Got a startup? Learn how to secure it. Who are the hot security startups? We’ve got that covered, too!

http://www.securityweekly.com

Business Security Weekly

Interviews with security luminaries, technical segments and hacking/security news. Find links to all the news stories we’ve discussed and technical how-to information here!

http://www.securityweekly.com

Paul's Security Weekly

A look at the current state of enterprise security solutions, including new products, features and industry reporting.

http://www.securityweekly.com

Enterprise Security Weekly

The straight up security news in 20 minutes or less! Links to all news articles are included here.

http://www.hacknaked.tv

Security Weekly News

Application Security Weekly

This week, we kick off the show with an interview featuring Scott Scheferman, Principal Strategist at Eclypsium, to talk about The BIOS Disconnect and vulnerabilities affecting the BIOSConnect feature within the Dell Client BIOS! Next up, we welcome Jack Rhysider, Podcaster and Host of the Darknet Diaries Podcast, to discuss the The Journey from a Network Security Engineer to a Podcast Host! In the Security News, the White House Announces a Ransomware Task Force, how much money Microsoft has paid out to security researchers last year, Amazon rolls out encryption for Ring doorbells, how a backdoor in popular KiwiSDR product gave root to a project developer for years, Trickbot Malware Returns with a new VNC Module to Spy on its Victims, and some of the absolute funniest quotes about cyber security &amp; tech in 2021! &nbsp; Show Notes:  Segment Resources:  Visit  to learn more about them!  &nbsp; Visit  for all the latest episodes! Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Glorious Purpose - PSW #702

This week, Paul, Tyler, and Adrian talk about the Different Approaches To Vulnerability Management! In the Enterprise News: Latent AI, Optiv Security Launches Next-Gen Managed XDR, An Intriguing Update to Mandiant Advantage, ReversingLabs raises $56M to combat software supply chain, Morphisec Announces New Incident Response Services, &amp; more! Finally, we air two pre-recorded interviews from BlackHat 2021 with Carolin Solskär from Detectify and TJ Punturiero from Offensive Security! &nbsp; Show Notes:  Visit  to learn more about them! Visit  to learn more about them! &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Follow us on Facebook:

Zombie Security Control - ESW #238

This week in the Security Weekly News Wrap Up, Dr. Doug Talks: Fortinet vs. Rapid7, OnlyFans, Cisco, Kalay, TMobile, the "gub'mint", &amp; more! Visit  for all the latest episodes! Show Notes:  &nbsp;

Win 11 ISOs, OnlyFans, Cisco Critical Flaw, Kalay, & Fortinet vs. Rapid7 - Wrap Up - SWN #144

The zero trust approach can be applied to almost every technology choice in the modern enterprise, and Kubernetes is no exception. For Kubernetes network security particularly, adopting a zero trust model involves some radical changes, including moving from a security perimeter defined by firewalls, IP addresses, and cluster boundaries to a granular approach that treats the network itself as adversarial and moves the security boundary down to the pod level. William will discuss why the zero trust approach is increasingly necessary for comprehensive Kubernetes security, the dos and don’ts when adopting Kubernetes, the implications for operators and security teams, and where tooling like service mesh plays a role. In the Application Security News: SSRF at a FinTech leads to admin account takeover, Zoom's bounty payouts for 2021, SLSA demonstrates Build Provenance, Go's supply chain philosophy, Raspberry Pi credentials, &amp; more! &nbsp; Show Notes:  Segment Resources: -  -  -  -  &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:

ASW #192 - William Morgan

By and large, individual malware strains come and go, but to stop attacks more quickly, organizations need to gain a deeper understanding of attack techniques. By analyzing the attack goals of attackers, organizations can better align their defenses to adapt to quickly changing attack techniques. FortiGuard Labs analyzed the functionality of detected malware by detonating the malware samples collected throughout the year. The result was a list of the individual tactics, techniques, and procedures the malware would have accomplished had the attack payloads been executed. The intelligence we gathered indicates that stopping an adversary earlier is critical. Understanding adversaries’ goals is crucial to defending against the flood of changing techniques they may use. By focusing on a few identified techniques, an organization could shut down a malware’s methods for attack entirely in some situations. In the Leadership and Communications section: Cybersecurity is IT’s Job, not the Board’s, Right?, Why Some CISOs Fail, How JetBlue creates a culture of security, and more! &nbsp; Show Notes:  Visit  to learn more about them! &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:

BSW #258 - Derek Manky

This week in the Security News: Secret C Cabal of killer rabbits, Quantum Locker, VMWare, Ricochet Chollima, Truck Braking, Elon, Lapsus$, BlackCat, and the returning Expert Commentary of Jason Wood on this edition of the Security Weekly News! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

SWN #207 - Hare, Quantum, VMWARE, APT 34, Brakes, Elon Buys Twitter, Lapsus, & BlackCat

Vuln in an Atlassian Confluence app, "Dirty Dancing" in OAuth flows, security audits of sigstore and slf4j, flaws in fleet management app, conducting tabletop exercises. &nbsp; Pressured by the speed of innovation, organizations are struggling to achieve the continuous web application security they need in the face of mounting threats and compliance requirements. What does it take in order for your AppSec program to be both effective and agile? In this segment, Ferruh Mavituna, founder and strategic advisor of Invicti Security, discusses best practices to help you implement an effective, agile, and – most importantly – continuous approach to application security. This segment is sponsored by Invicti. Visit  to learn more about them! &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes:

ASW #205 - Ferruh Mavituna

Learn what keeps DevOps and SecOps up at night when securing Kubernetes, container, and cloud native applications, what tactics are best for developers and application architects to consider when securing your latest cloud application and hardening your CI/CD pipeline and processes. This segment is sponsored by Qualys. Visit  to learn more about them! &nbsp; Text4Shell isn't a new patching hell, using supply chain info with GUAC, OpenSSF Scorecards and metrics, Toner Deaf firmware persistence, upcoming OWASP Board Elections, Chrome browser exploitation &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes:

ASW #217 - Kong Yew Chan

Join us for this segment with Lina Lau to learn lessons from real incident response engagements covering types of attacks leveraged against the cloud, war stories from supply chain breaches seen in the last 1-2 years, and how defenders and enterprises can better protect and proactively defend against these attacks. &nbsp; Segment Resources: Attacking and Defending the Cloud (Training)  Blackhat Singapore 2023 Training ADVANCED APT THREAT HUNTING &amp; INCIDENT RESPONSE (VIRTUAL)  Blackhat USA 2023 Training ADVANCED APT THREAT HUNTING &amp; INCIDENT RESPONSE (IN-PERSON)  &nbsp; &nbsp; Twitter 2FA goes away, safe testing for server-side prototype pollution, OWASP's guide on AI security &amp; privacy, Adobe's approach to smarter security testing, a fast web fuzzer &nbsp; Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes:

ASW #230 - Lina Lau

Flappy TREX lips, WooCommerce, 3CX, Zimbra, OneNote, ChatGPT, ProPump, Aaran Leyland, and More on this episode of the Security Weekly News. Visit  for all the latest episodes!&nbsp; Follow us on Twitter:  Like us on Facebook:&nbsp; Show Notes:

SWN #285 - TREXes, WooCommerce, 3CX, Zimbra, OneNote, ChatGPT, ProPump, & Aaran Leyland

We talk with Ben about the rewards, hazards, and fun of bug bounty programs. Then we find out different ways to build successful and welcoming communities. A new deps.dev API for supply chain enthusiasts, hacking and modding agricultural devices, guidance from CISA on secure by design (and by default!), Glaze brings adversarial art to AI training, key transparency for WhatsApp, a new appsec myth(?), Android hacking tool list, and a Chrome extension to find web debugging behavior. &nbsp; Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes:

ASW #237 - Ben Sadeghipour

Poisonous Parsley and Chat GPT, QR codes, Boot Guard, Akira, Wanted Posters, SuperCare, VPNS, Jason Wood, and more on this edition of the Security Weekly News. &nbsp; Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes: &nbsp;

SWN #296 - Chat GPT, QR codes, Boot Guard, Akira, SuperCare, Jason Wood, and More News

What happens to an app's security after six months? What about a year or two years? A Secure SDLC needs to maintain security throughout an app's lifetime, but too often the rate of new flaws can outpace the rate of new code within an app. Appsec teams need strategies and processes to keep software secure for as long as possible. Segment Resources:  &nbsp; Learn how hackers are exploiting the trust that mobile app owners place in their customers. Hackers are increasingly modifying app code, posing as trusted customers, and infiltrating IT infrastructure. This segment is sponsored by Verimatrix. Visit &nbsp;to learn more about them! &nbsp; Unlike vulnerabilities, which can and do often exist for months or years in application code without being exploited, a malicious package represents an immediate threat to an organization, intentionally designed to do harm. In the war for cybersecurity, attackers are innovating faster than companies can keep up with the threats coming their way. A new approach is needed to stay ahead of the impacts of malicious packages within applications. Findings from our latest report "Malicious Packages Special Report: Attacks Move Beyond Vulnerabilities" illustrate the growing threat of malicious packages. From 2021 to 2022, the number of malicious packages published to npm and rubygems alone grew 315 percent. Mend.io technology detected thousands of malicious packages in existing code bases. The top four malicious package risk vectors were exfiltration, developer sabotage, protestware, and spam. Nearly 85 percent of malicious packages discovered in existing applications were capable of exfiltration – causing an unauthorized transmission of information. Threat actors leveraging this type of package can easily collect protected information before the package is discovered and removed. We’ll share why as long as open source means open, the door will be left open to bad actors, so it’s especially critical to know when things are being brought into your code. Malicious packages represent an immediate threat, unlike vulnerabilities, and can not be taken lightly. This segment is sponsored by Mend.io. Visit &nbsp;to learn more about them! &nbsp; Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes: &nbsp;

ASW #241 - Asaf Ashkenazi, Chris Eng, Jeff Martin

Ferret Legging, Elon's Brain Implants, Volt Typhoon, CosmicEnergy, OAuth, ILoveYou (and that's not just the Molly talking), Aaran Leyland, and More on this episode of the Security Weekly News. &nbsp; Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:  &nbsp; Show Notes: &nbsp;

SWN #301 - Brain Implants, Volt Typhoon, CosmicEnergy, OAuth, ILoveYou , Aaran Leyland, and More

Emilie comes on the show to talk about penetration testing and share her knowledge and stories! In the Security News: There is no national cyber director, time to move away from MoveIT, update Microsoft IIS at least every 6 years, your security system is not secure, for that matter neither is your smart pet feeder, identity management is hard, at least for some, spies using spy gadgets to spy on spies, go ahead and just replace your hardware, secure boot is hard, bypassing the BIOS password (but don’t try this at home, or work for that matter), Rob shaved his beard, what’s new in PCI (drink, are we still drinking on PCI? If so, drink again), if your firmware isn’t patched, no cloud updates for you, and Gigabyte has a backdoor! Visit &nbsp;for all the latest episodes! Follow us on Twitter:  Like us on Facebook:&nbsp; Visit  for all the latest episodes! Visit &nbsp;to sign up for a demo or buy our AI Hunter! FShow Notes:

Penetration Testing Stories w/ Emilie St-Pierre - PSW #788

Without visibility and continuous monitoring, dangerous threats expose our blind spots and create risk. Invicti, who brought together Acunetix and Netsparker, analyzes common web application vulns across thousands of assets yearly and releases the Invicti AppSec Indicator for a holistic view of vulnerability trends from automated scan results. In this talk, Invicti Director of Product Patrick Vandenberg shares a deep dive into the trends currently impacting AppSec programs and discusses some of the best practices that will help organizations achieve efficiencies in their programs. Segment Resources: - [AppSec Indicator Spring 2023 edition | Invicti]( This segment is sponsored by Invicti. Visit []() to learn more about them! &nbsp;In the news, two XSS vulns via postMessage methods in Azure, how to choose (and move on from) a web research topic, OpenSSF finances a security developer-in-residence for Python, more infosec myths, free cybersecurity training resources. Visit [securityweekly.com/asw]() for all the latest episodes! Follow us on Twitter: [@SecWeekly]( Like us on Facebook: [facebook.com/secweekly]( Visit  for all the latest episodes! &nbsp;Show Notes:

Latest Web Vulnerability Trends & Best Practices - Patrick Vandenberg - ASW #245

GameOver(lay), ZenBleed, Maximus, Redline and others, the SEC, SiegedSec, Microsoft, Aaran Leyland, and More on the Security Weekly News.  Visit &nbsp;for all the latest episodes! Follow us on Twitter:   Like us on Facebook:  &nbsp;

GameOver(lay), ZenBleed, Maximus, Redline, the SEC, More News & Aaran Leyland - SWN #313

Mature shops should be looking to a security architecture process to help scale their systems and embrace security by design. We talk about what it means to create a security architecture process, why it's not just another security review, and why it requires security to dig into engineering. Segment Resources: -  Zap gets a jolt of new support, using Clang for security research, LLM attacks learn models, Rust visualizes dependencies, a National Cyber Workforce and Education Strategy, and more! Visit &nbsp;for all the latest episodes! Follow us on Twitter:&nbsp; Like us on Facebook:  Show Notes:&nbsp; &nbsp;

You've Got Appsec, But Do You Have ArchSec? - Merritt Baer - ASW #250

It's time to review the money of security, including public companies, IPOs, funding rounds and acquisitions from the previous quarter. We also update you on the Security Weekly 25 index. The index came roaring back last quarter. Here are the stocks currently in the index: SCWX Secureworks Corp PANW Palo Alto Networks Inc CHKP Check Point Software Technologies Ltd. SPLK Splunk Inc GEN Gen Digital Inc FTNT Fortinet Inc AKAM Akamai Technologies, Inc. FFIV F5 Inc ZS Zscaler Inc OSPN Onespan Inc LDOS Leidos Holdings Inc QLYS Qualys Inc VRNT Verint Systems Inc. CYBR Cyberark Software Ltd TENB Tenable Holdings Inc DARK Darktrace PLC S SentinelOne Inc NET Cloudflare Inc CRWD Crowdstrike Holdings Inc NTCT NetScout Systems, Inc. VRNS Varonis Systems Inc RPD Rapid7 Inc FSLY Fastly Inc RDWR Radware Ltd ATEN A10 Networks Inc Large security vendors and hyperscalers, including Microsoft, continue to expand their cybersecurity product and service portfolios. Microsoft’s extensive enterprise reach, massive partner network, and enormous influence in the C-suite puts pressure on CIOs and CISOs to consolidate on it as much as possible for cybersecurity. This report helps security leaders understand Microsoft’s cybersecurity portfolio, the tactics it uses, and how to manage peer and executive pressure to single-source security technology. Visit  for all the latest episodes! Show Notes:

Security Money/Pick Your Battles To Avoid Overconsolidation - Jess Burn, Jeff Pollard - BSW #337

We can't talk about OWASP without talking about lists, but we go beyond the lists to talk about a product security framework. Grant shares his insights on what makes lists work (and not work). More importantly, he shares the work he's doing to spearhead a new OWASP project to help scale the creation of appsec programs, whether you're on your own or part of a global org. Segment Resources:         Qualys discloses syslog and qsort vulns in glibc, Apple's jailbroken iPhone for security researchers, moving away from OpenSSL, what an ancient vuln in image parsing can teach us today, and more! Visit  for all the latest episodes! Show Notes:

Starting an OWASP Project (That's Not a List!) - Grant Ongers - ASW #272

We've been scanning code for decades. Sometimes scanning works well -- it finds meaningful flaws to fix. Sometimes it distracts us with false positives. Sometimes it burdens us with too many issues. We talk about finding a scanning strategy that works well and what the definition of "works well" should even be. Segment Resources:    LLMs improve fuzzing coverage, the Shim vuln threatens Linux secure boot, considering AI application threat models, a new language for a configuration file format, and more! Visit  for all the latest episodes! Show Notes:

Creating Code Security Through Better Visibility - Christien Rioux - ASW #273

In the leadership and communications section, SEC’s Enforcement Head: It’s Time for ‘Proactive Compliance’, Improving cybersecurity culture: A priority in the year of the CISO, Breaking Down Barriers: 6 Simple Measures to Overcome Communication Barriers, and more! Visit  for all the latest episodes! Show Notes:

Proactive Compliance, Improving Cybersecurity Culture, and Hiring The Right Skills - BSW #338

Check out this interview from the BSW Vault, hand picked by main host Matt Alderman! This segment was originally published on February 22, 2022. The Business Information Security Officer, or BISO, is relatively new and somewhat controversial role. Does this role act as the CISO's non-technical liaison to the business units or as the CISO's deputy to oversee strategy implementation at a granular level? Is this new role a necessary career path for future CISOs or an entry point into security? The BSW hosts debate! Show Notes:

The New BISO Role – A Career Path to CISO? - BSW Vault

Check out this interview from the ASW Vault, hand picked by main host Mike Shema! This segment was originally published on Dec 13, 2022. Threat modeling is an important part of a security program, but as companies grow you will choose which features you want to threat model or become a bottleneck. What if I told you, you can have your cake and eat it too. It is possible to scale your program and deliver higher quality threat models. Segment Resources: - Original blog:  - Open Sourced slides:  Show Notes:

Redefining Threat Modeling - Security Team Goes on Vacation - Jeevan Singh - ASW Vault

Released on January 26, 2023, the NIST AI RMF Framework was developed through a consensus-driven, open, transparent, and collaborative process that included a Request for Information, several draft versions for public comments, multiple workshops, and other opportunities to provide input. It is intended to build on, align with, and support AI risk management efforts by others. Padraic O'Reilly, Founder and Chief Innovation Officer at CyberSaint, joins BSW to discuss why AI risks are a unique challenge and how they can impact both organizations and society. Without proper controls, AI systems can amplify, perpetuate, or exacerbate inequitable or undesirable outcomes for individuals and communities. With proper controls, AI systems can mitigate and manage inequitable outcomes. This segment is sponsored by CyberSaint . Visit  to learn more about them! Panoptica, Cisco’s cloud application security solution, was born out of Outshift, Cisco's incubation engine. Shibu George, Engineering Product Manager at Outshift, joins Business Security Weekly to discuss his transition from application performance monitoring to application security and how Panoptica was born. This segment is sponsored by Panoptica. Visit  to learn more about them! Visit  for all the latest episodes! Show Notes:

AI Risks, Application Performance - Padraic O'Reilly, Shibu George - BSW #339

Farshad Abasi joins us again to talk about creating a new OWASP project, the Secure Pipeline Verification Standard. (Bonus points for not being a top ten list!) We talk about what it takes to pitch a new project and the problems that this new project is trying to solve. For this kind of project to be successful -- as in making a positive impact to how software is built -- it's important to not only identify the right audience, but craft guidance in a way that's understandable and achievable for that audience. This is also a chance to learn more about a project in its early days and the opportunities for participating in its development! Segment resources   (coming soon!)  PrintListener recreates fingerprints, iMessage updates key handling for a PQ3 rating, Silent Sabotage shows supply chain subterfuge against AI models, 2023 Rust survey results, the ways genAI might help developers, and more! Visit  for all the latest episodes! Show Notes:

Creating the Secure Pipeline Verification Standard - Farshad Abasi - ASW #274

Pascal Geenens from Radware joins us to discuss the latest research findings relating to hacktivists an other actors using volumetric and other network-based attacks. We'll discuss everything from the current state of DDoS attacks to use in the military and even the impact of cyberattacks on popular culture! You can find the report Pascal mentions here, on Radware's website:  In this week's news segment, we discuss the lack of funding announcements, and the potential effect RSA could have on the timing of all sorts of press releases. We also discuss 1Password's potential future with its sizable customer base and the $620M it raised a few years back. Some other topics we discuss:  NIST CSF 2.0 insider threats Ivanti Pulse Secure's appliance software found to be running positively ancient software (11 year old Linux distro, 5-20+ year old libraries &amp; components) Nevada AG trying to get messaging decrypted for children, to "protect them" Kelly Shortridge's response to CISA's secure development RFI OpenAI's new GenAI video product, Sora and the potential impact it could have on cybersecurity Instacart spews out crappy AI recipes and photos  Visit  for all the latest episodes! Show Notes:

Hacktivism Unveiled: Insights into the Footprints of Hacktivists - Pascal Geenens - ESW #351

The SEC's new cyber reporting requirements are forcing organizations to rethink their compliance and risk programs. No longer can compliance and risk be static, point in time assessments. Instead they need to match the speed of security which is dynamic and real-time. Couple the difference in speeds with whistleblowers and attack groups reporting non-compliance with the new SEC rules and organizations find themselves in a regulatory nightmare. Igor Volovich, VP of Compliance Strategy for Cyber Compliance at Qmulos, joins BSW to share his "Notes from the battlefield" on how automation is the only way to effectively converge security, risk, and compliance into a dynamic, real-time discipline. In the leadership and communications section, Effective cyber security starts at the top, CISOs Struggling to Balance Regulation and Security Demands With Rising Cybersecurity Pressures, Unlocking Leadership Excellence: Data-Driven Practices That Set Elite Leaders Apart, and more! Visit  for all the latest episodes! Show Notes:

The Convergence of Security, Compliance, and Risk - Igor Volovich - BSW #340

The need for vuln management programs has been around since the first bugs -- but lots of programs remain stuck in the past. We talk about the traps to avoid in VM programs, the easy-to-say yet hard-to-do foundations that VM programs need, and smarter ways to approach vulns based in modern app development. We also explore the ecosystem of acronyms around vulns and figure out what's useful (if anything) in CVSS, SSVC, EPSS, and more. Segment resources:       -- For a bit of history, one of the earliest "bugs bounty" from 1995.  A SilverSAML example similar to the GoldenSAML attack technique, more about serializing AI models for Hugging Face, OWASP releases 1.0 of the IoT Security Testing Guide, the White House releases more encouragement to move to memory-safe languages, and more! Visit  for all the latest episodes! Show Notes:

The Simple Mistakes and Complex Seeds of a Vulnerability Management Program - Emily Fox - ASW #275

Defenders spend a lot of time and money procuring and implementing security controls. At the heart of SecOps and the SOC are technologies like XDR, SIEM, and SOAR. How do we know these technologies are going to detect or prevent attacks? Wait for the annual pen test? Probably not a good idea. In this segment, we'll talk with Michael Mumcuoglu about how MITRE's ATT&amp;CK framework can help defenders better prepare for inevitable attack TTPs they'll have knocking on their doors. Segment Resources:       In the enterprise security news,  Axonius raises $200M and is doing $100M ARR! Claroty raises $100M and is doing $100M ARR! Crowdstrike picks up DSPM with Flow Security CyCode picks up Bearer Are attackers like lawyers? How a bank failed (with no help from a cyber attack) the FTC cracks down on customer data collection Apple’s car sadly won’t be a thing any time soon or maybe ever.  All that and more, on this episode of Enterprise Security Weekly. Visit  for all the latest episodes! Show Notes:

What can we do today to prevent tomorrow's breach? - Michael Mumcuoglu - ESW #352

In this episode of Enterprise Security Weekly, we revisit the insightful book "Jump-start Your SOC Analyst Career" with authors Jarrett Rodrick and Tyler Wall, exploring updates on career paths, opportunities, and the industry's reality. We delve into the myths versus the truths about cybersecurity careers, discussing the viability of high salaries and the best entry points into the field. Next, we tackle the critical issues plaguing the cybersecurity industry despite its rapid growth and increased influence at the board level. We ask why, despite ample resources, are failures more prevalent than ever? Lastly, we cover significant news in enterprise security, including the rumored historic acquisition of Wiz by Google, recent company acquisitions, and the evolving concept of shared responsibility in cybersecurity. Join us for a comprehensive discussion that spans career guidance, industry analysis, and the latest news in enterprise security. Visit  for all the latest episodes! Show Notes:

Jump-starting SOC Analyst Careers, Addressing Cybersecurity Industry Challenges, and Historic Rumors in Enterprise Security - ESW #368

Identity, the security threat that keeps on giving. For the 17th year in a row, identity is one of the top threats identified in the Verizon DBIR. Why? Dor Fledel, Senior Director of Product Management at Okta and Co-Founder of Spera, joins Business Security Weekly to discuss the challenges of identity and how to solve them. From numerous disparate identity systems to a proliferation is SaaS application usage, Dor explains why Identity SecurityPosture Management is critical component to identify vulnerabilities, prioritize risks, and streamline remediation. If you're struggling with securing your identities, don't miss this interview. Segment Resources:   This segment is sponsored by Okta. Visit  to learn more about them! The CISO role has been evolving for 20 years, but the last 2 years have accelerated that evolution. Some might say it's evolving into extinction. What are the factors driving this evolution? Allan Alford, CEO at Alford and Adams Consulting and host of The Cyber Ranch Podcast, joins Business Security Weekly to discuss this evolution and some of the factors driving these trends. In this interview, Allan will share his insights:  Migratory Trends of the CISO CISO Skill Sets: Technical or Business? The Language of the CISO  Visit  for all the latest episodes! Show Notes:

Identity Security Posture Management - Allan Alford,  Dor Fledel - BSW #358

Daleks, AVTECH, Palo Alto, VMWARE, Travel, California AI Dreamin', Aaran Leyland, and More on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Daleks, AVTECH, Palo Alto, VMWARE, Travel, California AI Dreamin', Aaran Leyland... - SWN #411

There have been a lot of bold claims about how generative AI and machine learning will transform the SOC. Ironically, the SOC was (arguably) invented only because security products failed to make good on bold claims. The cybersecurity market is full of products that exist only to solve the problems created by other security products (Security Analytics, SOC Automation, Risk-Based Vulnerability Management). Other products are natural evolutions and pick up where others leave off. In this interview, we'll explore what AI can and can't do, particularly when it comes to alert triage and other common SOC tasks. Segment Resources:  From Forrester:  From Intezer:     Naturally, the next approach to try is a federated one. How do we break down cybersecurity into more bite-sized components? How do we alleviate all this CISO stress we've heard about, and make their job seem less impossible than it does today? This will be a more standards and GRC focused discussion, covering:  the reasons why cross-walking doesn't work the reasons why traditional TPRM approaches (e.g. questionnaires) don't work opportunities for AI to help risk management or sales support?  This week in the enterprise security news,  Upwind Security gets a massive $100M Series B Trustwave and Cybereason merge NVIDIA wants to force SOC analyst millennials to socialize with AI agents Has the cybersecurity workforce peaked? Why incident response is essential for resilience an example of good product marketing who is Salvatore Verini, Jr. and why does he have all my data?  All that and more, on this episode of Enterprise Security Weekly. Visit  for all the latest episodes! Show Notes:

AI and the Autonomous SOC - Separating Hype from Reality - Justin Beals, Itai Tevet - ESW #384

Sounil Yu joins us to kick things off with AI defenses: Enterprise AI search tools like Copilot for Microsoft 365 lack the in-depth access controls required to ensure that query responses align with the user’s need-to-know boundaries. Without proper controls, these tools accelerate the discovery of improperly secured sensitive files within the organization. Knostic’s solution ensures that enterprise data is safeguarded without slowing down innovation. By automating the detection and remediation of LLM data exposure, Knostic helps organizations mitigate the security, privacy, and compliance risks associated with AI chatbots and enterprise search tools. In the security news: The controversial pick for National Cyber Director, the not-so-controversial pick to lead CISA, complete with funding cuts, the controversial ESP32 backdoor that is not a backdoor but hidden features, Dark Storm takes down X, interesting use cases for LoRa, using AI to get your dream job, details on the biggest crypto heist in history, an EDR bypass and a 404 error, slipping through the cracks in CVSS, old school vulnerability disclosure in 2025, Rayhunter, a pen test that should not have been, JTAG and your Flipper Zero, a Linux webcam was used for what now?, and "Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces"! Segment Resources:     Visit  for all the latest episodes! Show Notes:

AI Is Oversharing and Leaking Data - Sounil Yu - PSW #865

Deepfake Porn Bots, Skype, dd, Venom Spider, CISA, IT Helpdesk, Rob Allen, and more on the Security Weekly News. Segment Resources:  This segment is sponsored by ThreatLocker. Visit  to learn more about them! Visit  for all the latest episodes! Show Notes:

Deepfake Porn Bots, Skype, dd, Venom Spider, CISA, IT Helpdesk, Rob Allen... - Rob Allen - SWN #474

Recent findings of AI ecosystem insecurities and attacks show the importance of needing AI governance in the supply chain. And this supply chain is rapidly expanding to include not only open-source software but also collaborative platforms where custom models, agents, prompts, and other AI resources are used. And with this expansion of third-party AI component and services use comes an expanded security threat often not included in traditional supply chain management processes. It's time to update our supply chain management process to include AI governance. Easier said than done. In this Say Easy, Do Hard segment, we invite three CISOs to discuss the challenges of AI and the supply chain, including:  Data privacy concerns Flaws and malicious code in AI dependencies Lack of security tools to test for AI Vibe coding risks  and more. But we also do the hard part, by discussing the changes needed to your supply chain management process to address these concerns. Visit  for all the latest episodes! Show Notes:

Say Easy, Do Hard - AI Governance in the Supply Chain - Richard Bird, Nick Mistry - BSW #407

This week we have, SonicWall, Confidential Informants Exposed, Cisco Vishing, Perplexity vs robots.txt, Microsoft’s Project Ire, Meta–Flo Jury Verdict, GPT‑5 Lands, TeaOnHer Data Leak, Josh Marpet, and more on the Security Weekly News.. Visit  for all the latest episodes! Show Notes:

SonicWall, Informants Exposed, Cisco Vishing, Perplexity, GPT‑5, Josh Marpet–SWN #501 - SWN #501

Why should hate AI When firmware attacks The 300 second breach Old ways still work, AI might help And so begins the crawler wars Turn off your SonicWall VPN Your Pie may be wrapped in PII Attackers will find a way Signed kernel drivers D-Link on the KEV Rasperry PIs attack Stealthy LoRa LLM's don't commit code, people do Jame's Bond style rescue with drones SRAM has no chill In the full view of the public...  Visit  for all the latest episodes! Show Notes:

Devices Are Attacking - PSW #886

Open source software is a massive contribution that provides everything from foundational frameworks to tiny single-purpose libraries. We walk through the dimensions of trust and provenance in the software supply chain with Janet Worthington. And we discuss how even with new code generated by LLMs and new terms like slopsquatting, a lot of the most effective solutions are old techniques. Resources     Show Notes:

The Future of Supply Chain Security - Janet Worthington - ASW #343

300 Baud, Buddy Hackett Nudes, Dell, badUSB, Exchange, Erlang/OTP, Josh Marpet, and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

300 Baud, Buddy Hackett Nudes, Dell, badUSB, Exchange, Erlang/OTP, Josh Marpet... - SWN #502

We kick things off with a deep dive into the Hackberry PI and how to build one. Then in the security news:  Will Perplexity buy Chrome? ESP32 Bus Pirates Poisoned telemetry Docker image security Fully Open Source Quantum Sensors Securing your car, Flippers, and show me the money Bringing your printer and desktop to Starbucks Paying a ransom? You need approval AI: Shield or Spear? No authentication? That's a problem Transient Bugs: A realistic threat? You can run Linux And who still uses AOL dial-up?  Visit  for all the latest episodes! Show Notes:

Hackberry PIs and Other Hacker Things - PSW #887

A smaller attack surface should lead to a smaller list of CVEs to track, which in turn should lead to a smaller set of vulns that you should care about. But in practice, keeping something like a container image small has a lot of challenges in terms of what should be considered minimal. Neil Carpenter shares advice and anecdotes on what it takes to refine a container image and to change an org's expectations that every CVE needs to be fixed. Visit  for all the latest episodes! Show Notes:

Managing the Minimization of a Container Attack Surface - Neil Carpenter - ASW #344

The industry is obsessed with vulnerabilities. From vulnerability assessment to vulnerability management to exposure management and even zero days, we love to talk about vulnerabilities. But what about misconfiguration? By definition it's a vulnerability or weakness, but it doesn't have a CVE (common vulnerability enumeration). Should we ignore it? Danny Jenkins, CEO and Founder at ThreatLocker, joins BSW to discuss why misconfigurations matter. Simply, you can prevent many cyberattacks by eliminating your misconfigurations. That's why ThreatLocker released Defense Against Configurations (DAC). Danny will discuss the benefits of DAC, including:  Immediate visibility into system misconfigurations before they become vulnerabilities Compliance transparency, showing exactly where systems fall short of industry standards One unified view, with filters by criticality, system, and framework Actionable insights, updated weekly and delivered straight to customers’ inboxes  Segment Resources:     This segment is sponsored by ThreatLocker. Visit  to learn more about them! In the leadership and communications segment, CEO Blind Spots That Put Your Company at Risk, The CISO Mindset Shift: From Risk Defender to Business Accelerator in the Age of AI, When “Yes, and…” Backfires, and more! Visit  for all the latest episodes! Show Notes:

Misconfiguration, The Forgotten Vulnerability and the Power and Failure of "Yes" - Danny Jenkins - BSW #409

This segment is sponsored by Flashpoint. Visit  to learn more about them! Recent leaks tied to LockBit and Black Basta have exposed the inner workings of two of the most notorious ransomware groups—revealing their tactics, negotiation strategies, and operational infrastructure. For defenders, this rare window into adversary behavior offers critical intelligence to strengthen incident response and prevention strategies. In this interview, we'll break down what these leaks reveal and how security teams can use this intelligence to proactively harden their defenses, including:  Key takeaways from the LockBit and Black Basta leaks—and what they confirm about ransomware operations How leaked playbooks, chats, and toolkits can inform detection and response Practical steps to defend against modern ransomware tactics in 2025  In the security news:  Practical exploit code Old vulnerabilities, new attackers AI and web scraping - the battle continues 0-Days: You gotta prove it WinRAR 0-Day LLM patch diffing $20 million bug bounty Your APT is showing Hacking from the routers Its that easy eh? NIST guidance on AI Words have meaning Developers knowingly push vulnerable code My Hackberry PI post is live:   Resources:  Inside the LockBit Leak: Rare Insights Into Their Operations:  2025 Ransomware Survival Guide:  AI and Threat Intelligence: The Defenders’ Guide   Visit  for all the latest episodes! Show Notes:

What We’ve Learned from LockBit and Black Basta Leaks (and News) - Ian Gray - PSW #888

Humans wiped out by 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Philip K. Dick, Aaran Leyland, and More, on this edition of the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Humans extinct: 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Aaran Leyland.. - SWN #505

This week we talk with Alex Horan from Onapsis. He is a security focused IT professional with strong experience leading and motivating IT teams and departments.

Paul's Security Weekly #458 - Alex Horan, Product Manager at Onapsis

Paul and a dozen infosec professionals celebrate Episode 500 of Paul's Security Weekly by hosting roundtable discussions on IoT security and penetration testing. Stay tuned!

Paul’s Security Weekly #500 - NUMBER 500!

This week, we welcome Dug Song, Co-Founder and General Manager of Duo Security at Cisco, to discuss the vision and culture behind Duo Security, and talk about his journey from when he began his start in Information Security! In our second segment, we welcome Mike Godwin, Distinguished Senior Fellow at R Street Institute, to talk about Digital Rights and Privacy! In the Security News, Microsoft Security Shocker As 250 Million Customer Records Exposed Online, the NSA Offers Guidance on Mitigating Cloud Flaws, Multiple Vulnerabilities Found in AMD ATI Radeon Graphics Cards, Brazil prosecutes Glenn Greenwald in an attack on press freedom, and Cybersecurity Lessons Learned from 'The Rise of Skywalker'! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Something Sanitary - PSW #636

This week, we welcome Gene Kim, Founder, Researcher, and Author of the Phoenix Project and The Unicorn Project, to talk about his goals and aspirations in The Unicorn Project, take a deep dive into the Five Ideals, and how DevOps will be a major player for decades to come! In our second segment, we welcome back Peter Smith, CEO, and Co-Founder of Edgewise, to talk about Stopping Python Backdoor Attacks, and how similar attacks have managed to evade traditional network security defenses and propagate inside their target environments! In the Security News, NHS alerted to severe vulns in GE health equipment, Ragnarok Ransomware targets Citrix ADC &amp; disables Windows Defender, suspected Magecart hackers arrested in Indonesia, Wawa breach data was found for sale, and a mega-breach that exposed more than 250 million users! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; To learn more about Edgewise, visit:  Visit https://securit Visit  for all the latest episodes! Visit  to sign up for a demo or buy our AI Hunter!

What Could Go Wrong - PSW #637

This week, in the Enterprise Security News, Preempt Security Becomes First in Industry to do Real-Time Threat Detection for Encrypted Authentication Protocol Traffic, Actionable Searching and Data Download with Vulnerability Management Dashboards, Companies and employees embrace BYOD but with compliance and risk challenges! In our second segment, we interview Wilson Bautista, Founder of Jun Cyber, to talk about leadership, DevOps and Security working together to provide security for the business! In our final segment, we welcomeMalcolm Harkins, Chief Security &amp; Trust Officer at Cymatic, to discuss the security profits from the insecurity of computing thus at a macro economic level has no real economic incentive to solve many of the risk issues we face! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

The Greatest Exposures - ESW #171

This week, we welcome Katelyn Bowden, CEO of BADASS, (Battling Against Demeaning and Abusive Selfie Sharing), to talk about her journey, and how she started BADASS! In our second segment, we present you with a Technical Segment to talk about Adventures in AWS Computing! In the Security News, Google shares private videos with the wrong users, how to get hacked through a Philips Hue smart hub, Buggy Iowa Caucus App is actually Buggy? No way!, how US cities have handled their fight against cybercrime attacks, and how someone sabotaged their boss with ransomware from the dark web! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Come Hang Out! - PSW #638

This week, Doug White gives you the latest updates across all of Security Weekly's shows, from malware to hacking air-gapped computers, Ashley Madison, Katelyn Bowden and the BADASSARMY, Security Through Obscurity in Iowa, and highlights from the show notes from the week of February 2, 2020! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:  &nbsp;

Hacking Philips, Iowa Caucus, & Kryptos Key - Wrap Up - SWN #10

The CIA spying? NASA could have used a USB charger? Election technology not very secure? ICS is a threat and the return of the Equifax monster from beyond the grave! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

CIA, Equifax, ATT&CK for ICS - SWN #11

This week, we talk Enterprise News, to talk about Salt Security API Protection Explained, Thycotic Leads the Way for Cloud-based Privileged Access Management, ZeroFOX launches AI-powered Advanced Email Protection for Google and Microsoft platforms, Elastic Stack 7.6 delivers automated threat analysis and response, and 12,000+ Jenkins servers can be exploited to launch, amplify DDoS attacks! In our second segment, we welcome David Waugh, Chief Revenue Officer at Managed Methods, to discuss how K-12 schools are victims of lateral phishing campaigns! In our final segment, we welcome Jeff Deininger, Principal Sales Engineer for the Cloud at ExtraHop, to discuss How to Secure Cloud Workloads &amp; Reduce Friction with Cloud-Native Network Detection &amp; Response! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

Super Stoked - ESW #172

This week, we welcome Oshea Bowens, Founder &amp; Chief Janitor at Null Hat Security, to talk about Living in Blue Team Land and Skicon, a conference Founded by Oshea himself! In our second segment, we welcome John Loucaides, VP of Research &amp; Development at Eclypsium, to talk about Hacking Firmware: The Unprotected Attack Surface of the Enterprise! In the Security News, Misconfigured Docker Registries Expose Thousands of Repositories, a Forgotten motherboard driver turns out to be perfect for slipping Windows ransomware past antivirus checks, Jail Software Left Inmate Data Exposed Online, Adobe patches 42 vulnerabilities across 5 products, and how the CIA Secretly Owned Global Encryption Provider, Built Backdoors,&amp; Spied On 100+ Foreign Governments! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:  &nbsp;

Leaky Secrets - PSW #639

This week, Doug White brings you through the latest across all of our shows on the network, CIA pwns well, everyone in history, Bluetooth hacking, Thousands of Docker Repositories are open to the internet, lots of ransomware, and is Apple giving up passwords? &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

Docker Repos, SweynTooth, & Emotet - Wrap Up - SWN #12

This week, Quantum Crypto Chaos, IBM Cloud Vulnerabilities in CICS, Crowded Flounder and Hacking Back, Turkish RATs, Israeli soldiers catfished by HAMAS, and the Julian Assange Trial: Australian PMs trying to prevent extradition to the United States! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

Crypto Chaos, Assange Trial, & Turkish RATs - SWN #13

This week, we welcome Jeff Recor, Global IRM Lead at Accenture, to talk about how Integrated Risk Management is the New GRC! Jeff was scheduled to be part of the 'Security vs. Compliance' Roundtable (https://securityweekly.com/shows/security-vs-compliance-psw-632-2/) recorded on Dec. 19, 2019, but got snowed out! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

Pixie Dust - SCW #18

This week, Matt is joined by Scott Lyons and Josh Marpet to talk Enterprise News, and how IBM announced RSA Conference withdrawal, Dell Offloads RSA, 12 hottest new cybersecurity startups at RSA 2020, and lots of funding announcements! In the second segment, CEO of Red Lion LLC. Scott Lyons will provide an overview of their CTF at InfoSec World 2020, including their training class and CTF 101! In our final segment, we welcome Ben Budge, System Administrator III at Litehouse Foods, and Lyle Beck, Technology Manager at Litehouse Foods, to discuss the problems they faced at Litehouse in regards to network and system monitoring, troubleshooting, and how that ultimately took them to ExtraHop! &nbsp; Show Notes:  To learn more about ExtraHop, visit:  &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:

The Golden Circle - ESW #173

This week, we welcome Mike Nichols, Head of Product at Elastic Security, to talk about how Elastic Security is unifying SIEM and Endpoint Security! In our second segment, we welcome Ian Coldwater, Lead Platform Security Engineer at Heroku, to talk bout Kubernetes and Container Security! In the Security News, Iranian Hackers are targeting Dutch Universities, how electrical tape can fool Tesla sensors, Ransomware attack forces 2-day shutdown of a natural gas pipeline, Ring Rolls Out Mandatory 2FA &amp; New Privacy Controls, and 7 Ways to Improve the Security of Mobile Banking Apps! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Hacking Back - PSW #640

This week, Doug brings you the weekly Wrap Up, talking all things like D-List Celebrities will call you for money, RSA Sold for 2.1B, IBM pulls out of RSA due to fear of COVID-19, Citrix hacks, all this and more including highlights from this past week across all of our shows! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Follow us on Twitter:  Like us on Facebook:

ThemeGrill, Citrix Hacks, & ATT&CK for ICS - Wrap Up - SWN #14

This week, we welcome Padraic O'Reilly, Chief Product Officer &amp; Co-Founder at CyberSaint, to talk about The Cyber Risk/Compliance Transformation Solution! We want to take the time in the segment to formally introduce you to one of our new co-hosts, Mr. Fredrick "Flee" Lee. Flee is currently the Chief Security Officer for a company called Gusto and used to be Head of Information Security at Square. We'll spend some time getting to know Flee and his background, pepper him with questions, talk shop, all the while engaging in the usual mayhem! &nbsp; Show Notes:  Visit  to learn more about them! &nbsp; Visit  for all the latest episodes! Follow us on Twitter:  Like us on Facebook:

Cyber Chainsaw - SCW #55

Information security news, hacking, interviews, podcasts, live Internet TV, cocktails, and more!

Hack naked.

Security Weekly

Pinned to spotlight

Popular tracks