Welcome to the Security Weekly Podcast Network, your all-in-one source for the latest in cybersecurity! This feed features a diverse lineup of shows, including Application Security Weekly, Business Security Weekly, Paul's Security Weekly, Enterprise Security Weekly, and Security Weekly News. Whether you're a cybersecurity professional, business leader, or tech enthusiast, we cover all angles of the cybersecurity landscape.
Tune in for in-depth panel discussions, expert guest interviews, and breaking news on the latest hacking techniques, vulnerabilities, and industry trends. Stay informed and secure with the most trusted voices in cybersecurity!
Managing a cyber crisis extends far beyond the initial breach, tossing leadership into a chaotic fog where security teams, legal counsels, and executives must make high-stakes choices under extreme duress. When a catastrophic security event occurs, organizations struggle against a predictable set of systemic, technical, and operational roadblocks. How can organizations transition from a reactive state to a controlled recovery, successful crisis management state?
Mone' Ross, Vice President, Cyber Operations at JPMorganChase, joins Business Security Weekly to discuss Cyber Resilience and the leadership behaviors that determine what happens under pressure. Mone' will discuss why preparation and communication are imperative to a successful response. She has also identified the five Crisis Archetypes and how each type should or should not lead during a crisis.
In the leadership and communications segment, AI Security Now Tops Every CISO Priority for 2027, What a security strategy that survives 2027 looks like, Leaders Need to Grapple with Employee Ambivalence on AI, and more!
Show Notes: https://securityweekly.com/bsw-473
Bad Claude, Bad, French Fridge Fiasco Fries Fromage, Teenage Mutant Ninja AI, SonicWALL, Aaran Leyland, and More, on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-632
AI-enabled cyber attackers will check every third-party path into an application at scale and speed. The same process can help defenders just as much, but it's only as effective as the human expertise guiding it. Andrew Wesie, Xint co-founder and CTO. explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise.
Segment Resources:
Business logic vulns, https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference
Securing apps and their third-party access, https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks
Working with DARPA to test the infrastructure surrounding messaging apps, https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339
This segment is sponsored by Xint. To learn more, visit https://securityweekly.com/xint!
Show Notes: https://securityweekly.com/asw-408
Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?
The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.
Segment Resources:
Modernize your TPRM program with adaptive risk management for SaaS and AI
Nudge Security Unveils Adaptive Risk Management press release
The security work nobody wants to do is the risk nobody's watching
OAuth grants pile up faster than you can review them BleepingComputer
This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!
Topic Segment - Coordinated Disclosure
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.
Coordinated disclosure in 2026 is:
75% - Too slow for AI world
13% - Vendor Credit Race
13% - This is fine ????????️????
0% - Working as designed
0% - Other (tell me)
Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week's vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.
Enterprise Security News
Finally, in the enterprise security news,
A little funding
making software liable for cyber breaches
we have a new biggest bank heist ever!
more freezers defrosted
a company builds malware into their product on purpose
AI pentesting frameworks are lowering the script kiddy bar
AI hosting company hacks their competitor
there's a new SSH bug that could be very, very bad
even MSPaint gets a vulnerability
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-484
AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News.
Show Notes: https://securityweekly.com/swn-631
In the security news:
Supermarket refrigeration attacks, again!
Rapid7's Ivanti findings and why we can't have "nice" things
Google's massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead's TLS handling
Hackers hijack emergency alert apps
Taiwan's emergency services become an AI-agent target
CUI exposed through GSA's Google Drive
GCHQ can't account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public
Show Notes: https://securityweekly.com/psw-951
As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself?
Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker's Playbook (And How to Beat It), joins Business Security Weekly to discuss why it's not the technology that PWNs you, it's the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them.
Segment Resources:
https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL
In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more!
Show Notes: https://securityweekly.com/bsw-472
Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-630
Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.
Resources
https://www.rootevidence.com/blog-posts/stop-chasing-cves/
https://www.rootevidence.com/blog-posts/the-defender-window-is-longer-than-you-think/
Show Notes: https://securityweekly.com/asw-407
Interview with Casey Ellis
Our focus for this interview with Casey Ellis are the massive changes in:
Vulnerability Discovery
Vulnerability Disclosure
Exploitation and Remediation
The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?
Vibe Check
This week's vibe check explores the question, which security project always takes twice as long as planned?
55% - Enforcing data classification
18% - SOAR automation buildout
9% - Rolling out SSO
9% - Moving to passwordless auth
9% - AI agent discovery
0% - Other
News Segment
Finally, in the enterprise security news,
funding and M&A
PHP2Shell update
floods of bugs
silent train
breaches
the script kiddy bar has been lowered
the basics continue to be important
an AI lab pulls a PR stunt
an old squirrel story was a scam!
