Welcome to the Security Weekly Podcast Network, your all-in-one source for the latest in cybersecurity! This feed features a diverse lineup of shows, including Application Security Weekly, Business Security Weekly, Paul's Security Weekly, Enterprise Security Weekly, and Security Weekly News. Whether you're a cybersecurity professional, business leader, or tech enthusiast, we cover all angles of the cybersecurity landscape.
Tune in for in-depth panel discussions, expert guest interviews, and breaking news on the latest hacking techniques, vulnerabilities, and industry trends. Stay informed and secure with the most trusted voices in cybersecurity!
The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates.
Segment Resources:
https://mas.owasp.org
https://mas.owasp.org/MASWE/
https://hubs.ly/Q04ykvgm0
This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more!
Show Notes: https://securityweekly.com/asw-405
Interview with Michael Jenkins from ThreatLocker
Securing AI on the Endpoint - Zero Trust or Bust
Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given.
We explore how execution control and ringfencing can add some sanity and security to the process.
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Topic Segment: Anthropic Dreams of AI Replicants
Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research.
It is too loose to be an academic paper, but maybe should have been?
Is really a pressing AI risk we should be worried about right now?
Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices?
Weekly Enterprise News
Finally, in the enterprise security news,
we discuss the vibes
certified organic books
don't mess with criminals
the history of ShinyHunters
building strategies on the wrong lessons
crypto wallet supply chain drama
Hot refrigerators
Reddit is great for breach tracking
Microsoft patch Tuesday is on track to hit 12,000 patches by next April
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-481
Mr. Sparkle, Burger King, Pwnscape, Linux, Cisco, GitHub, Microsoft, Josh Marpet, and More on this episode of the Security Weekly News.
Show Notes: https://securityweekly.com/swn-625
In the security news this week:
Convert this router into an SDR
Ivanti straight to root
Anthropic's AI worm FUD
A kernel exploit to fix downloads
Supermarket refrigeration attacks
400 mystery Java vulnerabilities
Authentication bypass
Russia meets the data-center war
Stop & Shop attacked
Anthropic cuts eval agents
AI incident reporting
FortiBleed lives
Anthropic offers scanning
Pre-compromised phones
FakeGit returns
Teams deepfake detection
Let's Encrypt certificates get shorter
GitLab ships another critical patch
Engineer gets prison time for locking thousands of devices
OpenAI employee accused of planting a hidden recorder
Show Notes: https://securityweekly.com/psw-948
Businesses face severe challenges when balancing short-term efficiency with long-term adaptability against unforeseen cyber events. And Artificial Intelligence has only added to those challenges. How should organizations prepare?
Bill O'Connell, Chief Security Officer (CSO) at Commvault, joins Business Security Weekly to discuss why CISOs must think like resilient boxers, not fortresses. Bill will discuss why the CISO is becoming the Chief Resilience Officer and why they need to focus on Availability and Recovery. Bill's four areas of focus include:
AI Governance and Controls
Configuration Management
Backup and Recovery, and
Testing
Balancing artificial intelligence risk with productivity gains requires organizations to manage the tension between speed, security, and human oversight. The business wants to move fast, but security has concerns and employees fear for their jobs. How can organization adopt AI while eliminating friction points?
In this CyberRisk TV interview, Matt Alderman speaks with Ryan Grant, Country Manager for the US and Canada at ESET, about building cyber resilience in the AI era. They discuss findings from ESET's 2026 S&P Cyber Readiness Index, including the continued challenges organizations face with basic cyber hygiene, the growing sophistication of phishing attacks, and the impact AI is having on traditional threats.
Grant explains why organizations should focus on foundational security practices before layering AI-specific defenses on top, including multifactor authentication, access controls, endpoint detection and response, vulnerability and patch management, and incident response planning. He also addresses the rise of shadow AI and AI agents, emphasizing the need for clear policies, governance, access controls, employee training, and continuous monitoring.
The conversation also explores the challenges facing SMBs with limited cybersecurity resources and how managed service providers and security-as-a-service offerings can help close the gap. Grant discusses ESET's newly redesigned Protect offering, which combines security technology, 24/7 monitoring, vulnerability and patch management, multifactor authentication, premium support, and a cyber warranty into a simplified package designed to help organizations strengthen their security posture and focus on prevention.
