Skip to content
Sign in
Artwork for SECURITY.COM The Podcast
Technology

SECURITY.COM The Podcast

Daniel Tu Mellinger

In-depth intel. Real talk. Human factor.

Join Dan Mellinger, your go-to cybersecurity communicator, as he bridges the gap between cutting-edge security tech and the humans who make it work.

Every first and third week each month, he unpacks security stories and technical deep dives—from threat hunting to the not-so-secrets of Data Security and SSE others won’t tell you—all rooted in the same high‑quality content and bold thought leadership you’ve come to expect from SECURITY.COM.

Play
Open in
  • 22 episodes
  • fortnightly
  • Avg 36 min
  • English

Episodes 22

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S2 · E13
    Tuesday · 57 min

    Known Exploited Doesn't Stay Exploited | Empirical Security

    "Known exploited" is treated as a permanent state. The data says it isn't. If a vulnerability was exploited today, there's a 99.9% chance it's exploited again in the next 30 days. Go a year without observed activity and it's back at the base rate, as if it had never been exploited at all. CISA's KEV catalog has no last-observed field, and it only ever grows. Ed Bellis (CEO), Jay Jacobs (Chief Data Scientist) and Michael Roytman (CTO) of Empirical Security, the team behind Kenna Security and co-creators of EPSS, are back after a $25M Series A to talk about what Kenna couldn't finish: prioritization models trained per organization instead of one global score. Along the way: the 15,000-plus exploited CVEs that never make KEV and the 400-plus KEV entries their telemetry never sees; whether NVD gating enrichment on KEV hard-codes a stale signal into everyone's pipeline; the "dead vulnerability theory" of metadata bias; why their models are deterministic statistics rather than LLMs ("LLMs summarize the past really well; they don't predict"); a live on-air bet that 2026 ends with 120,000 CVEs; whether six years of exploitation data show any AI-acceleration signature yet (more discovery, flat actionable exploitation, a denominator growing faster than the numerator); what building EPSS as a public good taught them about probability and thresholds; and whether gated frontier models create a two-tier research world (Ed: "I don't think it matters at all"). Chapters: 00:00 – Known exploited isn't permanent: the premise, and a disclosure 01:26 – What Kenna proved, and what it couldn't solve 05:50 – The $25M Series A, and why the models aren't LLMs 09:11 – The KEV decay curve: 99.9% today, base rate in a year 13:25 – The third circle: exploited CVEs that KEV never lists 15:30 – NVD gates on KEV: stale signal, metadata bias, a data problem 24:17 – A last-observed field for KEV, and whether it tips off attackers 27:28 – Is AI accelerating exploitation? The 120,000-CVE bet 34:33 – LLMs summarize the past; forecasting models predict 40:59 – Lessons from building EPSS: probability, thresholds, donated data 50:23 – Gated frontier models and the two-tier research question 54:47 – Foundation vs. Radiant: targets of opportunity vs. targeted Links Empirical Security research: https://research.empiricalsecurity.com The KEV Paradox (Empirical Security, Jan 2026): https://research.empiricalsecurity.com/research/the-kev-paradox Looking for the AI vulnerability flood (Ben Edwards): https://research.empiricalsecurity.com/research/looking-for-the-ai-vulnerability-floodEPSS: https://www.first.org/epss/ CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalogListen on More episodes: https://www.youtube.com/@symantec/podcasts More research and expert perspectives: https://www.security.com Guests: Ed Bellis, CEO; Jay Jacobs, Chief Data Scientist; Michael Roytman, CTO — Empirical Security. Host: Dan Mellinger.SECURITY.COM The Podcast — In-depth intel. Real talk. Human factor.