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-483
Mrfoofoospicy, Binance, Polymarket, Ada Lovelace, Silent Train, Robosurance, Privacy Piracy, Josh Marpet, and More on this episode of Security Weekly News.
Show Notes: https://securityweekly.com/swn-629
In the security news this week:
In the security news this week:
Cisco says patch faster, then sells you time
Turning AI refusals into vulnerability signals
Brotli's are hiding
WordPress image upload exploit
Fortinet ships fixes before details
PHP2Shell still claiming victims, including firewalls
Uncoordinated disclosure
Claude finds vulns, go figure
PXE strikes again!
Sony's PS5 bounty drama
Apple's October patches reach older devices
CISA looks ahead to 2030
ArubaOS gets a pile of critical fixes
New UK rules for protecting undersea infrastructure
PortaPack Mayhem goes mobile
Can AI agents police other AI agents?
DHS bans DeepSeek
A Chinese model writes riskier code for a US contractor
eMudhra exits the TLS business
BlackX bootkit exploits Secure Boot
Signal makes hanging up harder than it should be
Is AI solving math, or making it harder to trust?
Show Notes: https://securityweekly.com/psw-950
CyberSN just released their Cybersecurity Jobs Report through September 2026. We'll cover that in the leadership and communications segment along with, Only 7% of CISOs at Large Companies Own AI Governance, Our Favorite Management Tips on Delegating Effectively, CIOs unprepared for agentic workforce shift, and more!
Show Notes: https://securityweekly.com/bsw-471
Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More, on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-628
Proactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against how vulns are exploited. Rashid Feroze talks about runtime security and the benefits of deploying eBPF filters to improve observability and block unauthorized behavior. He walks through scenarios related to supply chain attacks, prompt injections against agents, and responding to major events like PHP2Shell. We touch on threat models to help distinguish between what eBPF filters can protect against and what still requires secure coding discipline from developers.
Resources
https://ebpf.io
https://falco.org
Show Notes: https://securityweekly.com/asw-406
Interview with Barrett Lyon
Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.
This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.
Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!
Segment Resources:
The main website: https://doxx.net
Doxx.net Discord channel: https://discord.gg/595hAxHH4
Barrett's previous work mapping the internet for the Opte project: https://www.opte.org
Vibe Check
Which security acronym/phrases deserves to be retired?
38% - XDR
25% - Zero Trust
25% - UEBA
6% - CNAPP
6% - Non-Human
0% - Other (leave a comment)
Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants.
I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"?
I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????
Top Comments
"Other - The "AI TRiSM" term can go kick the biggest of rocks"
"Other - Shift left"
"My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over"
Enterprise Weekly News
Finally, in the enterprise security news,
We check out funding
There are a lot of acquisitions
And a round of layoffs
A tech startup goes out of business after two breaches
Private keys should be larger than "4"
PHP2Shell disrupts everyone's plans this week
Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-482
Tor, PhP2Shell, Deepfakes, eMudhra, LiteLLM, Meta, Josh Marpet, and More on this episode of the Security Weekly News.
Show Notes: https://securityweekly.com/swn-627
Special guest Joshua Wright joins us for a timely incident-response discussion!
Then, in the security news this week:
Have you heard about PHP2Shell?
Certificates with keys small enough to guess
Tor exit nodes turn into SSH credential traps
Do USB-C cables need firmware updates now?
HaleHound packs a radio lab into a cheap display
Claude solves part of the NIST curve mystery
The Army and self-directed offensive cyber agents
Retired nuclear reactors return to power AI
PatchSlop
NGINX, NODE.js patches critical flaws
BeyondTrust exploited before the patch landed
Plex vulnerabilities move from PoC to exploitation
ICS patches, including a Siemens flaw exploited in the wild
Can fake data trigger Japan's emergency alert?
Agentic pentests?
AI may add noise more than skill
AI agents navigate OT and move equipment
AI model helps build a Chrome exploit
Utah's VPN law runs into technical reality
Segment Resources:
https://dynamicincidentresponse.com/ - A New Era for Incident Response!
Show Notes: https://securityweekly.com/psw-949
In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most.
Segment Resources: Part 1: Minimum Viable Company: True Cyber Resilience Starts with Identity https://www.semperis.com/blog/minimum-viable-company-true-cyber-resilience-starts-with-identity/ Part 2: Minimum Viable Company: Cyber Resilience Beyond the Breach https://www.semperis.com/blog/minimum-viable-company-cyber-resilience-beyond-the-breach/ Part 3: Minimum Viable Company: Enabling Visibility, Control, Resilience https://www.semperis.com/blog/minimum-viable-company-enabling-visibility-control-resilience/
This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them!
In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more!
Show Notes: https://securityweekly.com/bsw-470
Klingons, Stop and Shop, OvHCloud, Microsoft, Plex2Shell, ReactOS, Aaran Leyland, and More on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-626