Segment Resources:
ESET free AI Skills Checker: ESET AI Skills Checker: https://www.eset.com/us/home/ai-skills-checker/ WeLiveSecurity Blog: Learn more about Guardbreaker, AI skills in the ESET H1 Threat Report, and more: www.welivesecurity.com SMB 2026 Cyber Readiness Index: https://www.eset.com/us/about/newsroom/research/eset-2026-smb-cyber-readiness-index/
This segment is sponsored by ESET. Visit https://securityweekly.com/eset to learn more about them!
Show Notes: https://securityweekly.com/bsw-469
Claude Registers for Citizenship, Yandex, Danfoss, Bricks, Purgatorius, Muse, Xandr, Grindr, Aaran Leyland, and More on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-624
To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we expand from there to challenge whether a focus on vulns and patches is even the right choice for an appsec program. Then it's on to incentives, the role of agents in writing and securing software, and what we should be looking for to bring new appsec practitioners into the industry.
Show Notes: https://securityweekly.com/asw-404
Interview with Hadar Krasner, Co-Founder and CPO of Bold Security
This week's interview with Hadar is a fascinating dive into the history of data security and why they chose to tackle endpoint-focused data security. We discuss why securing data is traditionally such a challenging task, making it clear why Bold is such a fitting name for the company. After 30 minutes, we barely scratched the surface and are hoping we can have them back soon for another interview!
Segment Resources:
https://www.bold.security/blog/endpoint-data-ai-human-risk-convergence
https://www.bold.security/blog/what-is-real-time-endpoint-data-protection-bold-makes-it-a-reality
This segment is sponsored by Bold Security. Visit https://securityweekly.com/bold-security to learn more about them!
Topic - Don't Let AI Ruin Your Talk
In this week's topic segment, we discuss the emerging epidemic of low-effort AI-generated slides. AI can definitely make slide creation less painful, but you still need to put some effort in to make a good looking deck that makes sense. If you don't, your audience WILL notice.
Enterprise Security News
Finally, in the enterprise security news,
we discuss the Sawtooth problem
cybersecurity is center stage in AI
not everyone is a big fan of passkeys
Ross Haleliuk is back with some interesting essays
insider threats: sometimes the cybercriminal was inside your organization all along
AI can now read your mind
and as always, we'll kick off with the vibes
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-480
Airline Zoom Calls, School Picture Day, Windows, TP-Link, AgentCorruption, OSS Scanner, Josh Marpet, and More on this episode of the Security Weekly News.
Show Notes: https://securityweekly.com/swn-623
In the security news this week:
BPFDoor
OpenSSH compresses a little too much
AI can find bugs. Who gets them fixed?
TP-Link and the courts
Cisco NX-API
ClingSTUN
LineageOS, Android TV, and a Raspberry PI
Dell's updater has a privilege problem
SonicWall SSRF
U-Boot's LogoFAIL like
Exploit-DB isn't dead
MFA passes. The attacker still gets in.
LakeShark and cool gadgets
Kasa cameras and an exposed debug interface
SharePoint hardening is back on the checklist
Google pauses open-source bug bounty submissions
NetScaler's latest vulnerability needs a closer look
Kiteworks tells customers to shut it down
Exchange gets an unexpected security update
Do LLMs actually reason?
disagree on AI risk?
Anthropic, AI consciousness and the Vatican
Grok gets involved in foreign policy
WordPress malware that survives cleanup
Can spyware vendors stop their own tools?
When an AI chatbot conversation reaches the police
Open-weight AI models enter the cyber debate
AI agents take their attacks shopping
Show Notes: https://securityweekly.com/psw-947
Harvest-Now-Decrypt-Later attacks are already in motion. Unmanaged keys and outdated algorithms are active weaknesses within an organization's infrastructure. When quantum decryption arrives, the fallout will be immediate—compliance gaps, lost trust, and financial impact. How should organizations prepare?
Vijay Viswanathan, Vice President of Product at ISARA Corporation, joins Business Security Weekly to discuss quantum safe security. For most organizations, cryptography is hidden, therefore it's risk is hidden or unknown. Vijay will discuss how to prepare for Q day, including the steps that should be taken now:
Cryptographic discovery and posture analysis
Executive communication on cryptographic risks
Mitigation and migration strategies
Crypto agility for ongoing maintenance
Segment Resources:
https://isara.com/blog-posts/enterprise-buyers-guide-for-quantum-safe-security/?utmsource=podcast&utmmedium=segment-resource&utm_campaign=bsw
This segment is sponsored by ISARA Corporation. Visit https://securityweekly.com/isara to learn more about them!
