Cloud Security Podcast

Award Winning Top 10 Ranked CyberSecurity Podcast in US,UK and Aus. Learn Cloud Security in Public Cloud the unbiased way from CyberSecurity Host: @hashishrajan

[Cloud Security Podcast @CloudSecPod]

GTG-1002 went from reconnaissance to exfiltration in under 60 minutes. No human could have done that. Clustering, sequencing and time boxing should give high fidelity detections.

Nicole Beckwith, @cribl_io on @CloudSecPod.

[Cloud Security Podcast @CloudSecPod]

Securing AI agents by design means rebuilding IAM from the ground up.

One engineer might run 40 agents in parallel in an hour. Multiply that across engineering, IT and business users.

Ido Shlomo from @TheTokenSec on @CloudSecPod.

#IdentitySecurity #AgenticAI

[Cloud Security Podcast @CloudSecPod]

Even fast remediation still leaves eight days of availability to attackers. Remediating within 24 hours or less is now the floor, and some exposures should be fixed within an hour. The current average is 28.2 days.

Richard Seiersen, @qualys

[Cloud Security Podcast @CloudSecPod]

Hash values, IP addresses and domains, the bottom three layers of the pyramid of pain, are essentially gone with AI. The aim is to catch the adversary on behaviour.

Nicole Beckwith, @cribl_io on @CloudSecPod.

[Cloud Security Podcast @CloudSecPod]

Blocking AI tools outright leads to more shadow AI. People go around it.

Visibility tells you someone is doing something. Observability tells you what they’re doing.

Johnny Hands, @trendaisecurity on @CloudSecPod

[Cloud Security Podcast @CloudSecPod]

Every employee on LinkedIn adds to your attack surface, and each profile can now be spoofed. Finding the fake sites and spoofed accounts that might trick your people is a cost-effective fix.

@adylon7 @outtake_ai

[Cloud Security Podcast @CloudSecPod]

Security teams are hiring groups of AI agents. Humans stay involved, with more agentic AI applied to prevention and shifting left. Shrinking the attack surface is how defenders fight back.

Richard Seiersen, @qualys

[Cloud Security Podcast @CloudSecPod]

An AI model in a sandbox is a master pentester already inside your organisation. Put the best pentester you know in there and they’d probably get out.

Models have already broken out and got internet access.

Steve Giguere, @CheckPointSW

[Cloud Security Podcast @CloudSecPod]

A single bug bounty report listed more than 80 DNS takeover vulnerabilities, about half on production domains. Fixing them meant finding who managed each domain, and many had no owner.

Ramesh Ramani, Block

[Cloud Security Podcast @CloudSecPod]

Staff using a Copilot at work are coming across data they shouldn't have seen. The unreported cases are the concern: some ask the AI to tell them more, which makes them unintentional insider threats. David Gibson from @varonis

[Cloud Security Podcast @CloudSecPod]

One question got a chatbot to write out its own system prompt. It asked the chatbot to draft one for a clone of itself.

Models often reveal their system prompt even when told not to.

@CheckPointSW

[Cloud Security Podcast @CloudSecPod]

When a CEO is being impersonated, the odds are it's the CEO asking security what's being done. Sometimes it stays with legal, and a two-week emergency becomes a $50,000 to $100,000 bill.

Alex Arjun Dhillon, @outtake_ai

[Cloud Security Podcast @CloudSecPod]

For each group in an access review, ask what data membership gives access to. Without that, it's "like reviewing the keys on a key ring without knowing what doors the keys unlock." David Gibson from @varonis .

[Cloud Security Podcast @CloudSecPod]

Someone with moderate training can use AI to chain multiple vulnerabilities together. Exploitation timelines are moving from months and weeks to hours.

Ammar Alim on @CloudSecPod. #VulnerabilityManagement

[Cloud Security Podcast @CloudSecPod]

Vulnerability management has historically meant scan, find, report. Derek Abdine built a lot of it at previous companies, and it's "not fast enough" now that the timeline is down to "hours or minutes".

#vulnerabilitymanagement

[Cloud Security Podcast @CloudSecPod]

A WAF rule can be deployed in minutes, which is quicker than patching. Patching is still necessary, and the virtual patch is for the emergency.

Ammar Alim on @CloudSecPod. #VulnerabilityManagement

[Cloud Security Podcast @CloudSecPod]

An AI model will often get the answer right, and a third of it might still be wrong. Derek Abdine, told @CloudSecPod why he wouldn't give a model full, unfettered access to an environment, and why human accountability still matters. #aisecurity

[Cloud Security Podcast @CloudSecPod]

Fake job candidates get the attention. The harder case never applies.

Threat actors pose on LinkedIn as staff at defence companies, then work real employees for information. Hiring checks never see it.

@adylon7 from Outtake with Ashish on @CloudSecPod

[Cloud Security Podcast @CloudSecPod]

An AI agent in your environment has no identity of its own. It acts on behalf of a person, sometimes using that person's human identity.

Ido Shlomo from @TheTokenSec spoke to Ashish on @CloudSecPod. First question in any agent review: whose access is it carrying?

[Cloud Security Podcast @CloudSecPod]

We're on track for more than 66,000 CVEs this year. About 1% are zero days, critical, or exploited in the wild, and that share has held flat.

That's six or seven hundred to act on.

Johnny Hands on the CVE panic, with Ashish.

@trendaisecurity