  • S2 · E12
    September 30 · 40 min

    Every Vendor Claims 99%. What Security Tests Really Measure | AV Comparatives

    Every endpoint product on the market claims 99%-plus protection, and they're all telling the truth. That is exactly why independent testing exists. Thomas Uhlemann of AV-Comparatives, the Innsbruck lab that has spent two decades trying to make "does it work?" a question with a defensible answer, walks through what each test actually does, what it deliberately doesn't measure, and how to read a report without being led by a vendor's cherry-picked chart.Disclosure: Broadcom participates in AV-Comparatives testing. Thomas runs communications, not testing, and this conversation is about methodology. No results or placements are discussed.What's inside: why the Real-World Protection Test runs products at default settings, online and offline, with USB and web-borne attack paths; why certification demands zero false positives on common business software ("malware might break your productivity, false positives will"); how vendors try to buy detection rates with false positives and why bi-monthly testing exposes it; why the EDR Detection Validation test disables blocking to measure signal-to-noise, and why failing vendors are anonymized; how the EPR test folds downtime and man-hours into total cost of ownership and refuses to name a winner; and a defender's checklist for reading any test report, starting with the methodology, not the chart.Chapters00:00 – Why independent testing exists, and who AV-Comparatives is06:24 – Real-World Protection: default settings, online, offline, USB09:40 – Malware Protection and the zero-false-positive rule14:53 – How vendors try to game tests, and why bi-monthly runs matter18:24 – EDR Detection Validation: signal-to-noise and anonymized vendors24:12 – EPR test: TCO, the quadrant, and why no winner is declared28:40 – How to read a report, and what tests can't measure34:21 – A defender checklist and healthy paranoia36:57 – AI in testing: faster, not newLinksAV-Comparatives: https://www.av-comparatives.orgMore episodes: https://www.youtube.com/@symantec/podcastsMore research and expert perspectives: https://www.security.comGuest: Thomas Uhlemann, Cybersecurity Evangelist, AV-Comparatives.Host: Dan Mellinger.SECURITY.COM The Podcast — In-depth intel. Real talk. Human factor.

  • S2 · E11
    September 21 · 38 min

    The Channel Isn't Dying. The Reseller Model Is.

    The channel isn't dying. The traditional reseller model is. Alan Maxwell, who leads Broadcom's Catalyst partner business internationally, puts the number on it: fewer than 15–20% of partner sales engineers could pass an unscripted, hands-on XDR architecture exam today, and the partners winning right now are the ones who stopped selling licenses and started selling outcomes.Alan just wrapped a six-part series on SECURITY.COM called The Resilient Channel. This conversation pulls it together for the VARs, MSSPs, distributors and integrators who sit between the vendor and the SOC: which structural force partners are underestimating most (regulation and cyber insurance, not AI), what separates a services-led partner from one with services language bolted on (revenue mix, hiring, comp plans), a 24-month plan to flip from 80% resale to 50/50, why MDF reform is finally real, a one-question test for whether a vendor's "agentic SOC" is agentic at all, and the liability gray area nobody in the industry has solved: when an autonomous agent knocks production offline, who holds the bag? Chapters00:00 – Who this episode is for: a 4-minute primer on the channel05:10 – Three things vendors and customers get wrong about partners06:44 – The partner's new burden: regulation, insurance, AI-speed threats11:38 – Architecting for margin: real services partners vs. fake ones17:23 – Technical enablement: why most SEs can't pass an unscripted exam22:38 – MDF reform, co-marketing that converts, compliance as an edge28:59 – Agentic AI claims, marketing math, and the liability gray area34:57 – One thing every partner CEO should do next quarter Read the seriesThe Resilient Channel, Part 1: https://www.security.com/expert-perspectives/resilient-channel-series-part-1Part 2: https://www.security.com/expert-perspectives/resilient-channel-series-part-2Part 3: https://www.security.com/expert-perspectives/resilient-channel-series-part-3Part 4: https://www.security.com/blog-post/resilient-channel-series-part-4Part 5: https://www.security.com/blog-post/resilient-channel-series-part-5Part 6: https://www.security.com/expert-perspectives/resilient-channel-series-part-6

  • S2 · E10
    June 19 · 12 min

    The Parasite in the Machine: Unmasking the Speagle Infostealer

    Symantec Threat Hunters found malware that turns a legitimate document-security platform into its own exfiltration channel. Infostealer.Speagle hijacks Cobra DocGuard to chase Chinese ballistic missile documents — then uses the platform's own driver to delete itself. A look at the Runningcrab activity cluster. Listen in.

  • S2 · E9
    May 20 · 21 min

    The Death of SIEM

    SIEM was supposed to be the nerve center of every security operation — collect every log, correlate every event, surface every threat. Most organizations ended up with an expensive log warehouse that generates more noise than signal. Recorded live from RSAC, Dan sits down with Justin Falck — Head of Product for Endpoint at the Enterprise Security Group at Broadcom — to break down where the SIEM model broke, why "magic correlation" never showed up, and what's actually replacing it in modern security operations. In this episode: The original promise of SIEM and where the math fell apart How detection engineering became a budget black hole Why XDR and MDR are reshaping the SOC "Owning the blades" — vendor-native correlation vs. data-lake aggregation Where SIEM still works (and the team sizes it takes) A look at CBX, Carbon Black's XDR launch from RSAC More at security.com. Subscribe, rate, and share with your fellow defenders. Stay sharp, stay curious, stay human.

  • S2 · E8
    May 6 · 31 min

    Hoodies to Headlines: The Evolution of Cybersecurity PR w/ W2 Communications

    The Evolution of Cybersecurity Media & PR — with Tony Welz, W2 Communications Cybersecurity went from a niche trade-press beat to a nation-state strategy domain in about 25 years. Dan Mellinger sits down with Tony Welz, co-founder of W2 Communications — a strategic communications agency that's specialized in cybersecurity for 23 years — to unpack how the story got told along the way, and who's telling it now. Tony's been in the room for nearly every inflection point: working with Sourcefire from their A-round through their Cisco acquisition, watching FireEye seed the modern threat-research content model, navigating the Target/Sony/Ashley Madison breach era, and helping clients adapt to today's SEC disclosure rules and geopolitical cyber reality.

  • S2 · E7
    April 22 · 14 min

    Iran's Cyber Warfare Playbook: What Defenders Need to Know Right Now

    Iran has always been active in cyberspace — but with U.S. and Israeli kinetic operations underway in March 2026, they're under pressure to make an impact, and cyber is where they can fight asymmetrically. Dan Mellinger and Symantec threat intelligence veteran Dick O'Brien break down what defenders are actually seeing right now: active intrusions on 5–6 organizations in the U.S. and Canada, the recent Stryker attack that weaponized Microsoft Intune instead of malware, and why Iranian operators are rapidly absorbing Russian cloud-attack tradecraft. Plus: why Iran is effectively the #2 most prevalent nation-state adversary, the surprisingly effective social engineering campaigns they're running, the little-known Iranian origins of modern ransomware, and the practical steps every U.S.-facing organization should take this week. More analysis at security.com.

  • S2 · E6
    April 6 · 38 min

    A Brief History of DLP

    How did Data Loss Prevention go from a forgotten niche to a boardroom necessity? In this episode, host Dan Mellinger sits down with Matt Jones, Channel Technical Director for Information Security at Broadcom's Enterprise Security Group, to trace the full arc of DLP — from its earliest roots to its role in today's enterprise security stack. Matt brings over two decades of hands-on experience, from the days of MimeSweeper and email content inspection to building managed DLP services and working with Symantec DLP for 15+ years. Together, they explore: 🕰️ The pre-DLP era — when data protection meant "don't leave documents on the printer" 📜 The regulatory turning points — HIPAA, Sarbanes-Oxley, and how GDPR made the board finally pay attention 🔍 How breach types evolved — from accidental data leaks to deliberate insider threats 🤖 The role of AI and machine learning in modern data classification ☁️ DLP in a cloud-first world — why the perimeter is gone and what that means for your data strategy 💡 Matt's #1 piece of advice: Start with accurate data classification — and don't forget to review your policies Whether you're a security practitioner, a CISO, or just trying to understand why DLP matters more than ever, this episode delivers real history, real context, and real talk. 🔗 More insights at Security.com 🎧 Subscribe | Rate | Share Stay sharp, stay curious, and stay human. #Cybersecurity #DLP #DataLossPrevention #InfoSec #SecurityPodcast #DataSecurity #Symantec #Broadcom #CloudSecurity #ZeroTrust

  • S2 · E5
    March 4 · 42 min

    AI-Hacking: Red Team vs. Blue Team

    As AI shifts from passive large language models (LLMs) to active "Agents" capable of executing tasks, the cybersecurity landscape is hitting a fever pitch. In this episode, recorded ahead of their Black Hat Europe presentation, your go-to cybersecurity communicator Dan Mellinger sits down with Paul Miller (Threat Intelligence & Ops Leader) and Dick O’Brien (Principal Research Editor, Symantec & Carbon Black) to dissect the escalating AI arms race.From the rise of "SpamGPT" to the shift toward "Predictive Security," we explore why defenders might actually have the winning hand in an AI-driven world.

  • S2 · E4
    February 18 · 56 min

    Personal Privacy w/ Electronic Frontier Foundations (EFF)

    In this episode, Dan Mellinger and Paul Miller host Cooper Quintin from the Electronic Frontier Foundation (EFF) to discuss the evolving landscape of cybersecurity, privacy threats, and the importance of human rights in the digital age. They explore the impact of smartphones on privacy, the role of tools like Privacy Badger, and the need for comprehensive privacy legislation. The conversation also highlights the significance of activism and community involvement in advocating for digital rights and privacy protections.

  • S2 · E3
    February 4 · 16 min

    2026 Threat Predictions

    Dick O'Brien details the Symantec Threat Hunters cybersecurity predictions for 2026. One of which we've already seen come to pass in January.Five Cyber Predictions for 2026: https://www.security.com/feature-stories/five-cyber-predictions-2026

  • S2 · E2
    January 28 · 55 min

    AI Code Insecurity w/ Veracode

    Dan Mellinger and Paul Miller chat with the legendary Chris Wysopal. They discuss the evolution of cybersecurity, the impact of AI on code security, and the responsibilities of developers in the age of automated coding tools. They explore the legacy of The L0pht, the challenges of integrating AI into security practices, and the importance of maintaining vigilance in code security despite advancements in technology.

  • S2 · E1
    January 14 · 22 min

    Ransomware in 2025

    The cyber-extortion epidemic reached new heights in 2025, with a record number of attacks recorded. This increase is being powered by a new breed of attackers who eschew encryption and rely solely on data theft as leverage for extortion. Recorded live at Black Hat Europe in London, Symantec & Carbon Black Threat Hunter, Dick O'Brien shares how Ransomware strategies shifted in 2025 and what's coming in 2026.

  • S1 · E9
    Nov 19, 2025 · 43 min

    Chasing Vulns w/ Jerry Gamblin

    Dan Mellinger interviews the legendary cybersecurity vulnerability researcher and open-source tool developer, Jerry Gamblin. They explore the importance of understanding CVEs, the role of MITRE, and the significance of the CNA Scorecard in improving data quality. Jerry shares insights on the challenges of managing vulnerabilities, the impact of decentralization, and the need for collaboration among software vendors. The conversation also touches on best practices for vulnerability management, addressing vulnerability fatigue, and the potential of AI in enhancing data processes. Jerry concludes with a glimpse into upcoming projects and innovations at RogoLabs.You can check out all of Jerry's open source tools here: https://rogolabs.net

  • S1 · E8
    Nov 5, 2025 · 51 min

    Managing Security Analyst Burnout

    Paul Miller talks about a topic close to his heart: managing Security Operations team workload. He discusses the causes of analyst burnout, along with signs and ways to help mitigate the impacts, both human and operational.

  • S1 · E7
    Oct 15, 2025 · 47 min

    Authentically Marketing Cybersecurity

    Dan sits down with Monica White, the CMO of the Enterprise Security Group at Broadcom (and his boss), to talk about the often winding career paths in marketing, early best practices, and understand how authenticity is the key to build durable brands.

  • S1 · E6
    Oct 1, 2025 · 32 min

    From Cybersecurity Products to Platforms

    Dan sits down with his colleague Nate Fitzgerald (head of product management for ESG) to discuss how and why the cybersecurity market has been transitioning from individual Products to (sometimes) integrated Platforms.

  • S1 · E5
    Sep 17, 2025 · 35 min

    Cybersecurity Testing: Tuned for the Test or Tuned for the Real World?

    Simon Edwards, Founder and CEO of SE Labs, and Adam Bromwich, CTO of the Enterprise Security Group at Broadcom join Dan in Las Vegas to dive into the details on cybersecurity testing which has been one of the more consistently dramatic topics in the industry.Definitely check out SE Labs to learn more from the best real world performance testing in the industry: https://selabs.uk

  • S1 · E4
    Sep 3, 2025 · 58 min

    Diving Deep Into Vulnerability Risk Modeling w/ Empirical Security

    Recorded from Hacker Summer Camp in Las Vegas, Dan dives deep into the history and current state of measuring cybersecurity vulnerability risk at scale with the team from Empirical Security. Ed, Michael, and Jay discuss some of the history of vulnerability measurement through the last decade and how they thin the time is now for organizations to start applying highly-specific local vulnerability modeling to their security strategies. There is a ton of amazing information you won't find anywhere else on the Empirical Security Blog: https://www.empiricalsecurity.com

Showing 1–20 of 22 episodes