Cloud Security Podcast by Google

View Top 200 Chart

Back to Rankings Page

Technology
**Cloud Security Podcast by Google**

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users’ data safe and workloads secure.

We’re going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject’s benefit or just for organizational benefit.

We hope you’ll join us if you’re interested in where technology overlaps with process and bumps up against organizational design. We’re hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can’t keep as the world moves from on-premises computing to cloud computing.

Latest Episodes:

EP243 Email Security in the AI Age: An Epic 2025 Arms Race Begins Sep 15, 2025

Show notes

Guest:

Cy Khormaee, CEO, AegisAI
Ryan Luo, CTO, AegisAI

Topics:

What is the state of email security in 2025?
Why start an email security company now?
Is it true that there are new and accelerating AI threats to email?
It sounds cliche, but do you really have to use good AI to fight bad AI?
What did you learn from your time fighting abuse at scale at Google that is helping you now
How do you see the future of email security and what role will AI play?

Resources:

EP242 The AI SOC: Is This The Automation We've Been Waiting For? Sep 08, 2025

Show notes

Guest:

Augusto Barros, Principal Product Manager, Prophet Security, ex-Gartner analyst

Topics:

What is your definition of "AI SOC"?
What will AI change in a SOC? What will the post-AI SOC look like?
What are the primary mechanisms by which AI SOC tools reduce attacker dwell time, and what challenges do they face in maintaining signal fidelity?
Why would this wave of SOC automation (namely, AI SOC) work now, if it did not fully succeed before (SOAR)?
How do we measure progress towards AI SOC? What gets better at what time? How would we know? What SOC metrics will show improvement?
What common misconceptions or challenges have organizations encountered during the initial stages of AI SOC adoption, and how can they be overcome?
Do you have a timeline for SOC AI adoption? Sure, everybody wants AI alerts triage? What's next? What's after that?

Resources:

EP241 From Black Box to Building Blocks: More Modern Detection Engineering Lessons from Google Sep 01, 2025

Show notes

Guest:

Rick Correa,Uber TL Google SecOps, Google Cloud

Topics:

On the 3rd anniversary of Curated Detections, you've grown from 70 rules to over 4700. Can you walk us through that journey? What were some of the key inflection points and what have been the biggest lessons learned in scaling a detection portfolio so massively?
Historically the SecOps Curated Detection content was opaque, which led to, understandably, a bit of customer friction. We've recently made nearly all of that content transparent and editable by users. What were the challenges in that transition?
You make a distinction between "Detection-as-Code" and a more mature "Software Engineering" paradigm. What gets better for a security team when they move beyond just version control and a CI/CD pipeline and start incorporating things like unit testing, readability reviews, and performance testing for their detections?
The idea of a "Goldilocks Zone" for detections is intriguing – not too many, not too few. How do you find that balance, and what are the metrics that matter when measuring the effectiveness of a detection program? You mentioned customer feedback is important, but a confusion matrix isn't possible, why is that?
You talk about enabling customers to use your "building blocks" to create their own detections. Can you give us a practical example of how a customer might use a building block for something like detecting VPN and Tor traffic to augment their security?
You have started using LLMs for reviewing the explainability of human-generated metadata. Can you expand on that? What have you found are the ripe areas for AI in detection engineering, and can you share any anecdotes of where AI has succeeded and where it has failed?

Resources

EP240 Cyber Resiliency for the Rest of Us: Making it Happen on a Real-World Budget Aug 25, 2025

Show notes

Guest:

Errol Weiss, Chief Security Officer (CSO) at Health-ISAC

Topics:

How adding digital resilience is crucial for enterprises? How to make the leaders shift from "just cybersecurity" to "digital resilience"?
How to be the most resilient you can be given the resources? How to be the most resilient with the least amount of money?
How to make yourself a smaller target?
Smaller target measures fit into what some call "basics." But "Basic" hygiene is actually very hard for many. What are your top 3 hygiene tips for making it happen that actually work?
We are talking about under-resources orgs, but some are much more under-resourced, what is your advice for those with extreme shortage of security resources?
Assessing vendor security - what is most important to consider today in 2025? How not to be hacked via your vendor?

Resources:

EP239 Linux Security: The Detection and Response Disconnect and Where Is My Agentless EDR Aug 18, 2025

Show notes

Guest:

Craig H. Rowland, Founder and CEO, Sandfly Security

Topics:

When it comes to Linux environments – spanning on-prem, cloud, and even–gasp–hybrid setups – where are you seeing the most significant blind spots for security teams today?
There's sometimes a perception that Linux is inherently more secure or less of a malware target than Windows. Could you break down some of the fundamental differences in how malware behaves on Linux versus Windows, and why that matters for defenders in the cloud?
'Living off the Land' isn't a new concept, but on Linux, it feels like attackers have a particularly rich set of native tools at their disposal. What are some of the more subtly abused but legitimate Linux utilities you're seeing weaponized in cloud attacks, and how does that complicate detection?
When you weigh agent-based versus agentless monitoring in cloud and containerized Linux environments, what are the operational trade-offs and outcome trade-offs security teams really need to consider?
SSH keys are the de facto keys to the kingdom in many Linux environments. Beyond just 'use strong passphrases,' what are the critical, often overlooked, risks associated with SSH key management, credential theft, and subsequent lateral movement that you see plaguing organizations, especially at scale in the cloud?
What are the biggest operational hurdles teams face when trying to conduct incident response effectively and rapidly across such a distributed Linux environment, and what's key to overcoming them?

Resources:

EP238 Google Lessons for Using AI Agents for Securing Our Enterprise Aug 11, 2025

Show notes

Guest:

Dominik Swierad, Senior PM D&R AI and Sec-Gemini

Topics:

When introducing AI agents to security teams at Google, what was your initial strategy to build trust and overcome the natural skepticism? Can you walk us through the very first conversations and the key concerns that were raised?
With a vast array of applications, how did you identify and prioritize the initial use cases for AI agents within Google's enterprise security?
What specific criteria made a use case a good candidate for early evaluation? Were there any surprising 'no-go' areas you discovered?"
Beyond simple efficiency gains, what were the key metrics and qualitative feedback mechanisms you used to evaluate the success of the initial AI agent deployments?
What were the most significant hurdles you faced in transitioning from successful pilots to broader adoption of AI agents?
How do you manage the inherent risks of autonomous agents, such as potential for errors or adversarial manipulation, within a live and critical environment like Google's?
How has the introduction of AI agents changed the day-to-day responsibilities and skill requirements for Google's security engineers?
From your unique vantage point of deploying defensive AI agents, what are your biggest concerns about how threat actors will inevitably leverage similar technologies?

Resources:

EP237 Making Security Personal at the Speed and Scale of TikTok Aug 04, 2025

Show notes

Guest:

Kim Albarella, Global Head of Security, TikTok

Questions:

Security is part of your DNA. In your day to day at TikTok, what are some tips you'd share with users about staying safe online?
Many regulations were written with older technologies in mind. How do you bridge the gap between these legacy requirements and the realities of a modern, microservices-based tech stack like TikTok's, ensuring both compliance and agility?
You have a background in compliance and risk management. How do you approach demonstrating the effectiveness of security controls, not just their existence, especially given the rapid pace of change in both technology and regulations?
TikTok operates on a global scale, facing a complex web of varying regulations and user expectations. How do you balance the need for localized compliance with the desire for a consistent global security posture? How do you avoid creating a fragmented and overly complex system, and what role does automation play in this balancing act?
What strategies and metrics do you use to ensure auditability and provide confidence to stakeholders?
We understand you've used TikTok videos for security training. Can you elaborate on how you've fostered a strong security culture internally, especially in such a dynamic environment?
What is in your TikTok feed?

Resources:

EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI Jul 28, 2025

Show notes

Guest:

Manija Poulatova, Director of Security Engineering and Operations at Lloyd's Banking Group

Topics:

SIEM migration is hard, and it can take ages. Yours was - given the scale and the industry - on a relatively short side of 9 months. What's been your experience so far with that and what could have gone faster?
Anton might be a "reformed" analyst but I can't resist asking a three legged stool question: of the people/process/technology aspects, which are the hardest for this transformation? What helped the most in solving your big challenges?
Was there a process that people wanted to keep but it needed to go for the new tool?
One thing we talked about was the plan to adopt composite alerting techniques and what we've been calling the "funnel model" for detection in Google SecOps. Could you share what that means and how your team is adopting?
There are a lot of moving parts in a D&R journey from a process and tooling perspective, how did you structure your plan and why?
It wouldn't be our show in 2025 if I didn't ask at least one AI question! What lessons do you have for other security leaders preparing their teams for the AI in SOC transition?

Resources:

EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom Jul 21, 2025

Show notes

Guest:

Anna Gressel, Partner at Paul, Weiss, one of the AI practice leads

Episode co-host:

Marina Kaganovich, Office of the CISO, Google Cloud

Questions:

Agentic AI and AI agents, with its promise of autonomous decision-making and learning capabilities, presents a unique set of risks across various domains. What are some of the key areas of concern for you?
What frameworks are most relevant to the deployment of agentic AI, and where are the potential gaps?
What are you seeing in terms of how regulatory frameworks may need to be adapted to address the unique challenges posed by agentic AI?
How about legal aspects - does traditional tort law or product liability apply?
How does the autonomous nature of agentic AI challenge established legal concepts of liability and responsibility?
The other related topic is knowing what agents "think" on the inside. So what are the key legal considerations for managing transparency and explainability in agentic AI decision-making?

Resources:

EP234 The SIEM Paradox: Logs, Lies, and Failing to Detect Jul 14, 2025

Show notes

Guest:

Svetla Yankova, Founder and CEO, Citreno

Topics:

Why do so many organizations still collect logs yet don't detect threats? In other words, why is our industry spending more money than ever on SIEM tooling and still not "winning" against Tier 1 ... or even Tier 5 adversaries?
What are the hardest parts about getting the right context into a SOC analyst's face when they're triaging and investigating an alert? Is it integration? SOAR playbook development? Data enrichment? All of the above?
What are the organizational problems that keep organizations from getting the full benefit of the security operations tools they're buying?
Top SIEM mistakes? Is it trying to migrate too fast? Is it accepting a too slow migration? In other words, where are expectations tyrannical for customers? Have they changed much since 2015?
Do you expect people to write their own detections? Detecting engineering seems popular with elite clients and nobody else, what can we do?
Do you think AI will change how we SOC (Tim: "SOC" is not a verb?) in the next 1- 3 -5 years?
Do you think that AI SOC tech is repeating the mistakes SOAR vendors made 10 years ago? Are we making the same mistakes all over again? Are we making new mistakes?

Resources:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cloud Security Podcast by Google

Related Podcasts

Links

Stay Connected