In the leadership and communications segment, AI Governance Frameworks Won't Save You, but an Ethically Engaged Workforce Might, Cyber Skills Diminish Quicker than Organizations Can Build Readiness, The Mindsets Leaders Need as AI Accelerates the Pace of Business, and more!
Show Notes: https://securityweekly.com/bsw-468
Typing, textGrain, NetScaler again, Fortinet, Copilot, LibreOffice, Dots, Aaran Leyland, and More on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-622
The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approaching new standards, guidelines, and practical deployment patterns to make it easier for orgs to establish more refined and correct access policies. It's a problem that predates LLMs, but also one that agents and MCPs made all the more acute. We talk about what intent means when trying to constrain agents' activities, what role LLMs have in policy decisions, and how LLMs can help create a much-needed inventory of access controls.
Segment Resources:
https://www.cerbos.dev/blog/dimmer-switch-not-a-kill-switch-rethinking-ai-agent-governance
https://www.cerbos.dev/blog/multi-hop-delegation-ai-agents
https://openid.net/wg/authzen/
Show Notes: https://securityweekly.com/asw-403
Interview with Aqsa Taylor
Exaforce's Chief Security Evangelist, Aqsa, joins us to discuss the current state of the AI SOC and why it covers so much more than it did over 2 years ago, when our podcast first started covering this market. Exaforce also recently released AI Security and its ExaGo mobile app - we're very excited about the possibility of analyzing incidents at the grocery store!
This segment is sponsored by Exaforce. Visit https://securityweekly.com/exaforce to learn more about them!
Topic Segment - Regulating AI
The AI industry's sandbox escapes have had a big impact on everyone and unsurprisingly, there's a bill proposing to ban some AI products and pause the development of others.
It seems that, increasingly, as pro-AI and anti-AI groups become more polarized and divided, you could start an entire podcast that does nothing but fact-check both sides. We're an emotional species and it seems the more heated debate gets, the more folks on both sides are willing to straight-up fabricate things to help argue their points.
Today's focus is this YouTube video: https://www.youtube.com/watch?v=WXsTCJl7sU4
It's the most on-the-nose type of propaganda - straight up claiming the government is going to break into your house and take your GPUs and LLMs. Could the bill proposed by Bernie Sanders and Greg Casar be characterized as extreme? Sure, but it's nowhere near as extreme as the title of the video, "They're Banning AI Servers at Home" suggests.
The hardest things to swallow about the video:
it characterizes Bernie Sanders as "the government", as if he's representative of most of the US government rather than an outlier that has little to no chance to get a bill like this passed
it never mentions the fact that the bill establishes a model cutoff, measured in training effort (10^25 flops, which doesn't include the open weight models you're using at home, unless you have an 8x cluster of DGX Sparks - $40k+ worth of AI compute)
Enterprise News
Finally, in the enterprise security news,
we check the vibes
massive, connected funding
NVIDIA OpenShell
cars are still hackable
a ransomware arrest turned into a murder investigation
AI welfare
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-479
RAM, Muse, CloudSyncD, Springsteen, Who Owns Your Software?, Persistence, Michael Jenkins, CTO of ThreatLocker, and More on this episode of the Security Weekly News.
Segment Resources: https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news:
Compiling spreadsheets, because that's why
Nvidia wants to put AI agents in timeout
Citrix NetScaler gets exploited again, and again
Spectre still refuses to die
Your SBOM is incomplete?
File notifications leak more than filenames
ENIAC had cables instead of a BIOS
Another Linux kernel root exploit lands
Containers share a kernel
ThinkNode M9 microSD card gets a virus notice
Google analyst infiltrates a supply-chain gang
Your phone speaker can transmit radio
Reconstructing firmware with a logic analyzer
Robot dogs learn cybersecurity
CISA warns about third-party ICS integrators
Dutch police arrest a ShinyHunters suspect
A soldier goes from telecom hacking to prison
AI companies discover their agents have opinions
Cloudflare containers accidentally share leftovers
OT networks are still mostly not isolated
Florida wants to pause ChatGPT
The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Show Notes: https://securityweekly.com/psw-946
At a time when the traditional approach to enterprise vulnerability management is no longer effective, security leaders are turning to AI agents to help identify, validate, and contain zero-day threats. Learn how Google Cloud Security is building autonomous detection engineering to help your organization close the remediation gap, establish compensating controls to protect business assets, and outpace AI-powered adversaries.
Segment Resources:
https://services.google.com/fh/files/misc/monitoringandstoppingaipowered_threats.pdf https://cloud.google.com/blog/products/identity-security/detecting-and-containing-powered-threats-with-google-security-operations-agents?e=48754805
This segment is sponsored by Google Cloud. Visit https://securityweekly.com/googlecloud to learn more about them!
In the leadership and communications segment, CISOs can no longer ignore the nation-state threat, AI Policies Won't Save You If You Can't See The Risk, The Invisible Work Draining Your Best Employees , and more!
Show Notes: https://securityweekly.com/bsw-467
Venus in Furs, Money Laundering, Agentic AI Hijinx, MCP, Thunderbastard, Aaran Leyland, and More on the Security Weekly News.
Show Notes: https://securityweekly.com/swn-620
Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding interconnected systems than fixing a single piece of software. We discuss how orgs can be more effective at securing their environment and what role LLMs might have in evaluating controls. Plus, we look to the future of bug bounty programs and how researchers can still excel through curiosity and expertise on a topic rather than relying on scanners, prompts, and luck.
Show Notes: https://securityweekly.com/asw-402
Interview with Christopher Crawley - The Value of SecOps
This week, we talk to Chris Crawley about his new book, The Value of Cybersecurity Operations. Chris has been training teams on security operations for years, but found that students often struggled to justify the importance of secops training and even the need for secops in general. This book was written to more broadly arm practitioners with the information they need to communicate why security operations are necessary to leadership.
The book is available in several forms: eBook, hardcover, softcover, and an audiobook read by Chris himself!
You can pick all versions up here: https://shop.montance.com/collections/all and Security Weekly listeners get 50% off with code sw-50!
The Evolving Exploitation of Trust with Josh Davies, Security Strategist at Fortra
Fortra Intelligence and Research Experts (FIRE) is Fortra's emergent threat intelligence identity, created to unify research teams across multiple security disciplines and share intelligence with the wider threat intelligence community. FIRE co-ordinator and security strategist Josh Davies joins us to share insights from original FIRE research like Calphishing, Mirage2FA, RatPressto phishkit and heavily obfuscated campaigns that evade defences. While also digging into trends from big data analysis within phishing, fraud, social engineering and credential theft.
Segment Resources:
Art of Security Podcast
Fortra Research
This segment is sponsored by Fortra. Access FIRE Research here: https://securityweekly.com/fortrabh
Why Agentic AI Security Requires a Defense-In-Depth Strategy with Kaushik Shanadi, CTO and Co-Founder of Helmet Security
Many organizations are approaching agentic AI security by stitching together individual controls, assuming that identity, network, endpoint, or application security alone is enough. Each address only one part of the problem. As AI agents become more autonomous, move across systems, and take actions on behalf of users, organizations need a true defense-in-depth strategy that combines every layer of the security stack. Kaushik can discuss how each security layer provides a different piece of the puzzle and how individually, none of the controls are sufficient. But together, they create the layered governance needed to securely deploy agentic AI.
For more information about Helmet Security, please visit https://securityweekly.com/helmetbh
Above Security on Why Legacy Tools Don't Cut It for Modern Insider Risk with Tricia Howard, Head of Marketing at Above Security
As organizations rush to adopt agentic AI, agents are often given broad access to critical business systems and sensitive data. Legacy insider risk management tools weren't built for this, and organizations have spent years on insider risk posturing and investments that leave security teams inundated with false positives while the real risk slips through undetected. In this segment, Tricia Howard draws on her decade in cybersecurity, including years watching user and entity behavior analytics (UEBA) overpromise and underdeliver, to unpack why understanding human – and now AI – intent is the missing piece.
Segment Resources:
Blog Post: Redefining Insider Threat
Blog Post: What I wanted UEBA to be, Years Ago
To learn more about Above Security and insider risk management in the era of agentic AI, visit: https://securityweekly.com/abovebh
The Identity Crisis Your Security Team Didn't See Coming: Governing AI Agents with Darren Guccione, CEO and Co-Founder of Keeper Security
AI agents outnumber human identities in enterprise environments, and traditional security software was never built to govern them. 89% of cybersecurity decision-makers recently surveyed by Keeper Security said that AI adoption has made identity management harder.
In this Black Hat USA conversation with Cyber Risk TV, Darren Guccione, CEO and Co-Founder of Keeper Security, shares a practical framework for extending identity governance to non-human identities and AI agents before the access gap becomes a breach.
Segment Resources:
Privileged Access Management
Identity Security at Machine Speed
To learn more about Keeper Security, visit: https://securityweekly.com/keeperbh
Show Notes: https://securityweekly.com/esw-478
