Risky Business

Latest Episodes:

Risky Business #858 -- The $6.3b laptop Nov 04, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Ciaran Martin, former CEO of the UK’s National Cyber Security Centre (NCSC), to talk through the week’s cybersecurity news, including:

The $6.3 billion dollar Binance hack turned out to be pretty clunky, but it ain’t dumb if it works we guess
Meanwhile Brazil’s Mercado Bitcoin loses “millions”. Cute!
A bit late to make the Word of the Year shortlist, but Google’s coined a new term with “LLMjacking”
An infosec guy’s clankers hacked another infosec guy, everyone’s arguing about it, it’s funny Much, much more!

This week’s show is brought to you by runZero. VP of Security Research Tod Beardsley joins Patrick Gray to chat about fear around the looming post-quantum cryptography crisis, and how CISOs can use it as an opportunity to clean up house and finally take all the end-of-life products out to pasture.

This episode is also available on YouTube

Show notes

Snake Oilers: Minimal.dev, Request Rocket and TRM Labs Oct 30, 2026

Show notes

In this edition of the Snake Oilers podcast, three vendors drop by to pitch their products.

Minimal.dev: A sandbox for AI agents! Co-Founder and CEO Jake King explains what the company is and how it works.

Request Rocket: Runtime access control for AI agents and APIs. Founder and CTO Alex Ferguson drops by to talk about the problem the company is trying to solve.

TRM Labs: All-source threat intelligence. Global Strategic Accounts Director Simon Warren talks about the company’s platform Ardence.

This episode is also available on YouTube.

Show notes

Risky Business #857 -- AI FUD intensifies Oct 28, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:

Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do
Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?
Last week’s PHP meteor seems to have missed Earth
This week’s Brotli HTTP/2 critical flaw is this week’s meteor
The private key is always 4. This time it’s TLS bugs in GoAhead
Much, much more!

This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse.

This episode is also available on YouTube

Show notes

Risky Business #856 -- 8-bit encryption, PHP megabugs and more Oct 21, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:

The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
Is the breach-polcalypse upon us?
OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line
Much, much more!

This week’s show is brought to you by Trail of Bits. Principal Security Engineer Anish Naik joins James Wilson to chat about two agent skills plugins, Patching Bugs and Regression Hunt, that the company is releasing off the back of its joint initiative with Open AI, Patch the Planet.

This episode is also available on YouTube

Show notes

Risky Business #855 -- ShinyHunters done sowing, enters reaping phase Oct 14, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Brad Arkin to talk through the week’s cybersecurity news, including:

Sacré bleu! Hackers turn up the heat at French supermarket freezers
ShinyHunters enters “find out” stage
Netscaler, Zimbra, SharePoint, Atlassian…. So many bugs exploited in the wild
More models “behave badly” (by… doing exactly what we’re telling them to do)
Ukraine hit another Yandex data centre in Russia and all those Texan patriots with numbers in their usernames have gone super quiet
Much, much more…

This week’s show is brought to you by Corelight. Co-founder and Chief Strategy Officer Gregory Bell joins James Wilson to chat about the company’s new white paper that looks into whether a sophisticated model or nicely structured data is more important with automated SOC work.

This episode is also available on YouTube

Show notes

Soap Box: HD Moore talks OT security, frontier fearmongering and more Sep 30, 2026

Show notes

In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with industry legend HD Moore about how his company runZero wound up being used heavily to discover OT devices in enterprise networks.

They also talk about the vulnpocalypse and how frontier lab fearmongering is reminiscent of the collective freakout when HD released the Metasploit exploit framework back in 2003.

This episode is also available on YouTube.

Show notes

Risky Business #854 -- We're Jevpilled Sep 23, 2026

Show notes

THE RISKY BUSINESS WEEKLY SHOW IS NOW ON HIATUS FOR TWO WEEKS AND WILL RETURN OCTOBER 14

On this week’s show Patrick Gray and James Wilson are joined by Adam Boileau to talk through the week’s news, including:

Google’s Gemini finally did some crimes
OpenAI admits more agents did silly things because “alignment”
US Treasury’s Scott Bessent rules out a liability waiver for the frontier labs, saying, roughly: “Lol. Lmao even.”
Jev is Silicon Valley’s “hot dog/not hotdog” app brought to life, and it will really improve security tooling
The FBI and Coast Guard boarded oil tankers after they were allegedly hacked
Much, much more…

This week’s show is brought to you by Thinkst Canary. Founder Haroon Meer joins Patrick to talk about Thinkst’s new deception tools that trick the AI agents that are targeting you. It’s actually hilarious how well deception tech works against hacking agents.

This episode is also available on YouTube

Show notes

Risky Business #853 -- We're all gonna die, apparently Sep 16, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by former US Cyber Command executive director turned PwC’s Cyber, Data & Technology Risk leader Morgan Adamski to talk through the week’s news, including:

More tech guys penned more open letters and AI will destroy us all!
Another Wednesday, another congregation of OpenAI agents on wikis… yawn
OpenAI agents were behind the headscratching RubyGems hacking campaign in May
The FBI will disrupt more adversary operations, NSA is creating more mission centres, lawmakers want sanctions on hackers-for-hire… Release more hounds!
So many platforms, so many bugs, so many patches breaking other stuff
Much, much more…

This week’s show is brought to you by Airlock Digital. Its co-founders Daniel Schell and David Cottingham join Patrick to talk about how Airlock has integrated itself with Crowdstrike via its Falcon Foundry platform.

This episode is also available on YouTube

Show notes

Snake Oilers: watchTowr, XBOW and CoreView Sep 11, 2026

Show notes

In this edition of the Snake Oilers podcast three vendors stop by to pitch the audience on their products:

watchTowr: We’re all familiar with watchTowr’s research, but what do they actually do?
XBOW: The AI pentesting company pitches its approach
CoreView: Your M365 tenant is probably a security disaster. Tame it with CoreView!

This episode is also available on YouTube.

Show notes

Risky Business #852 -- Cyber Command wants to buy shells Sep 09, 2026

Show notes

On this week’s show Patrick Gray and James Wilson are joined by guest co-host Robby Winchester from SpecterOps to talk through the week’s news, including:

ID verification company IDScan was breached and 153m driver licenses wound up for sale online. Cue the barrage of lawsuits
The US government plans to pay private contractors to conduct military hacks
The US accuses China of distillation attacks, a.k.a. forbidden training
It’s Wednesday, so OpenAI’s agents escaped sandboxes again and passed notes around on a German Wiki
Much, much more…

This week’s show is brought to you by Sublime Security. Sublime’s head of detection engineering Randy Pargman joins the show to chat about how the company is preparing for prompt injection attacks to move from being largely theoretical to commonplace.

This episode is also available on YouTube