Security Weekly Podcast Network (Video)

Latest Episodes:

Quantum Computing Isn't A Threat To Blockchains - Yet - Sandy Carielli, Martha Bennett - ASW #354 Oct 28, 2025

Show notes

The post quantum encryption migration is going to be a challenge, but how much of a challenge? There are several reasons why it is different from every other protocol and cypher iteration in the past. Is today's hardware up to the task? Is it just swapping out a library, or is there more to it? What is the extent of software, systems, and architecture that have to be updated or replaced to complete the migration? Can we get it all done by 2030?

Sandy Carielli and Martha Bennett join us to answer these questions and dive into one area of tech that hasn't been discussed much when it comes to post-quantum encryption: blockchain.

Relevant Forrester Reports:

In the news, high standards for open source software, trends in self-hosting, doing the cloud wrong, and is it really always DNS?

Show Notes: https://securityweekly.com/asw-354

Securing AI Agents with Dave Lewis, Enterprise News, and interviews from Oktane 2025 - Dave Lewis, Mike Poole, Conor Mulherin - ESW #430 Oct 27, 2025

Show notes

Segment 1: Interview with Dave Lewis from 1Password

In this week's sponsored interview, we dive into the evolving security landscape around AI agents, where we stand with AI agent adoption. We also touch on topics such as securing credentials in browser workflows and why identity is foundational to AI agent security.

This segment is sponsored by 1Password. Visit https://securityweekly.com/1password to learn more!

Segment 2: Enterprise News

In this week's enterprise security news,

one big acquisition, two small fundings
not all AI is bad
deepfakes are getting crazy good
make sure you log what your AI agents do
Copilot prompt injection
NordVPN tries to pull a jedi mind trick on us
failure rate in AI adoption is a feature not a bug?
using facial recognition to find Tinder profiles
a predictable squirrel story

All that and more, on this episode of Enterprise Security Weekly.

Segment 3: Two interviews from Oktane 2025

Interview with Connor Mulherin of TechSoup

The cybersecurity landscape in the nonprofit sector is evolving quickly, with organizations facing unique challenges due to limited resources, sensitive mission-driven work, and developing policies and training programs. Connor Mulherin, Director and GM of Validation Services at TechSoup, will discuss the industry's need for accessible and collaborative solutions to provide affordable technology leadership and security guidance. It will highlight how nonprofit organizations can build long-term digital resilience and combat these growing challenges.

Segment Resources:

Interview with Mike Poole, Director of Cyber Security at Werner Enterprises

In today's digital landscape, cybersecurity is not just a technical issue—it's a business imperative. Organizations that prioritize cybersecurity culture see fewer incidents and stronger resilience against evolving threats. But how do you foster a security-first mindset across an organization?

This session will explore the critical components of building and maintaining a robust cybersecurity culture, starting with executive leadership buy-in—a fundamental step in securing resources and driving organizational change. We'll then dive into the power of monthly phishing exercises, which reinforce awareness and preparedness. Attendees will also learn how to develop effective training programs that engage employees at all levels and create lasting behavioral change. Finally, we'll discuss the role of cybersecurity-themed events, particularly during Cybersecurity Awareness Month, as a powerful tool to capture attention and reinforce key security principles.

This segment is sponsored by Oktane by Okta. Visit https://securityweekly.com/oktane to learn more about them!

Show Notes: https://securityweekly.com/esw-430

Robo Bees, side, AI Risk, Red Tiger, SessionReaper, Bad Bots, Willow, Josh Marpet - SWN #523 Oct 24, 2025

Show notes

Venomous Robo Bees and Rabid Cocaine Weasels, sidebar spoofing, AI Risk, Red Tiger, SessionReaper, Bad Bots, Willow, Josh Marpet, and More on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-523

Its Always DNS - PSW #897 Oct 23, 2025

Show notes

In the security news:

When in doubt, blame DNS, you're almost always correct
How to Make Windows 11 great, or at least suck less
CSRF is the least of your problems
Shady exploits
Linux security table stakes (not steaks)
The pill camera
Give AI access to your UART
Security products that actually try to be secure?
Firmware vulnerabilities, lots of them
Teams is spying on you
More details on PolarEdge
VSCode, marketplaces, and developers at risk
Cisco SNMP flaw used to deploy malware
The 90's called, they want their exploits back

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/psw-897

Security That Sticks: Shaping Human Behavior - Nicole Jiang, Rinki Sethi - BSW #418 Oct 22, 2025

Show notes

As the Verizon Data Breach Investigations Report has stated year after year, most breaches start with human error. We've invested a lot in Security Awareness and Training and Phishing solutions, but yet human error is still the top risk. How do we actually reduce human risk?

Rinki Sethi, CSO at Upwind Security, and Nicole Jiang, CEO of Fable Security, share why human risk management is the next frontier for security—and how platforms like Fable Security deliver personalized nudges that help employees build safer habits and stay ahead of threats. Solving human risk starts by changing human behavior. Learn how advancements in Artificial Intelligence (AI) and the application of adtech principles (targeted, personalized, A/B-tested messages delivered when they're most relevant) are delivering faster, more effective behavior change that lasts.

