Security Weekly Podcast Network (Video)

Latest Episodes:

Oops, all Interviews: Switching to Cyber, CISO Reflections, and the State of TPCRM - Lenny Zeltser, Helen Patton, Alexandre Sieira - ESW #452 Mar 30, 2026

Show notes

Interview with Helen Patton about her new book, Switching to Cyber

Helen joins us to discuss her second book, "Switching to Cyber." Her first book discussed strategies for handling various stages of the cybersecurity career, while this one, co-written with Josiah Dykstra, provides a guide for switching to cyber mid-career.

Check out her book, Switching to Cyber: The Mid-Career Guide to Launching a Cybersecurity Career:

on Amazon
on Barnes & Noble
and on the publisher's website

Interview with Lenny Zeltzer: Reflections on Being a CISO

After a cybersecurity career in various roles, doing everything from product management to malware analysis training, Lenny spent 6 years in the CISO seat at Axonius, from near the inception of the company through its growth from its modest Series A stage in 2019 to the present, with nearly a billion in funding today.

Lenny's CISO Essays:

Interview with Alexandre Sieira: The state of TPCRM is shifting

The gold standard for third party cyber risk management has long been the humble questionnaire. While we've seen security rating services companies generate scores by scanning a company's external resources. Both approaches are widely considered inaccurate for either creating trust relationships or determining the true risk of doing business with a third party.

Every analysis of this problem comes to the same conclusion: without internal data about the state of systems and the security program, TPCRM can't improve substantially. Most this believe this to be an impossible problem: third parties would never share data this sensitive with a customer and first parties assume the same.

What if they did?

That's exactly the premise behind Tenchi Security, and Alexandre joins us to talk about how they've accomplished the 'impossible' in Brazil and aim to expand their success to the US.

Resources:

Thoughts from a panel discussion at a recent FS-ISAC event, shared on LinkedIn
Predicts 2026: Third-Party Cybersecurity Risk Management Evolves for the AI Era (Gartner Subscribers only, sorry)

Show Notes: https://securityweekly.com/esw-452

Scam Baiting, AI, and the New Grift Economy, Part 2 - Rinoa Poison - SWN #567 Mar 27, 2026

Show notes

In this two-part interview, Rinoa Poison explores the mechanics of modern scams, the role of AI in making them more convincing, and the growing world of scam baiting. She also discusses the tactics, technical setups, and safety considerations behind wasting scammers' time.

Show Notes: https://securityweekly.com/swn-567

Scanning The Internet with Linux Tools - PSW #919 Mar 26, 2026

Show notes

In this segment, we will explore some pretty awesome tools for scanning the Internet, with a focus on network edge devices. We'll bring it all together with Claude Code and look at some sample results. Tools include:

Shodan | Passive recon — query existing scan data for exposed devices, services, and vulns | Passive (API) | Instant (no packets sent)
ZMap | Host discovery — find live hosts with open ports | L4 (TCP SYN, UDP, ICMP) | Millions of packets/sec
ZGrab2 | Application-layer handshakes — grab banners, certs, headers | L7 (30+ protocol modules) | Thousands of hosts/sec
Nerva | Service fingerprinting — identify 140+ protocols with metadata, CPEs, technology stacks | L7 (TCP, UDP, SCTP) | Fast, concurrent
Nuclei | Template-based vulnerability scanning — default creds, exposed panels, known CVEs | L7 (HTTP, network) | Hundreds of targets/min
Shannon | Vulnerability exploitation — AI-powered whitebox pentesting of web apps | Application | ~1-1.5 hrs per target
edgescan.py | Automated pipeline — orchestrates all tools above into a single command | Orchestration | End-to-end

Show Notes: https://securityweekly.com/psw-919

Say Easy, Do Hard - Crypto-Agility - BSW #440 Mar 25, 2026

Show notes

With Q-day getting closer, regulatory guidance pushing firms to migrate to quantum security in the next five years, and an extensive remediation backlog waiting to be discovered, security leaders must start their quantum security migration today. Easier said than done. In this Say Easy, Do Hard segment, we discuss the quantum-safe journey using a framework for crypto-agility.

In part 1, we define cryptographic agility, or crypto-agility for short, and why it's important. Crypto-agility is not just about transitioning to quantum-safe cryptography in the nimblest way possible, and it's not something that can be achieved merely by updating encryption algorithms and protocols. Instead, you need to adapt your organization's cryptographic architecture, automation, and governance to allow for greater control and flexibility.

In part 2, we discuss a framework for discovery, prioritization, and remediation while keeping crypto-agility in mind. A quantum-safe journey requires:

Inventory of Systems With Non-Quantum-Safe Algorithms And Protocols
System Prioritization, Leading To A Migration Roadmap
Remediation, Including Vendors And Partners

Once a distant possibility, Q-Day is quickly approaching. Are you ready for 2030?

