Security Weekly Podcast Network (Audio)

Latest Episodes:

Assessing risk at the speed of change, coordinated disclosure, and the news - Danielle Russell - ESW #484 Nov 09, 2026

Show notes

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?

The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.

Segment Resources:

Modernize your TPRM program with adaptive risk management for SaaS and AI
Nudge Security Unveils Adaptive Risk Management press release
The security work nobody wants to do is the risk nobody’s watching
OAuth grants pile up faster than you can review them BleepingComputer

This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!

Topic Segment - Coordinated Disclosure

An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.

Coordinated disclosure in 2026 is:

75% - Too slow for AI world
13% - Vendor Credit Race
13% - This is fine ????????️????
0% - Working as designed
0% - Other (tell me)

Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.

Enterprise Security News

Finally, in the enterprise security news,

A little funding
making software liable for cyber breaches
we have a new biggest bank heist ever!
more freezers defrosted
a company builds malware into their product on purpose
AI pentesting frameworks are lowering the script kiddy bar
AI hosting company hacks their competitor
there’s a new SSH bug that could be very, very bad
even MSPaint gets a vulnerability

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-484

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet and more - SWN #631 Nov 06, 2026

Show notes

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-631

"That’s Not Supposed to Happen" - PSW #951 Nov 05, 2026

Show notes

In the security news:

Supermarket refrigeration attacks, again!
Rapid7’s Ivanti findings and why we can’t have “nice” things
Google’s massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead’s TLS handling
Hackers hijack emergency alert apps
Taiwan’s emergency services become an AI-agent target
CUI exposed through GSA’s Google Drive
GCHQ can’t account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-951

It's The Trickery While Empowering Employees and Redesigning Work for AI - Frank Riccardi - BSW #472 Nov 04, 2026

Show notes

As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself?

Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), joins Business Security Weekly to discuss why it’s not the technology that PWNs you, it’s the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them.

Segment Resources:

https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL

In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-472

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland. - SWN #630 Nov 03, 2026

Show notes

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-630

More Vulns and More Guesswork from Less Data - Jeremiah Grossman - ASW #407 Nov 03, 2026

Show notes

Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.

Resources

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-407

Shifting Cyber Turtles with Casey Ellis, the Vibe Check, and the News - Casey Ellis - ESW #483 Nov 02, 2026

Show notes

Interview with Casey Ellis

Our focus for this interview with Casey Ellis are the massive changes in:

Vulnerability Discovery
Vulnerability Disclosure
Exploitation and Remediation

The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?

Vibe Check

This week's vibe check explores the question, which security project always takes twice as long as planned?

55% - Enforcing data classification
18% - SOAR automation buildout
9% - Rolling out SSO
9% - Moving to passwordless auth
9% - AI agent discovery
0% - Other

News Segment

Finally, in the enterprise security news,

funding and M&A
PHP2Shell update
floods of bugs
silent train
breaches
the script kiddy bar has been lowered
the basics continue to be important
an AI lab pulls a PR stunt
an old squirrel story was a scam!

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-483

Mrfoofoo, Binance, Polymarket, Silent Train, robosurance, privacy, and Josh Marpet - SWN #629 Oct 30, 2026

Show notes

Mrfoofoospicy, Binance, Polymarket, Ada Lovelace, Silent Train, Robosurance, Privacy Piracy, Josh Marpet, and More on this episode of Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-629

Vulnpocalypse Continues Until Defense Improves - PSW #950 Oct 29, 2026

Show notes

In the security news this week:

Cisco says patch faster, then sells you time
Turning AI refusals into vulnerability signals
Brotli’s are hiding
WordPress image upload exploit
Fortinet ships fixes before details
PHP2Shell still claiming victims, including firewalls
Uncoordinated disclosure
Claude finds vulns, go figure
PXE strikes again!
Sony’s PS5 bounty drama
Apple’s October patches reach older devices
CISA looks ahead to 2030
ArubaOS gets a pile of critical fixes
New UK rules for protecting undersea infrastructure
PortaPack Mayhem goes mobile
Can AI agents police other AI agents?
DHS bans DeepSeek
A Chinese model writes riskier code for a US contractor
eMudhra exits the TLS business
BlackX bootkit exploits Secure Boot
Signal makes hanging up harder than it should be
Is AI solving math, or making it harder to trust?

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-950

CyberSN Jobs Report as CIOs and CISOs are Unaccountable and Unprepared for AI - BSW #471 Oct 28, 2026

Show notes

CyberSN just released their Cybersecurity Jobs Report through September 2026. We’ll cover that in the leadership and communications segment along with, Only 7% of CISOs at Large Companies Own AI Governance, Our Favorite Management Tips on Delegating Effectively, CIOs unprepared for agentic workforce shift, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-471

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Audio)

Related Podcasts

Links

Stay Connected