loader from loading.io

EP241 From Black Box to Building Blocks: More Modern Detection Engineering Lessons from Google

Cloud Security Podcast by Google

Release Date: 09/01/2025

EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success show art EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success

Cloud Security Podcast by Google

Guests: , Deputy Group CISO, Allianz ,  Global Head of D&R, Allianz  Topics:  Moving from traditional SIEM to an agentic SOC model, especially in a heavily regulated insurer, is a massive undertaking. What did the collaboration model with your vendor look like?  Agentic AI introduces a new layer of risk - that of unconstrained or unintended autonomous action. In the context of Allianz, how did you establish the governance framework for the SOC alert triage agents? Where did you draw the line between fully automated action and the mandatory "human-in-the-loop" for...

info_outline EP251 Beyond Fancy Scripts: Can AI Red Teaming Find Truly Novel Attacks? show art EP251 Beyond Fancy Scripts: Can AI Red Teaming Find Truly Novel Attacks?

Cloud Security Podcast by Google

Guest: , CEO at Topics: The market already has Breach and Attack Simulation (BAS), for testing known TTPs. You’re calling this 'AI-powered' red teaming. Is this just a fancy LLM stringing together known attacks, or is there a genuine agent here that can discover a truly novel attack path that a human hasn't scripted for it? Let's talk about the 'so what?' problem. Pentest reports are famous for becoming shelf-ware. How do you turn a complex AI finding into an actionable ticket for a developer, and more importantly, how do you help a CISO decide which of the thousand 'criticals' to...

info_outline EP250 The End of EP250 The End of "Collect Everything"? Moving from Centralization to Data Access?

Cloud Security Podcast by Google

Guest: , CEO at , original founder of Topics: Are we really coming  to “access to security data” and away from “centralizing the data”? How to detect without the same storage for all logs? Is data pipeline a part of SIEM or is it standalone? Will this just collapse into SIEM soon? Tell us about the issues with log pipelines in the past? What about enrichment? Why do it in a pipeline, and not in a SIEM? We are unable to share enough practices between security teams. How are we fixing it? Is pipelines part of the answer? Do you have a piece of advice for people who want to do...

info_outline EP249 Data First: What Really Makes Your SOC 'AI Ready'? show art EP249 Data First: What Really Makes Your SOC 'AI Ready'?

Cloud Security Podcast by Google

Guest: , co-founder and CEO at Topics: We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from achieving it today? You've also raised a metaphor of AI in the SOC as a "Dr. Jekyll and Mr. Hyde" situation. Could you walk us through what you see as the "Jekyll"—the noble, beneficial promise of AI—and what are the factors that can turn it into the dangerous "Mr....

info_outline EP248 Cloud IR Tabletop Wins: How to Stop Playing Security Theater and Start Practicing show art EP248 Cloud IR Tabletop Wins: How to Stop Playing Security Theater and Start Practicing

Cloud Security Podcast by Google

Guest: , Director for Incident Response at Google Cloud Topics: What is this tabletop thing, please tell us about running a good security incident tabletop?  Why are tabletops for incident response preparedness so amazingly effective yet rarely done well? This is cheap/easy/useful so why do so many fail to do it? Why are tabletops seen as kind of like elite pursuit? What’s your favorite Cloud-centric scenario for tabletop exercises? Ransomware? But there is little ransomware in the cloud, no? What are other good cloud tabletop scenarios? Resources:  

info_outline EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion show art EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion

Cloud Security Podcast by Google

Guest: , Board Risk Advisor, Non-Executive Director & Author, former CISO Topics: Drawing from the book's focus on continuous improvement, how have you seen the necessary skills, knowledge, experience, and behaviors for a CISO evolve, especially when guiding an organization through a transformation? Could you share lessons learned about leadership and organizational resilience during such a critical period, and how does that experience reshape your approach to future transformations? Many organizations are undergoing transformations, often heavily involving cloud technologies. From...

info_outline EP246 From Scanners to AI: 25 Years of Vulnerability Management with Qualys CEO Sumedh Thakar show art EP246 From Scanners to AI: 25 Years of Vulnerability Management with Qualys CEO Sumedh Thakar

Cloud Security Podcast by Google

Guest: , President and CEO, Topics: How did vulnerability management (VM) change since Qualys was founded in 1999? What is different about VM today? Can we actually remediate vulnerabilities automatically at scale? Why did this work for you even though many expected it would not? Where does cloud fit into modern vulnerability management? How does AI help vulnerability management today? What is real? What is this Risk Operations Center (ROC) concept and how it helps in vulnerability management? Resources: blog   

info_outline EP245 From Consumer Chatbots to Enterprise Guardrails: Securing Real AI Adoption show art EP245 From Consumer Chatbots to Enterprise Guardrails: Securing Real AI Adoption

Cloud Security Podcast by Google

Guest: , CEO and Co-Founder, Topics: In what ways is the current wave of enterprise AI adoption different from previous technology shifts? If we say “but it is different this time”, then why? What is your take on “consumer grade AI for business” vs enterprise AI? A lot of this sounds a bit like the CASB era circa 2014. How is this different with AI?  The concept of "routing prompts for risk and cost management" is intriguing. Can you elaborate on the architecture and specific AI engines Witness AI uses to achieve this, especially for large global corporations?  What are...

info_outline EP244 The Future of SOAPA: Jon Oltsik on Platform Consolidation vs. Best-of-Breed in the Age of Agentic AI show art EP244 The Future of SOAPA: Jon Oltsik on Platform Consolidation vs. Best-of-Breed in the Age of Agentic AI

Cloud Security Podcast by Google

Guest: , security researcher, ex-ESG analyst Topics: You invented the concept of – Security Operations & Analytics Platform Architecture. As we look towards SOAPA 2025, how do you see the ongoing debate between consolidating security around a single platform versus a more disaggregated, best-of-breed approach playing out?  What are the key drivers for either strategy in today's complex environments? How can we have both “” and platformization going at the same time? With all the buzz around Generative AI and Agentic AI, how do you envision these technologies changing the...

info_outline EP243 Email Security in the AI Age: An Epic 2025 Arms Race Begins show art EP243 Email Security in the AI Age: An Epic 2025 Arms Race Begins

Cloud Security Podcast by Google

Guest: , CEO, , CTO, Topics: What is the state of email security in 2025? Why start an email security company now? Is it true that there are new and accelerating AI threats to email? It sounds cliche, but do you really have to use good AI to fight bad AI? What did you learn from your time fighting abuse at scale at Google that is helping you now How do you see the future of email security and what role will AI play? Resources:    

info_outline
 
More Episodes

Guest:

Topics:

  • On the 3rd anniversary of Curated Detections, you've grown from 70 rules to over 4700. Can you walk us through that journey? What were some of the key inflection points and what have been the biggest lessons learned in scaling a detection portfolio so massively?
  • Historically the SecOps Curated Detection content was opaque, which led to, understandably, a bit of customer friction. We’ve recently made nearly all of that content transparent and editable by users. What were the challenges in that transition?
  • You make a distinction between "Detection-as-Code" and a more mature "Software Engineering" paradigm. What gets better for a security team when they move beyond just version control and a CI/CD pipeline and start incorporating things like unit testing, readability reviews, and performance testing for their detections?
  • The idea of a "Goldilocks Zone" for detections is intriguing – not too many, not too few. How do you find that balance, and what are the metrics that matter when measuring the effectiveness of a detection program? You mentioned customer feedback is important, but a confusion matrix isn't possible, why is that?
  • You talk about enabling customers to use your "building blocks" to create their own detections. Can you give us a practical example of how a customer might use a building block for something like detecting VPN and Tor traffic to augment their security?
  • You have started using LLMs for reviewing the explainability of human-generated metadata. Can you expand on that? What have you found are the ripe areas for AI in detection engineering, and can you share any anecdotes of where AI has succeeded and where it has failed?


   Resources