Segment Resources:

Show Notes: https://securityweekly.com/bsw-440

Scam Baiting, AI, and the New Grift Economy, Part 1 - Rinoa Poison - SWN #566 Mar 24, 2026

Show notes

Rinoa Poison joins Security Weekly News to break down the world of scam baiting, how modern scams are evolving, and why AI is making fraud harder to spot. In this two-part conversation, she shares how scam baiters operate, the risks involved, and what everyday people should know.

Show Notes: https://securityweekly.com/swn-566

Why Proactive Security Is Far Better Than Patching - Erik Nost - ASW #375 Mar 24, 2026

Show notes

So much of appsec's efforts can be consumed by vuln management and a race to patch security flaws. But that's more a symptom of the ease of scanning and the volume of CVEs. Erik Nost walks through the principles behind proactive security, why the concept sounds familiar to secure by design, and why organizations still struggle with creating effective practices for visibility.

Resources

https://www.forrester.com/blogs/proactive-security-platforms-will-cumulate-visibility-prioritization-and-remediation/

Show Notes: https://securityweekly.com/asw-375

Can AI help critical infrastructure, the state of the cyber market, and weekly news - Kara Sprague, Mike Privette - ESW #451 Mar 23, 2026

Show notes

Interview with Kara Sprague - The AI Fix for Infrastructure's Oldest Security Risks.

Critical infrastructure, often built on decades-old systems and legacy code, remains vulnerable to cyberattacks. From pipelines and energy grids to transportation networks, we break down where critical infrastructure is vulnerable and how AI could potentially help strengthen defenses.

Interview with Mike Privette - The State of the Cybersecurity Market

Here at ESW, we use Mike Privette's Security, Funded newsletter to prepare for every news segment. His newsletter covers the latest fundings, acquisitions, public market performance, layoffs, and other pertinent market details every week. We particularly enjoy the weekly Vibe Check.

In this interview, he joins us for the third year in a row, to discuss the most interesting insights from his annual State of Market Report.

Post recording Adrian here: Whooooo, so this conversation was SO good, I decided to punt the news segment in favor of a part 2 with Mike, so enjoy!

Also, though I punted the news segment, I did collect these stories and annotated them, so I think there's still some value in leaving them in the show notes. Scroll down for the links and my comments on each of these!

Weekly Enterprise News

Finally, in the enterprise security news,

funding announcements seem to be ramping up before RSA
Should security architects be shifting right?
How McKinsley's AI platform got hacked… by AI
Amazon is having a bad time with AI lately
Europe announces a Google Workspace/Microsoft 365 replacement
Robot dogs are apparently guarding datacenters now
Some much needed security humor in our squirrel stories before we all fly to San Francisco and lose our minds for a week

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-451

Ahab and Peewee Herman, Zoom, Vibe Hacking, SharePoint, Meta, AgeID, Josh Marpet - SWN #565 Mar 20, 2026

Show notes

Macbeth, Ahab, Peewee Herman, Microsoft, Zoom, Vibe Hacking, SharePoint, Meta, AgeID, Josh Marpet, and More on this episode of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-565

Hacking IP KVMs & Reversing with Radare2 - Sergi Àlvarez - PSW #918 Mar 19, 2026

Show notes

In this episode, we sit down with the Radare community leader, Pancake, the creator of the Radare2 reverse engineering framework. Whether you've never heard of Radare, already use it daily, or are thinking about contributing to its development, this conversation will demystify what makes Radare unique, why thousands of engineers rely on it, and how you can step into the community.

This segment is sponsored by NowSecure. Discover how AI-powered mobile app security testing finds hidden vulns and leaks at https://securityweekly.com/nowsecure.

In the security news:

The US national cyber strategy
in the category of dumb laws and 3d printing guns
Iranian threat analysis
ESP32 Bus Pirate gets some amazing updates
I can reset the admin password
Rick-rolling yourself
Chrome 0days
Re-purposing those old Ubiquiti cloud keys
The new TLS certificate lifecycle
A Flipper Zero add-on and news on the FlipperOne
glassword malware
Do you care about exploits or patching?
attacking nuclear research centers
how we uncovered 9 vulnerabilities in IP KVMs
and hacking your laundry card with Claude

Show Notes: https://securityweekly.com/psw-918

Language of the Board as CISO-Board Time Falls Short and CISOs Struggle with Risk - Ben Wilcox - BSW #439 Mar 18, 2026

Show notes

Security metrics often fail because they measure activity rather than actual risk, often failing to connect with business impact, making them difficult to explain to boards and executives. How do you build efffective metrics that are actionable, contextual, and valuable?

Ben Wilcox, CTO & CISO at ProArch, joins Business Security Weekly to help us speak the language of the board. Ben will cover how to develop measurable, strategic, and AI-ready security metrics.

In the leadership and communications segment, Only 30 minutes per quarter on cyber risk: Why CISO-board conversations are falling short, When the Team Gets the Recognition, Your Leadership Is Working, The communication lesson that changed my career, and more!

Show Notes: https://securityweekly.com/bsw-439

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected