Security Weekly Podcast Network (Video)

Latest Episodes:

Say Easy, Do Hard - AI Governance in the Supply Chain - Nick Mistry, Richard Bird - BSW #407 Aug 06, 2025

Show notes

Recent findings of AI ecosystem insecurities and attacks show the importance of needing AI governance in the supply chain. And this supply chain is rapidly expanding to include not only open-source software but also collaborative platforms where custom models, agents, prompts, and other AI resources are used. And with this expansion of third-party AI component and services use comes an expanded security threat often not included in traditional supply chain management processes. It's time to update our supply chain management process to include AI governance. Easier said than done.

In this Say Easy, Do Hard segment, we invite three CISOs to discuss the challenges of AI and the supply chain, including:

Data privacy concerns
Flaws and malicious code in AI dependencies
Lack of security tools to test for AI
Vibe coding risks

and more. But we also do the hard part, by discussing the changes needed to your supply chain management process to address these concerns.

Show Notes: https://securityweekly.com/bsw-407

MFA Bypass, SonicWall, BIOS Shade, Sex Toys, FBI Warning, Claude v GPT-5, Josh Marpet - SWN #500 Aug 05, 2025

Show notes

MFA Bypass, SonicWall, BIOS Shade, Sex Toys, FBI Warnings, Claude vs GPT-5, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-500

Uniting software development and application security - Jonathan Schneider, Will Vandevanter - ASW #342 Aug 05, 2025

Show notes

Maintaining code is a lot more than keeping dependencies up to date. It involved everything from keeping old code running to changing frameworks to even changing implementation languages. Jonathan Schneider talks about the engineering considerations of refactoring and rewriting code, why code maintenance is important to appsec, and how to build confidence that adding automation to a migration results in code that has the same workflows as before.

Resources

Then, instead of our usual news segment, we do a deep dive on some recent vulns NVIDIA's Triton Inference Server disclosed by Trail of Bits' Will Vandevanter. Will talks about the thought process and tools that go into identify potential vulns, the analysis in determining whether they're exploitable, and the disclosure process with vendors. He makes the important point that even if something doesn't turn out to be a vuln, there's still benefit to the learning process and gaining experience in seeing the different ways that devs design software. Of course, it's also more fun when you find an exploitable vuln -- which Will did here!

Resources

Show Notes: https://securityweekly.com/asw-342

Weekly Enterprise Security News and Tips on Building Security From Day 1 - Guillaume Ross - ESW #418 Aug 04, 2025

Show notes

The Weekly Enterprise News (segments 1 and 2)

This week, we've had to make some last minute adjustments, so we're going to do the news first, split into two segments.

This week, we're discussing:

Some interesting funding
Two acquisitions - one picked up for $250M, the other slightly larger, at $25 BILLION
Interesting new companies!
On the 1 year anniversary of that thing that happened, Crowdstrike would like to assure you that they're REALLY making sure that thing never happens again
Flipping the script
How researchers rooted Copilot, but not really
talks to check out at Hacker Summer Camp
detection engineering tips
the Cloud Security Alliance has a new AI Controls Matrix
sending in the National Guard to handle a breach!
and how to read an AI press release

Interview: Guillaume Ross on Building Security from Scratch

Guillaume shares his experiences building security from scratch at Canadian FinTech, Finaptic. Imagine the situation: you're CISO, and literally NOTHING is in place yet. No policies, no controls, no GRC processes. Where do you start? What do you do first? Are there things you can get away with that would be impossible in older, well-established financial firms?

Show Notes: https://securityweekly.com/esw-418

Pipes, Thorium, Excel, ATM Hillbilly Cannibal Attack, Lambdas, AIs, Aaran Leyland - SWN #499 Aug 01, 2025

Show notes

Pipes, Thorium, Excel, Weird Ports, ATM Hillbilly Cannibal Attack, Lambdas, National Guard, AIs, Aaran Leyland, and More on this episode of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-499

Hacking Washing Machines - PSW #885 Jul 31, 2025

Show notes

In the security news:

Hacking washing machines, good clean fun!
Hacking cars via Bluetooth
More Bluetooth hacking with Breaktooth
Making old vulnerabilities great again: exploiting abandoned hardware
Clorox and Cognizant point fingers
AI generated Linux malware
Attacking Russian airports
When user verification data leaks
Turns out you CAN steal cars with a Flipper Zero, so we're told
The UEFI vulnerabilities - the hits keep coming
Hijacking Discord invites
The Raspberry PI laptop
The new Hack RF One Pro
Security appliances still fail to be secure
Person Re-Identification via Wi-Fi

Show Notes: https://securityweekly.com/psw-885

Aligning Security Objectives, Ditch the Ego, Lead for Real and Succeed - BSW #406 Jul 30, 2025

Show notes

In the leadership and communications section, The CISO code of conduct: Ditch the ego, lead for real, The books shaping today's cybersecurity leaders, How to Succeed in Your Career When Change Is a Constant, and more!

Show Notes: https://securityweekly.com/bsw-406

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet... - SWN #498 Jul 29, 2025

Show notes

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-498

How Product-Led Security Leads to Paved Roads - Julia Knecht - ASW #341 Jul 29, 2025

Show notes

A successful strategy in appsec is to build platforms with defaults and designs that ease the burden of security choices for developers. But there's an important difference between expecting (or requiring!) developers to use a platform and building a platform that developers embrace. Julia Knecht shares her experience in building platforms with an attention to developer needs, developer experience, and security requirements. She brings attention to the product management skills and feedback loops that make paved roads successful -- as well as the areas where developers may still need or choose their own alternatives. After all, the impact of a paved road isn't in its creation, it's in its adoption.

Show Notes: https://securityweekly.com/asw-341

tj-actions Lessons Learned, US Cyber Offense, this week's enterprise security news - Dimitri Stiliadis - ESW #417 Jul 28, 2025

Show notes

Interview Segment - Lessons Learned from the tj-actions GitHub Action Supply Chain Attack with Dimitri Stiliadis

Breach analysis is one of my favorite topics to dive into and I'm thrilled Dimitri is joining us today to reveal some of the insights he's pulled out of this GitHub Actions incident. It isn't an overstatement to say that some of the lessons to be learned from this incident represent fundamental changes to how we architect development environments.

Why are we talking about it now, 4 months after it occurred? In the case of the Equifax breach, the most useful details about the breach didn't get released to the public until 18 months after the incident. It takes time for details to come out, but in my experience, the learning opportunities are worth the wait.

Topic Segment - Should the US Go on the Cyber Offensive?

Triggered by an op-ed from Dave Kennedy, the discussion of whether the US should launch more visible offensive cyber operations starts up again. There are a lot of factors and nuances to discuss here, and a lot of us have opinions here. We'll see if we can do any of it justice in 15 minutes.

News Segment

Finally, in the enterprise security news,

We discuss the latest fundings
a few acquisitions
a vibe coding campfire story
how to hack AI agents
zero-days in AI coding apps
more AI zero days
why Ivanti vulns are still alive and well in Japan
how wiper commands made their way into Amazon's AI coding agent
it seems like vulnerabilities and AI are pairing up in this week's news stories!

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-417

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected