Security Weekly Podcast Network (Video)

Latest Episodes:

Steganography, RICO, CMMC, End of 10, AI is coming for you, Aaran Leyland and More... - SWN #477 May 16, 2025

Show notes

Steganography, RICO, CMMC, End of 10, AI is coming for you, Aaran Leyland and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-477

Ransomware in your CPU - PSW #874 May 15, 2025

Show notes

This week in the security news:

Android catches up to iOS with its own lockdown mode
Just in case, there is a new CVE foundation
Branch privilege injection attacks
My screen is vulnerable
The return of embedded devices to take over the world - 15 years later
Attackers are going after MagicINFO
Hacking Starlink
Mitel SIP phones can be hacked
Reversing with Hopper
Supercharge your Ghidra with AI
Pretending to be an anti-virus to bypass anti-virus
macOS RCE - perfect colors
End of life routers are a hackers dream, and how info sharing sucks
Ransomware in your CPU
Disable ASUS DriverHub
Age verification and privacy concerns

Show Notes: https://securityweekly.com/psw-874

CISO Communication and Hiring, as they Combat Threat and Penetration Testing Trends - Derek Manky, Gunter Ollmann - BSW #395 May 14, 2025

Show notes

In the leadership and communications section, How CISOs can talk cybersecurity so it makes sense to executives, Firms to spend more on GenAI than security in 2025, Europe leads shift from cyber security 'headcount gap' to skills-based hiring, and more!

Next, pre-recorded interviews from RSAC Conference 2025, including:

This segment is sponsored by Fortinet. Visit https://securityweekly.com/fortinetrsac to learn more about them!

Unpacking the latest annual report from Fortinet's FortiGuard Labs. We're talking with Derek Manky, Chief Security Strategist and Global VP Threat Intelligence, Fortinet's FortiGuard Labs, to get a snapshot of the active threat landscape and trends from 2024, including a comprehensive analysis across all tactics used in cyberattacks, as outlined in the MITRE ATT&CK framework. The report reveals that threat actors are increasingly harnessing automation, commoditized tools, and AI to systematically erode the traditional advantages held by defenders.

Read the full report at https://securityweekly.com/fortinetrsac.

This segment is sponsored by Cobalt. Visit https://securityweekly.com/cobaltrsac to learn more about them!

In this interview, Gunter Ollmann, Chief Technology Officer at Cobalt, unpacks the findings from the State of Pentesting Report 2025, spotlighting both measurable security progress and the rising challenges introduced by generative AI (genAI). While the report shows that organizations are resolving vulnerabilities faster than ever, genAI systems stand out as a growing security blind spot: only 21% of serious genAI vulnerabilities identified during penetration testing are fixed, compared to over 75% for API flaws and 68% for cloud vulnerabilities. Nearly 32% of genAI-related findings were classified as high risk — more than double the average across other systems. And although 98% of organizations are adopting genAI-powered features, only 66% are running regular security assessments on those systems.

Segment Resources: https://www.cobalt.io/blog/key-takeaways-state-of-pentesting-report-2025 https://resource.cobalt.io/state-of-pentesting-2025?gl=1*zwbjgz*gclaw*R0NMLjE3MzcwNTU5ODMuQ2owS0NRaUEtYUs4QmhDREFSSXNBTF8tSDltRlB0X2FmSVhnQnBzSjYxOHlRZ1dhcmRMQ0lHalo3eVgxcTh1cHVnWFVwV0todHFPSDFZZ2FBb0hNRUFMd193Y0I.*gcl_au*MTc4MjQwMTAwNC4xNzQ0NjM0MTgz

Show Notes: https://securityweekly.com/bsw-395

Deepfake, South Korea, Moonlander, ChineseAI, FBI, AI damages professional reputation - SWN #476 May 13, 2025

Show notes

Deepfake porn, South Korea, Operation Moonlander, Chinese AI, FBI, AI use damages professional reputation, Joshua Marpet and More

Show Notes: https://securityweekly.com/swn-476

Secure Code Reviews, LLM Coding Assistants, and Trusting Code - Rey Bango, Karim Toubba, Gal Elbaz - ASW #330 May 13, 2025

Show notes

Developers are relying on LLMs as coding assistants, so where are the LLM assistants for appsec? The principles behind secure code reviews don't really change based on who write the code, whether human or AI. But more code means more reasons for appsec to scale its practices and figure out how to establish trust in code, packages, and designs. Rey Bango shares his experience with secure code reviews and where developer education fits in among the adoption of LLMs.

As businesses rapidly embrace SaaS and AI-powered applications at an unprecedented rate, many small-to-medium sized businesses (SMBs) struggle to keep up due to complex tech stacks and limited visibility into the skyrocketing app sprawl. These modern challenges demand a smarter, more streamlined approach to identity and access management. Learn how LastPass is reimagining access control through "Secure Access Experiences" - starting with the introduction of SaaS Monitoring capabilities designed to bring clarity to even the most chaotic environments. Secure Access Experiences - https://www.lastpass.com/solutions/secure-access

This segment is sponsored by LastPass. Visit https://securityweekly.com/lastpassrsac to learn more about them!

Cloud Application Detection and Response (CADR) has burst onto the scene as one of the hottest categories in security, with numerous vendors touting a variety of capabilities and making promises on how bringing detection and response to the application-level will be a game changer. In this segment, Gal Elbaz, co-founder and CTO of Oligo Security, will dive into what CADR is, who it helps, and what the future will look like for this game changing technology. Segment Resources - https://www.oligo.security/company/whyoligo

To see Oligo in action, please visit https://securityweekly.com/oligorsac

Show Notes: https://securityweekly.com/asw-330

Secrets and their role in infrastructure security - Jawahar Sivasankaran, Chas Clawson, Sergey Gorbaty, Fernando Medrano - ESW #406 May 12, 2025

Show notes

Segment 1 - Secrets and their role in infrastructure security

From API keys and tokens to environment variables and credentials, secrets are foundational—and often overlooked—attack surfaces in cloud-native and distributed systems. We break down the risks tied to poor secret hygiene, discuss emerging patterns for secure secret management at scale, and shares insights on integrating secrets management into systems design.

This segment is sponsored by Fastly. Visit https://securityweekly.com/fastly to learn more about them!

Segment 2 - Weekly Enterprise News

In this week's enterprise security news, we have:

Funding, mostly focused on identity security and 'secure-by-design'
Palo Alto acquires one of the more mature AI security startups, Protect AI
LimaCharlie is first with a cybersecurity-focused MCP offering
Meta releases a ton of open source AI security tooling, including LlamaFirewall
Exploring the state of AI in the SOC
The first research on whether AI is replacing jobs is out
Some CEOs are requiring employees to be more productive with AI
Are prompts the new IOCs?
Are puppies the new booth babes?
We get closure on two previous stories we covered:
1. one about an ex-Disney employee,
2. and one about a tiny dog

Segment 3 - Executive Interviews from RSAC

CYWARE The legacy SecOps market is getting disrupted. The traditional way of ingesting large troves of data, analysis and actioning is not efficient today. Customers and the market are moving towards a more threat centric approach to effectively solve their security operations challenges.

CERT Water Management Case Study
Cybersecurity Alert Fatigue! How Threat Intelligence Can Turn Data Overload Into Actionable Insights Blog
Frost & Sullivan's 2024 Threat Intelligence Platform Radar Report
2025 TIP Buyer's Guide

This segment is sponsored by Cyware. Visit https://securityweekly.com/cywarersac to request a demo!

SUMOLOGIC Intelligent SecOps is more than a buzzword—it's a blueprint for modernizing security operations through real-time analytics, contextual threat intelligence, and AI-powered automation. In this segment, Sumo Logic's Field CTO Chas Clawson explains how SOC teams can accelerate detection and response, cut through alert noise, and improve security outcomes by fusing AI-driven automation with human context and expertise. He also shares the latest security capabilities Sumo Logic announced at the RSA Conference to help organizations build and operate Intelligent SecOps.

Press Release: Sumo Logic Unifies Security to Deliver Intelligent Security Operations
Blog: RSAC 2025 Intelligent Security Operations
Brief: Sumo Logic Threat Intelligence
Chas Blog: Cloudy with a chance of breach: advanced threat hunting strategies for a hyperconnected and SaaSy world
LinkedIn Live: Implications of AI in a modern defense strategy

This segment is sponsored by Sumo Logic. Visit https://securityweekly.com/sumologicrsac to learn more about them!

Show Notes: https://securityweekly.com/esw-406

Sudo watch, AI Dreams, Kickidler, Powershool, Old Man Router, PSMU, Aaran Leyland... - SWN #475 May 09, 2025

Show notes

Sudo watch this show, Hallucinations, Kickidler, Powershool redux, Old Man Router, PSMU, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-475

Are You Down With RDP? - PSW #873 May 08, 2025

Show notes

Security news for this week:

RDP and credentials that are not really revoked, and some RDP bitmap caching fun
Some magic info on MagicINFO
Vulnerability Management Zombies
There is a backdoor in your e-commerce
Airborne: vulnerabilities in AirPlay
Bring your own installer - crafty EDR bypass
The Signal clone used by US government officials: shocker: has been hacked
AI slop vulnerability reporting
Bricking iPhones with a single line of code
Hacking planet technology
Vibe hacking for the win?
Cybersecurity CEO arrested for deploying malware
Hello my perverted friend
FastCGI - fast, but vulnerable

Chapters:

0:00 Opening and introductions 2:43 Panel introductions and conference recaps 4:46 Conference announcements and Corncon discussion 8:05 RSAC 2025 recap and vulnerability management trends 15:44 RDP credential revocation flaw in Windows 11 34:57 Apple AirPlay "wormable" vulnerabilities and third-party device risks 44:10 Signal clone breach used by US officials (TeleMessage incident) 55:38 Supply chain attack: Magento extensions backdoor 66:12 "Hello my perverted friend": Sextortion scam analysis 72:10 Security culture and phishing awareness at home 75:25 Digital signage vulnerabilities: Samsung MagicInfo 81:41 Threat hunting tradecraft and blue team operations 88:38 AI slop in vulnerability reporting and vibe hacking 98:59 Apple notification DoS and sandbox bypass 101:24 VMware licensing controversy and alternatives 107:14 CEO arrested for planting malware in hospital systems 116:06 FastCGI vulnerabilities in embedded/IoT systems 122:12 Rooting Android phones and device locking 124:08 Closing and outro

Show Notes: https://securityweekly.com/psw-873

C-Suite Gaps, Cybersecurity is not Working to Solve Exposures and Supply Chain Risks - Lenny Zeltser, Dr. Aleksandr Yampolskiy - BSW #394 May 07, 2025

Show notes

In the leadership and communications section, The C-suite gap that's putting your company at risk, CISOs band together to urge world governments to harmonize cyber rules, Cybersecurity is Not Working: Time to Try Something Else, and more!

Organizations are increasingly threatened by cyberattacks originating from their suppliers. Existing tools (like EDR, MDR, and XDR) effectively handle threats within an organization, but leave a gap regarding third-party risk. SecurityScorecard created the Supply Chain Detection and Response category to empower organizations to shift from being reactive and uncertain to confidently and proactively protecting their entire supply chain. What is Supply Chain Detection and Response (SCDR)?: https://securityscorecard.com/blog/what-is-supply-chain-detection-and-response/ Learn more about continuous supply chain cyber risk detection and response: https://securityscorecard.com/why-securityscorecard/supply-chain-detection-response/ Claim Your Free SCDR Assessment: https://securityscorecard.com/get-started-scdr/#form This segment is sponsored by Security Scorecard. Visit https://securityweekly.com/securityscorecardrsac for more information on how SecurityScorecard MAX and Supply Chain Detection and Response can help your organization identify and resolve supply chain risks.

In this interview, Axonius CISO Lenny Zeltser shares the vision behind Axonius Exposures, the company's latest innovation in unified risk management. Launched ahead of RSA Conference 2025, Exposures tackles one of the most persistent challenges in cybersecurity today: making sense of fragmented risk signals to drive confident, actionable decision-making. Lenny will discuss how Exposures unifies security findings, asset intelligence, and business context in a single platform — giving security teams the clarity and automation they need to prioritize what truly matters. He'll also explore what this launch means for Axonius' mission, the evolution of cyber asset management, and how organizations can move from reactive security postures to proactive, risk-based strategies. Want to see how Axonius Exposures gives you the clarity to take action on your most critical risks? Visit https://securityweekly.com/axoniusrsac to learn more and schedule a personalized demo.

Show Notes: https://securityweekly.com/bsw-394

Deepfake Porn Bots, Skype, dd, Venom Spider, CISA, IT Helpdesk, Rob Allen... - Rob Allen - SWN #474 May 06, 2025

Show notes

Deepfake Porn Bots, Skype, dd, Venom Spider, CISA, IT Helpdesk, Rob Allen, and more on the Security Weekly News.

Segment Resources: https://cybersecuritynews.com/cyber-security-company-ceo-arrested/

This segment is sponsored by ThreatLocker. Visit https://www.securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/swn-474