Segment Resources: Five must-haves of modern human risk management: https://fablesecurity.com/ebook-five-must-haves/ Starter RFP for modern human risk management: https://fablesecurity.com/starter-rfp-for-modern-hrm/

This segment is sponsored by Fable Security. Visit https://securityweekly.com/fable to learn more about them!

In the leadership and communications segment, Inside the CISO Mind: How Security Leaders Choose Solutions, 2026 Leadership Strategy: Mastering Agility and Anticipation for Better Decisions, The Most Human, Strategic, Sought-After Tool in Leadership, and more!

Show Notes: https://securityweekly.com/bsw-418

The Afterlife, AWS, ClickFix, Agentic AI, Robot Lumberjacks, Robocalls, Aaran Leyland - SWN #522 Oct 21, 2025

Show notes

The Afterlife, AWS, ClickFix, Agentic AI Galore, Robot Lumberjacks, Robocalls, Aaran Leyland, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-522

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Reacting to Ransomware and Setting Secure Defaults - Rob Allen - ASW #353 Oct 21, 2025

Show notes

Ransomware attacks typically don't care about memory safety and dependency scanning, they often target old, unpatched vulns and too often they succeed. Rob Allen shares some of the biggest cases he's seen, what they have in common, and what appsec teams could do better to help them. Too much software still requires custom configuration to make it more secure. And too few software makers are embracing secure by default, let alone secure by design.

In the news, passively monitoring geosynchronous satellite communications on the cheap, successful LLM poisoning of any size model with a single size dose, security engineering lessons from Signal's post-quantum crypto work, improving security for JavaScript in the browser, and more!

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more!

Show Notes: https://securityweekly.com/asw-353

Mitigating attacks against AI-enabled Apps, Replacing the CIA triad, Enterprise News - David Brauchler - ESW #429 Oct 20, 2025

Show notes

Segment 1: David Brauchler on AI attacks and stopping them

David Brauchler says AI red teaming has proven that eliminating prompt injection is a lost cause. And many developers inadvertently introduce serious threat vectors into their applications – risks they must later eliminate before they become ingrained across application stacks.

NCC Group's AI security team has surveyed dozens of AI applications, exploited their most common risks, and discovered a set of practical architectural patterns and input validation strategies that completely mitigate natural language injection attacks. David's talk aimed at helping security pros and developers understand how to design/test complex agentic systems and how to model trust flows in agentic environments. He also provided information about what architectural decisions can mitigate prompt injection and other model manipulation risks, even when AI systems are exposed to untrusted sources of data.

More about David's Black Hat talk:

Video of the talk and accompanying slides: https://www.nccgroup.com/research-blog/when-guardrails-arent-enough-reinventing-agentic-ai-security-with-architectural-controls/
Talk abstract: https://www.blackhat.com/us-25/briefings/schedule/#when-guardrails-arent-enough-reinventing-agentic-ai-security-with-architectural-controls-46112
Slide presentation only: https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Brauchler-When-Guardrails-Arent-Enough.pdf

Additional blogs by David about AI security:

Analyzing Secure AI Architectures: https://www.nccgroup.com/research-blog/analyzing-secure-ai-architectures/
Analyzing Secure AI Design Principles: https://www.nccgroup.com/research-blog/analyzing-secure-ai-design-principles/
Analyzing AI Application Threat Models: https://www.nccgroup.com/research-blog/analyzing-ai-application-threat-models/
Building Security‑First AI Applications: A Best Practices Guide for CISOs: https://www.nccgroup.com/building-security-first-ai-applications-a-best-practices-guide-for-cisos/
Building Trust by Design for Secure AI Applications: Tips for CISOs: https://www.nccgroup.com/building-trust-by-design-for-secure-ai-applications-tips-for-cisos/
AI and Cyber Security: New Vulnerabilities CISOs Must Address: https://www.nccgroup.com/ai-and-cyber-security-new-vulnerabilities-cisos-must-address/

Segment 2: Should we replace the CIA triad?

An op-ed on CSO Online made us think - should we consider the CIA triad 'dead' and replace it? We discuss the value and longevity of security frameworks, as well as the author's proposed replacement.

Segment 3: The Weekly Enterprise News

Finally, in the enterprise security news,

Slow week for funding, older companies raising via debt financing
A useful AI framework from the Cloud Security Alliance
two interesting essays, one of which is wrong
Folks are out here blasting unencrypted data to and from Satellites, while anyone can sniff and capture it
getting hacked during a job interview
LLM poisoning is far easier than previously thought
F5 got breached
Be careful when patching your Jeep ('s software)

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-429

Erotic Chats, UEFI, F5, Cisco, Doug Sings, Insiders, Lastpass, Sora, Aaran Leyland... - SWN #521 Oct 17, 2025

Show notes

Erotic Chats, UEFI, F5, Cisco, Doug Sings, Insiders, Lastpass, Sora, Aaran Leyland, and More on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-521

AI, EDR, and Hacking Things - PSW #896 Oct 16, 2025

Show notes

First up is a technical segment on UEFI shells: determining if they contain dangerous functionality that allows attackers to bypass Secure Boot.

Then in the security news: