loader from loading.io

EP239 Linux Security: The Detection and Response Disconnect and Where Is My Agentless EDR

Cloud Security Podcast by Google

Release Date: 08/18/2025

EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen show art EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen

Cloud Security Podcast by Google

Guest: , VP of Engineering at Google, former CISO of Alphabet Topics: The "God-Like Designer" Fallacy: You've argued that we need to move away from the "God-like designer" model of security—where we pre-calculate every risk like building a bridge—and towards a biological model. Can you explain why that old engineering mindset is becoming risky in today’s cloud and AI environments? Resilience vs. Robustness: In your view, what is the practical difference between a robust system (like a fortress that eventually breaks) and a resilient system (like an immune system)? How does a CISO...

info_outline EP257 Beyond the 'Kaboom': What Actually Breaks When OT Meets the Cloud? show art EP257 Beyond the 'Kaboom': What Actually Breaks When OT Meets the Cloud?

Cloud Security Podcast by Google

Guest: , Technical Leader, OT Consulting, Mandiant Topics: When we hear “attacks on Operational Technology (OT)” some think of Stuxnet targeting PLCs or even backdoored pipeline control software plot in the 1980s. Is this space always so spectacular or are there less “kaboom” style attacks we are more concerned about in practice? Given the old "air-gapped" mindset of many OT environments, what are the most common security gaps or blind spots you see when organizations start to integrate cloud services for things like data analytics or remote monitoring? How is the shift to cloud...

info_outline EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance show art EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance

Cloud Security Podcast by Google

Guest: Topics: Do you believe that AI is going to end up being a net improvement for defenders or attackers?  Is short term vs long term different? We’re excited about the new book you have coming out with your co-author .  We want to ask the same question, but for society: do you think AI is going to end up helping the forces of liberal democracy, or the forces of corruption, illiberalism, and authoritarianism?  If exploitation is always cheaper than patching (and attackers don’t follow as many rules and procedures), do we have a chance here?  If this requires...

info_outline EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking show art EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking

Cloud Security Podcast by Google

Guest: , VP of Security Engineering, Google Topic: The term "AI Hacking Singularity" sounds like pure sci-fi, yet you and some other very credible folks describe an imminent threat. How much of this is hyperbole to shock the complacent, and how much is based on actual, observed capabilities today?  Can autonomous AI agents really achieve that "exploit - at - machine - velocity" without human intervention for the zero-day discovery phase? On the other hand, why may it actually not happen? When we talk about autonomous AI attack platforms, are we talking about highly resourced...

info_outline EP254 Escaping 1990s Vulnerability Management: From Unauthenticated Scans to AI-Driven Mitigation show art EP254 Escaping 1990s Vulnerability Management: From Unauthenticated Scans to AI-Driven Mitigation

Cloud Security Podcast by Google

Guest: , Consulting Manager on Security Transformation Team, Mandiant, Google Cloud Topics: How has vulnerability management (VM) evolved beyond basic scanning and reporting, and what are the biggest gaps between modern practices and what organizations are actually doing? Why are so many organizations stuck with 1990s VM practices? Why mitigation planning is still hard for so many? Why do many organizations, including large ones, still rely on unauthenticated scans despite the known importance of authenticated scanning for accurate results? What constitutes a "gold standard" vulnerability...

info_outline EP253 The Craft of Cloud Bug Hunting: Writing Winning Reports and Secrets from a VRP Champion show art EP253 The Craft of Cloud Bug Hunting: Writing Winning Reports and Secrets from a VRP Champion

Cloud Security Podcast by Google

Guests: , bug bounty hunter Sreeram KL, bug bounty hunter Topics: We hear from the Cloud VRP team that you write excellent bugbounty reports - is there any advice you'd give to other researchers when they write reports? You are one of Cloud VRP's top researchers and won the MVH (most valuable hacker) award at their event in June - what do you think makes you so successful at finding issues?  What is a Bugswat? What do you find most enjoyable and least enjoyable about the VRP? What is the single best piece of advice you'd give an aspiring cloud bug hunter today?  Resources: ...

info_outline EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success show art EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success

Cloud Security Podcast by Google

Guests: , Deputy Group CISO, Allianz ,  Global Head of D&R, Allianz  Topics:  Moving from traditional SIEM to an agentic SOC model, especially in a heavily regulated insurer, is a massive undertaking. What did the collaboration model with your vendor look like?  Agentic AI introduces a new layer of risk - that of unconstrained or unintended autonomous action. In the context of Allianz, how did you establish the governance framework for the SOC alert triage agents? Where did you draw the line between fully automated action and the mandatory "human-in-the-loop" for...

info_outline EP251 Beyond Fancy Scripts: Can AI Red Teaming Find Truly Novel Attacks? show art EP251 Beyond Fancy Scripts: Can AI Red Teaming Find Truly Novel Attacks?

Cloud Security Podcast by Google

Guest: , CEO at Topics: The market already has Breach and Attack Simulation (BAS), for testing known TTPs. You’re calling this 'AI-powered' red teaming. Is this just a fancy LLM stringing together known attacks, or is there a genuine agent here that can discover a truly novel attack path that a human hasn't scripted for it? Let's talk about the 'so what?' problem. Pentest reports are famous for becoming shelf-ware. How do you turn a complex AI finding into an actionable ticket for a developer, and more importantly, how do you help a CISO decide which of the thousand 'criticals' to...

info_outline EP250 The End of EP250 The End of "Collect Everything"? Moving from Centralization to Data Access?

Cloud Security Podcast by Google

Guest: , CEO at , original founder of Topics: Are we really coming  to “access to security data” and away from “centralizing the data”? How to detect without the same storage for all logs? Is data pipeline a part of SIEM or is it standalone? Will this just collapse into SIEM soon? Tell us about the issues with log pipelines in the past? What about enrichment? Why do it in a pipeline, and not in a SIEM? We are unable to share enough practices between security teams. How are we fixing it? Is pipelines part of the answer? Do you have a piece of advice for people who want to do...

info_outline EP249 Data First: What Really Makes Your SOC 'AI Ready'? show art EP249 Data First: What Really Makes Your SOC 'AI Ready'?

Cloud Security Podcast by Google

Guest: , co-founder and CEO at Topics: We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from achieving it today? You've also raised a metaphor of AI in the SOC as a "Dr. Jekyll and Mr. Hyde" situation. Could you walk us through what you see as the "Jekyll"—the noble, beneficial promise of AI—and what are the factors that can turn it into the dangerous "Mr....

info_outline
 
More Episodes

Guest:

Topics:

  • When it comes to Linux environments – spanning on-prem, cloud, and even–gasp–hybrid setups – where are you seeing the most significant blind spots for security teams today? 
  • There's sometimes a perception that Linux is inherently more secure or less of a malware target than Windows. Could you break down some of the fundamental differences in how malware behaves on Linux versus Windows, and why that matters for defenders in the cloud?
  • 'Living off the Land' isn't a new concept, but on Linux, it feels like attackers have a particularly rich set of native tools at their disposal. What are some of the more subtly abused but legitimate Linux utilities you're seeing weaponized in cloud attacks, and how does that complicate detection?
  • When you weigh agent-based versus agentless monitoring in cloud and containerized Linux environments, what are the operational trade-offs and outcome trade-offs security teams really need to consider? 
  • SSH keys are the de facto keys to the kingdom in many Linux environments. Beyond just 'use strong passphrases,' what are the critical, often overlooked, risks associated with SSH key management, credential theft, and subsequent lateral movement that you see plaguing organizations, especially at scale in the cloud?
  • What are the biggest operational hurdles teams face when trying to conduct incident response effectively and rapidly across such a distributed Linux environment, and what's key to overcoming them?

Resources: