这是indexloc提供的服务,不要输入任何密码

Cloud Security Podcast

Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!

cloud-security-podcast_high_res.png

Episode list

#251
November 10, 2025

EP251 Beyond Fancy Scripts: Can AI Red Teaming Find Truly Novel Attacks?

Guest:

29:29

Topics covered:

  • The market already has Breach and Attack Simulation (BAS) for testing known TTPs. You’re calling this 'AI-powered' red teaming. Is this just a fancy LLM stringing together known attacks, or is there a genuine agent here that can discover a truly novel attack path that a human hasn't scripted for it?
  • Let's talk about the 'so what?' problem. Pentest reports are famous for becoming shelf-ware. How do you turn a complex AI finding into an actionable ticket for a developer, and more importantly, how do you help a CISO decide which of the thousand 'criticals' to actually fix first?
  • You're asking customers to unleash a 'hacker AI' in their production environment. That’s terrifying. What are the 'do no harm' guardrails? How do you guarantee your AI won't accidentally rm -rf a critical server or cause a denial of service while it's 'exploring'?
  • You mentioned the AI is particularly good at finding authentication bugs. Why that specific category? What's the secret sauce there, and what's the reaction from customers when you show them those types of flaws?
  • Is this AI meant to replace a human red teamer, or make them better? Does it automate the boring stuff so experts can focus on creative business logic attacks, or is the ultimate goal to automate the entire red team function away?
  • So, is this just about finding holes, or are you closing the loop for the blue team? Can the attack paths your AI finds be automatically translated into high-fidelity detection rules? Is the end goal a continuous 'purple team engine' that’s constantly training our defenses?
  • Also, what about fixing? What makes your findings more fixable?
  • What will happen to red team testing in 2-3 years if this technology gets better?
#250
November 3, 2025

EP250 The End of "Collect Everything"? Moving from Centralization to Data Access?

Guest:

Topics:

SIEM and SOC
29:29

Topics covered:

  • Are we really coming  to “access to security data” and away from “centralizing the data”?
  • How to detect without the same storage for all logs?
  • Is data pipeline a part of SIEM or is it standalone? Will this just collapse into SIEM soon?
  • Tell us about the issues with log pipelines in the past?
  • What about enrichment? Why do it in a pipeline, and not in a SIEM?
  • We are unable to share enough practices between security teams. How are we fixing it? Is pipelines part of the answer?
  • Do you have a piece of advice for people who want to do more than save on their SIEM costs?
#249
October 27, 2025

EP249 Data First: What Really Makes Your SOC 'AI Ready'?

Guest:

Topics:

SIEM and SOC
29:29

Topics covered:

  • We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from achieving it today?
  • You've also raised a metaphor of AI in the SOC as a "Dr. Jekyll and Mr. Hyde" situation. Could you walk us through what you see as the "Jekyll"—the noble, beneficial promise of AI—and what are the factors that can turn it into the dangerous "Mr. Hyde"?
  • Let's drill down into the heart of the "Mr. Hyde" problem: the data. Many believe that AI can fix a team's messy data, but you've noted that "it's all about the data, duh." What's the story?
  • “AI ready SOC” - What is the foundational work a SOC needs to do to ensure their data is AI-ready, and what happens when they skip this step?  
  • And is there anything we can do to use AI to help with this foundational problem?
  • How do we measure progress towards AI SOC? What gets better at what time? How would we know? 
  • What SOC metrics will show improvement? Will anything get worse? 
#248
October 20, 2025

EP248 Cloud IR Tabletop Wins: How to Stop Playing Security Theater and Start Practicing

Guest:

  • Jibran Ilyas, Director for Incident Response at Google Cloud
29:29

Topics covered:

  • What is this tabletop thing, please tell us about running a good security incident tabletop? 
  • Why are tabletops for incident response preparedness so amazingly effective yet rarely done well?
  • This is cheap/easy/useful so why do so many fail to do it? Why are tabletops seen as kind of like elite pursuit?
  • What’s your favorite Cloud-centric scenario for tabletop exercises? Ransomware? But there is little ransomware in the cloud, no?
  • What are other good cloud tabletop scenarios?
#247
October 13, 2025

EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion

Guest:

  • David Gee, Board Risk Advisor, Non-Executive Director & Author, former CISO

Topics:

CISO
29:29

Topics covered:

  • Drawing from the "Aspiring CIO and CISO" book's focus on continuous improvement, how have you seen the necessary skills, knowledge, experience, and behaviors for a CISO evolve, especially when guiding an organization through a transformation?
  • Could you share lessons learned about leadership and organizational resilience during such a critical period, and how does that experience reshape your approach to future transformations?
  • Many organizations are undergoing transformations, often heavily involving cloud technologies. From your perspective, what is the most crucial—and perhaps often overlooked—role a CISO plays in ensuring security is an enabler, not a roadblock, during such large-scale changes?
  • Have you ever seen a CISO who is a cloud champion for the organization?
  • Your best advice for a CISO meeting cloud for the first time?
  • What is your best advice for a CISO meeting AI for the first time?
  • How do you balance the continuous self-improvement and development with the day-to-day pressures and responsibilities?
#246
October 6, 2025

EP246 From Scanners to AI: 25 Years of Vulnerability Management with Qualys CEO Sumedh Thakar

Guest:

29:29

Topics covered:

  • How did vulnerability management (VM) change since Qualys was founded in 1999? What is different about VM today?
  • Can we actually remediate vulnerabilities automatically at scale? Why did this work for you even though many expected it would not?
  • Where does cloud fit into modern vulnerability management?
  • How does AI help vulnerability management today? Is this primarily better prioritization? What is real?
  • What is this Risk Operations Center (ROC) concept and how it helps in vulnerability management?
#245
September 29, 2025

EP245 From Consumer Chatbots to Enterprise Guardrails: Securing Real AI Adoption

Guest:

29:29

Topics covered:

  • In what ways is the current wave of enterprise AI adoption different from previous technology shifts? If we say “but it is different this time”, then why?
  • What is your take on “consumer grade AI for business” vs enterprise AI?
  • A lot of this sounds a bit like the CASB era circa 2014. How is this different with AI? 
  • The concept of "routing prompts for risk and cost management" is intriguing. Can you elaborate on the architecture and specific AI engines Witness AI uses to achieve this, especially for large global corporations? 
  • What are you seeing in the identity space for AI access? Can you give us a rundown of the different tradeoffs teams are making when it comes to managing identities for agents? 
#244
September 22, 2025

EP244 The Future of SOAPA: Jon Oltsik on Platform Consolidation vs. Best-of-Breed in the Age of Agentic AI

Guest:

29:29

Topics covered:

  • You invented the concept of SOAPA – Security Operations & Analytics Platform Architecture. As we look towards SOAPA 2025, how do you see the ongoing debate between consolidating security around a single platform versus a more disaggregated, best-of-breed approach playing out? 
  • What are the key drivers for either strategy in today's complex environments? How can we have both “decoupling” and platformization going at the same time?
  • With all the buzz around Generative AI and Agentic AI, how do you envision these technologies changing the future of the Security Operations Center (and SOAPA of course)? 
  • Where do you see AI really work today in the SOC and what is the proof of that actually happening? What does a realistic "AI SOC" look like in the next few years, and what are the practical implications for security teams?
  • “Integration” is always a hot topic in security - and it has been for decades. Within the context of SOAPA and the adoption of advanced analytics, where do you see the most critical integration challenges today – whether it's vendor-centric ecosystems, strategic partnerships, or the push for open standards?
#243
September 15, 2025

EP243 Email Security in the AI Age: An Epic 2025 Arms Race Begins

Guests:

29:29

Topics covered:

  • What is the state of email security in 2025?
  • Why start an email security company now?
  • Is it true that there are new and accelerating AI threats to email?
  • It sounds cliche, but do you really have to use good AI to fight bad AI?
  • What did you learn from your time fighting abuse at scale at Google that is helping you now
  • How do you see the future of email security and what role will AI play?
#242
September 8, 2025

EP242 The AI SOC: Is This The Automation We've Been Waiting For?

Guest:

29:29

Topics covered:

  • What is your definition of “AI SOC”?
  • What will AI change in a SOC? What will the post-AI SOC look like? 
  • What are the primary mechanisms by which AI SOC tools reduce attacker dwell time, and what challenges do they face in maintaining signal fidelity?
  • Why would this wave of SOC automation (namely, AI SOC)  work now, if it did not fully succeed before (SOAR)?
  • How do we measure progress towards AI SOC? What gets better at what time? How would we know? What SOC metrics will show improvement?
  • What common misconceptions or challenges have organizations encountered during the initial stages of AI SOC adoption, and how can they be overcome?
  • Do you have a timeline for SOC AI adoption? Sure, everybody wants AI alerts triage? What’s next? What's after that?