains How Google SRE books "Atomic Accidents" book (yes, really) -
Guest:
Jeanette Manfra, VP, Head of Risk and Compliance, Google CloudTopics:
How does "outsourcing" security to the cloud change the intensity of the security vs. privacy struggle for a CISO? Does the centralization of cloud make it a bigger target for regulators, or is there a dimension we're missing? Does the Shared Responsibility Model actually survive contact with regulators, and how does AI complicate that boundary? Can AI actually automate the translation of fragmented rules into evidence, or are we just dreaming? How do we navigate the collision between transparency (logging everything) and privacy (recording nothing)? What is your one piece of practical advice for leaders helping their teams adopt AI?Resources:
Video version EP14 Making Compliance Cloud-native EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment? -
Guest:
Raja Mukerji, Co-Founder & Chief Scientist, Extrahop Rafal Los, VP of Client Relations and Strategic Initiatives, ExtrahopTopics:
Is Network Detection and Response (NDR) coming back after being shoved to the side by EDR a bit? Is this for real? What's the value proposition of NDR in 2026, because some people still don't understand it? How does NDR apply to the world of WFH, cloud/SaaS, encryption, high bandwidth, etc? Is the value of NDR the same, or different, when it comes to public (or private) cloud? How does NDR fill visibility gaps that identity and agent-based solutions cannot? What does NDR offer that built-in cloud security tooling (as of right now) does not? Would you call NDR a key cloud security control? Does NDR help with shadow AI? NDR elephant in the room is sometimes cost. How does cost change the value prop when compared to on-premise or physical infrastructure?Resources:
Video version EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty EP113 Love it or Hate it, Network Security is Coming to the Cloud EP154 Mike Schiffman: from Blueboxing to LLMs via Network Security at Google EP115 How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer? EP263 SOC Refurbishing: Why New Tools Won't Fix Broken Processes (Even With AI) "The GC+CISO Connection Book" book -
Guests:
Eric Foster, CEO, Tenex.AI Bashar Abouseido, President, Tenex.AITopics:
"10X SOC" sounds great. But for an organization stuck in "SIEM 1.0" with poor data quality and manual workflows, is "AI-native MDR" a "leapfrog" opportunity or a recipe for disaster? We've seen the rise of "Decoupled SIEM" and security data lakes. Does a "Modern SIEM" even need to exist if an MDR platform has an agentic layer doing the heavy lifting? You've argued for AI-native over AI-bolted-on. For an end user, what are the tangible differences of using "AI inside a legacy SIEM" versus using an "AI-native separate product"? What is the one task you thought AI would handle by now that still requires a senior human analyst to step in? If a CISO is using an AI MDR, "Mean Time to Detect" (MTTD) starts to look like a vanity metric because the machine is instant. What is the new golden metric for an AI-powered SOC? Is it "Time to Context," "Reduction in Human Toil," or something else? How do you help a skeptical SOC Manager—who has been burned by false positives for a decade—trust an autonomous agent to perform a "containment" action at 3:00 AM?Resources:
EP227 AI-Native MDR: Betting on the Future of Security Operations? EP10 SIEM Modernization? Is That a Thing? The original "10X" paper "Autonomic Security Operations: 10X Transformation of the Security Operations Center" -
Guest:
Dan Lorenc, Founder / CEO, ChainguardTopics:
We just saw a security tool (Trivy) get used to pop an AI infrastructure tool (LiteLLM) to eventually pop end users. Have we reached the point where our security tooling is actually our largest unmanaged attack surface? Why now? Software supply chain security had the perennial vibe of "not top concern" for most organizations, right? TeamPCP pushed malicious code to existing GitHub tags. We've been screaming about pinning versions to SHAs for years, but clearly, nobody is listening. Is it time to admit that 'convenience' is the primary enemy of supply chain security? The Axios incident showed a victim compromised in under two minutes. In a world of auto-updating dependencies, is the concept of a human-in-the-loop for software updates officially dead, or do we need to look very hard at version pinning and such? With XZ Utils case, we saw a long-game social engineering attack. Beyond just 'watching npm closely,' what are the realistic architectural safeguards for an org that knows they can't audit every line of an update? We've spent the last three years talking about SBOMs (Software Bill of Materials) like they were a pill for supply chain health. But if the scanner producing the SBOM is the one that's compromised, isn't the SBOM just a signed receipt for your own house being on fire? What is the one practical thing they can do to ensure their CI/CD isn't a credential-exfiltration-as-a-service platform?Resources:
Video version North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack EP100 2022 Accelerate State of DevOps Report and Software Supply Chain Security EP116 SBOMs: A Step Towards a More Secure Software Supply Chain EP226 AI Supply Chain Security: Old Lessons, New Poisons, and Agentic Dreams EP24 Linking Up The Pieces: Software Supply Chain Security at Google and Beyond Matt Levine blog -
Guests:
No guests! Just Tim and AntonTopics:
Hard to believe we've been doing these since 2022, is that right? What did we see this year at RSA, apart from AI? And more AI? And more AI? What framework can we use to understand the approaches vendors take to AI and security? Just saying "AI washing" is not enough! How to tell "AI washer" from "AI tourist"? I sense that "securing AI" (and agents) is finally growing as fast as "using AI for security", do you agree? Is the AI vulnerability apocalypse coming? Soon? Have we seen any signs of AI backlash?Resource:
Video version EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025 RSA 2025: AI's Promise vs. Security's Past — A Reality Check blog EP172 RSA 2024: Separating AI Signal from Noise, SecOps Evolves, XDR Declines? EP119 RSA 2023 - What We Saw, What We Learned, and What We're Excited About EP70 Special - RSA 2022 Reflections - Securing the Past vs Securing the Future EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance -
Guests:
Kelli Vanderlee, Senior Manager, Threat Analysis, Mandiant, Google Cloud Scott Runnels, Mandiant Incident Response, Google CloudTopics:
Do we need to rethink "Mean Time to Respond" entirely, or are we just in deep trouble? Why are threat groups collaborating so well, and are there actual lessons for defenders in their "business" model? What is the scalable advice for teams worried about voice phishing and GenAI cloning? What does "weaponizing the administrative fabric" actually mean in a world where identity is the perimeter? Why is identity/SaaS compromise "news" in 2026 when cloud security folks have been shouting about it for years? What actually changed? What's the latest in supply chain compromise, particularly regarding malicious open-source packages? How do we defend against malware that is "lazy" enough to use the victim's own AI tools for reconnaissance? What is the specific advice for Detection and Response (D&R) teams to handle "living off the land" (or "living off the cloud")? How do you fix the situation when IT and Security departments genuinely hate each other? Besides reading the report, what is the one book or piece of advice for a CISO to survive this year?Resources:
Video version M-Trends 2026 Report EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends EP254 Escaping 1990s Vulnerability Management: From Unauthenticated Scans to AI-Driven Mitigation EP205 Cybersecurity Forecast 2025: Beyond the Hype and into the Reality EP147 Special: 2024 Security Forecast Report "The Evolution of Cooperation" book -
Guest:
Raffael Marty, Operating Advisor, a SIEM legend since 1999Topics:
You argue that declaring existing SIEM being obsolete is a "marketing slogan" rather than a true thesis. What is the real pain point and the actual gap in traditional SIEMs as opposed to the more sensational claims? You highlight that "correlation, state, timelines, and real-time detection require locality," making centralization a necessary trade-off. Can a truly federated or decoupled SIEM architecture achieve the same fidelity and real-time performance for complex, stateful detections as a centralized one? You call the rise of independent security data pipelines the "SIEM Trojan Horse." How quickly is this abstraction layer turning SIEM into a "swappable" component, and what should SIEM vendors have done differently years ago to prevent this market from existing? This "AI SOC" thing, is this even real? Is AI in a SOC a better label? Do you think major SIEM vendors will own this very soon, like they did with UEBA and SOAR? If volume-based pricing is flawed because it penalizes good security hygiene, what is a better SIEM pricing model that fairly addresses compute, enrichment, and retention costs without just shifting the volume cost to unpredictable query charges? You question the idea that startups can find a better way to release detection rules than large vendors with significant content teams. What metrics should security leaders use to evaluate the quality of a vendor's detection engineering (DE) output beyond just coverage numbers? Can AI fix DE?Resources:
Video version The SIEM Maturity Framework: A Practical Scoring Tool for Security Analytics Platforms and raffy.ch/SIEM/ The Gaps That Created the New Wave of SIEM and AI SOC Vendors How AI Impacts the Cyber Market and The Future of SIEM Why Venture Capital Is Betting Against Traditional SIEMs EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI EP234 The SIEM Paradox: Logs, Lies, and Failing to Detect EP125 Will SIEM Ever Die: SIEM Lessons from the Past for the Future Decoupled SIEM: Brilliant or Stupid? Decoupled SIEM: Where I Think We Are Now? -
Guest:
Allie Mellen, Principal Analyst @ Forrester, author of "Code War: How Nations Hack, Spy, and Shape the Digital Battlefield"Topics:
Your book focuses on the US, China, and Russia. When you were planning the book did you also want to cover players like Israel, Iran, and North Korea? Most of our listeners are migrating to or operating heavily in the cloud. As nations refine their "digital battlefield" strategies, does the "shared responsibility model" actually hold up against a nation-state actor? How does a company's detection strategy need to change when the adversary isn't a teenager looking for a ransom, but a state-funded group whose goal might be long-term persistence or subtle data manipulation? How should people allocate their resources to defending against both of these threats? How afraid are you of a "bad guy with AI" scenarios? Mild anxiety or apocalyptic fears? Do you see AI primarily helping "Tier 2" nations close the capability gap with the "Big Three," or does it just further cement the dominance of the nations that own the underlying compute and models? You've spent a lot of time as an analyst looking at how enterprises buy and run security tech. For a CISO at (say) mid-tier logistics company, should 'nation-state cyberattacks' even be on their threat model? Or is worrying about the spies just a form of security theater when they haven't even solved basic credential theft yet?Resource:
Video version "Code War: How Nations Hack, Spy, and Shape the Digital Battlefield" by Allie Mellen Allie Mellen substack The source for the original "air defense on the roof" argument (2008) EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance EP156 Living Off the Land and Attacking Critical Infrastructure: Mandiant Incident Deep Dive "Disrupting the first reported AI-orchestrated cyber espionage campaign" report -
Guest:
Alastair Paterson, CEO and co-founder @ Harmonic SecurityTopics:
Harmonic Security focuses on securing generative AI in use. Can you walk us through a real, anonymized example of a data leak caused by employee AI usage that your platform has identified? AI governance gets thrown around a lot. What does this mean in the context of Shadow AI? How should organizations be thinking about governing AI in light of upcoming AI regulations in the US and in the EU? If we generally agree that employees are using AI tools before they are sanctioned, how can organizations control this? Network, API, endpoint? Many organizations struggle with the "ban vs. embrace" debate for generative AI. Based on your experience, what's a compelling argument for moving from a blanket ban to a managed, secure adoption model? Can you share a success story where this approach demonstrably reduced risk? The term "shadow AI" is often used interchangeably with "shadow IT" (but for AI-powered applications) but you've highlighted that AI is a different beast. What is the single biggest distinction between managing the risk of unsanctioned AI tools versus unsanctioned IT applications? Looking forward, where do you see the biggest risks in the evolution of shadow AI? For instance, will the next threat be from highly specialized AI agents trained on proprietary data, or from the rapid proliferation of new, unmonitored open-source models? Given the speed of change in this space, what's one piece of advice you'd give to a CISO today who is just beginning to get a handle on their organization's shadow AI problem?Resources:
Video version Harmonic Security research Shadow AI Strikes Back: Enterprise AI Absent Oversight in the Age of Gen AI blog Shadow Agents: A New Era of Shadow AI Risk in the Enterprise blog (RSA 2026 presentation coming!) Spotlighting 'shadow AI': How to protect against risky AI practices blog EP171 GenAI in the Wrong Hands: Unmasking the Threat of Malicious AI and Defending Against the Dark Side (aka "dirty bomb episode") A Conversation with Alastair Paterson from Harmonic Security video -
Guests:
Alexander Pabst, Global Deputy CISO, Allianz SE Michael Sinno, Director of D&R, GoogleTopics:
We've spent decades obsessed with MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). As AI agents begin to handle the bulk of triage at machine speed, do these metrics become "vanity metrics"? If an AI resolves an alert in seconds, does measuring the "mean" still tell us anything about the health of our security program, or should we be looking at "Time to Context" instead? You mentioned the Maturity Triangle. Can you walk us through that framework? Specifically, how does AI change the balance between the three points of that triangle—is it shifting us from a "People-heavy" model to something more "Engineering-led," and where does the "Measurement" piece sit? Google is famous for its "Engineering-led" approach to D&R. How is Google currently measuring the success of its own internal D&R program? Specifically, how are you quantifying "Toil Reduction"? Are we measuring how many hours we saved, or are we measuring the complexity of the threats our humans are now free to hunt? Toil reduction is a laudable goal for the team members, what are the metrics we track and report up to document the overall improvement in D&R for Google's board? When you talk to your board about the success of AI in your security program, what are the 2 or 3 "Golden Metrics" that actually move the needle for them? How do you prove that an AI-driven SOC is actually better, not just faster? We often talk about AI as an "assistant," but we're moving toward Agentic SOCs. How should organizations measure the "unit economics" of their SOC? Should we be tracking the ratio of AI-handled vs. Human-handled incidents, and at what point does a high AI-handle rate become a risk rather than a success?Resources:
Video version EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success EP238 Google Lessons for Using AI Agents for Securing Our Enterprise EP91 "Hacking Google", Op Aurora and Insider Threat at Google EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI EP189 How Google Does Security Programs at Scale: CISO Insights EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil The SOC Metrics that Matter…or Do They? blog An Actual Complete List Of SOC Metrics (And Your Path To DIY) blog Achieving Autonomic Security Operations: Why metrics matter (but not how you think) blog -
Guest:
Daniel Lyman, VP of Threat Detection and Response, FiservTopics:
What is the right way for people to bridge the gap and translate executive dreams and board goals into the reality of life on the ground? How do we talk to people who think they have "transformed" their SOC simply by buying a better, shinier product (like a modern SIEM) while leaving their old processes intact? What are the specific challenges and advantages you've seen with a federated SOC versus a centralized one? What does a "federated" or "sub-SOC" model actually mean in practice? Why is the message that "EDR doesn't cover everything" so hard for some people to hear? Is this obsession with EDR a business decision or technology debt? How do you expect AI to change the calculus around data centralization versus data federation? What is your favorite example of telemetry that is useful, but usually excluded from a SIEM? What are the Detection and Response organizational metrics that you think are most valuable? Is the continued use of Excel an issue of tooling, laziness, or just because it is a fundamentally good way to interact with a small database?Resources:
Video version "In My Time of Dying" book EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective The Gravity of Process: Why New Tech Never Fixes Broken Process and Can AI Change It? blog -
Guest:
Alex Shulman-Peleg, Global CISO at KrakenTopics:
You mentioned that centralized security can't work anymore. Can you elaborate on the key changes—driven by cloud, SaaS, and AI—that have made this traditional model unsustainable for a modern organization? Why do some persist at centralized, top down approach to security, despite that? What do you mean by "Freedom, Responsibility and distributed security"? Can you explain the difference between "centralized security" and what you define as "security with distributed ownership"? Is this the same "federated"? In our conversation you mentioned "cloud and AI- native", what do you mean by this (especially "AI-native") and how is this changing your approach to security? You introduce the concept of "Security as quality" suggesting that a security-unaware developer is essentially a bad software developer. How do you shift the culture and internal metrics to make security an inherent quality standard, rather than a separate, compliance-driven checklist? You likened the central security team's new role to a "911 emergency service." Beyond incident response, what stays central no matter what, and how does the central team successfully influence the security posture of the entire organization without being directly responsible for the day-to-day work.Resources:
Video version EP129 How CISO Cloud Dreams and Realities Collide EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps -
Guest:
Dennis Chow, Director of Detection Engineering at UKG
Topics:
We ended our season talking about the AI apocalypse. In your opinion, are we living in the world that the guests describe in their apocalypse paper? Do you think AI-powered attacks are really here, and if so, what is your plan to respond? Is it faster patching? Better D&R? Something else altogether? Your team has a hybrid agent workflow: could you tell us what that means? Also, define "AI agent" please. What are your production use cases for AI and AI agents in your SOC? What are your overall SOC metrics and how does the agentic AI part play into that? It's one thing to ask a team "hey what did y'all do last week" and get a good report - how are you measuring the agentic parts of your SOC? How are you thinking about what comes next once AI is automatically writing good (!) rules for your team out of research blog posts and TI papers?Resources:
Video version Agentic AI in the SOC: Build vs Buy Lessons EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI EP242 The AI SOC: Is This The Automation We've Been Waiting For? Google Cloud Skill Boost - Mostra di più
