Security Weekly Podcast Network (Audio)

Latest Episodes:

Figuring Out Where to Start with Secure Code - ASW #358 Nov 25, 2025

Show notes

What are your favorite resources for secure code? Co-hosts John Kinsella and Kalyani Pawar talk about the reality of bringing security into a business. We talk about the role of the OWASP Top 10 and the OWASP ASVS in crafting security programs. And balance that with a discussion in what's the best use of everyone's time -- developers and appsec folks alike -- in crafting code that's secure by design rather than just secure from scanner results.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-358

Aligning teams for effective remediation, Anthropic's latest report, and the news - Ravid Circus - ESW #434 Nov 24, 2025

Show notes

Interview with Ravid Circus

Ravid will discuss why security and engineering misalignment is the biggest barrier to fast, effective remediation, using data from Seemplicity’s 2025 Remediation Operations Report. This is costing some teams days of unnecessary exposure, which can lead to major security implications for organizations.

Segment Resources:

Topic Segment: Thoughts on Anthropic's latest security report

Ex-SC Media journalist Derek Johnson did a great job writing this one up over at Cyberscoop: China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work

There are a number of interesting questions that have been raised here. Some want more technical details and question the report's conclusions. How automated was it, really?

I found it odd that Anthropic's CEO was on 60 minutes the same week, talking about how dangerous AI is (which is his company's primary and only product).

I think one of the more interesting things to discuss is how Anthropic has based its identity and brand on AI safety. While so many other SaaS companies appear to be doing the bare minimum to stop attacks against their customers, Anthropic is putting significant resources into testing for future threats and discovering active attacks.

News Segment

Finally, in the enterprise security news,

vendor layoffs have started again
the sins of security vendor research
the pillars of the Internet are burning
selling out to North Korea isn’t worth what they’re paying you
ransom payments, in 24 easy installments?
a breach handled the right way
we probably shouldn’t be putting LLMs into kids toys
ordering coffee from the terminal

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-434

Emoticons, Sonicwall, Global Protect, Pop ups, WhatsApp, 7Zip, Roblox, Josh Marpet... - SWN #531 Nov 21, 2025

Show notes

Emoticons, Sonicwall, Global Protect, Pop-ups, WhatsApp, 7Zip, Roblox, Josh Marpet, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-531

Give Me Liberty or Linux, Badge Hacking Interview - Bryce Owen - PSW #901 Nov 20, 2025

Show notes

In the security news:

Cloudflare was down, it was not good
Logitech breached
The largest data breach in history?
Fortinet Fortiweb - the saga continues
Hacking Linux through your malware scanner, oh the irony
I never stopped hating systemd
The ASUS exploit that never existed
If iRobot fails, can we deploy our own hacker bot army?
Firmware encryption is a bitch
Threat actors deply Claude Code
Remembering the Viasat hack and why we can't have nice things
Hacking re-entry sensors
Sending signals in the wrong direction
A File Format Uncracked for 20 Years
And 2026 is the year of the Linux desktop!

Then, high school junior Bryce Owen joins us to discuss how he created the "Space Badge"!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-901

Health and Wellness of the CISO as They Crack Under Pressure and Need a BISO to Scale - Dr. Yonesy Núñez - BSW #422 Nov 19, 2025

Show notes

It's a topic we discuss often on Business Security Weekly: CISO Burnout. It's real, but how should you manage it?

Dr. Yonesy Núñez, Global Cybersecurity Executive at Chain Bridge Bank and former Managing Director, Chief Cybersecurity Risk Officer, and Chief Information Security Officer at The Depository Trust & Clearing Corporation (DTCC), joins Business Security Weekly to share his personal insights. An advocate of CISO Health and Wellness, Yonesy will discuss how we can "Optimize the Operator" by creating harmony with mind and spirit.

Segment Resources: https://councils.forbes.com/profile/Yonesy-Nunez-Global-Cybersecurity-Executive-Chain-Bridge-Bank/e79e72a5-4b18-48b1-b5ab-8a0afd47d782

In the leadership and communications segment, CISOs are cracking under pressure, How BISOs enable CISOs to scale security across the business, Great Leaders Empower Strategic Decision-Making Across the Organization, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-422

Cloudflare, Gh0stRAT, npm, North Koreans, Arch, Steam, Documentaries, Aaran Leyland.. - SWN #530 Nov 18, 2025

Show notes

Cloudflare, Gh0stRAT, npm, North Korean Employees, Arch Linux Steam Machine, Documentaries, Aaran Leyland, and more on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-530

Secure Coding as Critical Thinking Instead of Vulnspotting - Matias Madou - ASW #357 Nov 18, 2025

Show notes

Secure code should be grounded more in concepts like secure by default and secure by design than by "spot the vuln" thinking. Matias Madou shares his experience in secure coding training and the importance of teaching critical thinking. He also discusses why critical thinking is so closely related to threat modeling and how LLMs can be a tool for helping developers get beyond the superficial advice of, "Think like an attacker."

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-357

Year of the (Clandestine) Linux Desktop, topic, and the news - Rob Allen - ESW #433 Nov 17, 2025

Show notes

Segment 1: Interview with Rob Allen

It’s the Year of the (Clandestine) Linux Desktop!

As if EDR evasions weren’t enough, attackers are now employing yet another method to hide their presence on enterprise systems: deploying tiny Linux VMs. Attackers are using Hyper-V and/or WSL to deploy tiny (120MB disk space and 256MB memory) Linux VMs to host a custom reverse shell and reverse proxy.

In this segment, we’ll discuss strategies and mitigations to battle this novel technique with Rob Allen from Threatlocker.

Segment Resources:

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Segment 2: Topic - Threat Modeling Humanoid Robots

We're entering the age of human-shaped robots, so it seems like a good time to talk about the fact that they ALREADY HAVE CVEs assigned to them. I guess this isn't a terrible thing - John Connor might have had an easier time if he could simply hack the terminators from a distance...

Resources

https://www.unitree.com/H2 (watch the video!)
China’s humanoid robots get factory jobs as UBTech’s model scores US$112 million in orders
The big reveal: Xpeng founder unzips humanoid robot to prove it’s not human
Exploit Allows for Takeover of Fleets of Unitree Robots - Security researchers find a wormable vulnerability
100-page Paper: The Cybersecurity of a Humanoid Robot
5-page Paper: Cybersecurity AI: Humanoid Robots as Attack Vectors
Amazingly, $300 smart vacuums have some of the same exact vulnerabilities and backdoors built into them as the $16,000 humanoid robots! The Day My Smart Vacuum Turned Against Me

Segment 3: Weekly News

Finally, in the enterprise security news,

A $435M venture round
A $75M seed round
a few acquisitions
the producer of the movie Half Baked bought a spyware company
AI isn’t going well, or is it?
maybe we just need to adopt it more slowly and deliberately?
ad-blockers are enterprise best practices
firewalls and VPNs are security risks, according to insurance claims
could you power an entire house with disposable vapes?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-433

Augustus De Morgan, Doordash, Fortiweb, Typosquatting, Vista, Ransomware, AI, More... - SWN #529 Nov 14, 2025

Show notes

Augustus De Morgan, Doordash, Fortiweb, Typosquatting, Vista, Ransomware, AI, Josh, Rob, Aaran, Jason, Dr. Scott, Rocky, Uh., and More on this edition of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-529

Going Around EDR - PSW #900 Nov 13, 2025

Show notes

This week: