Cybersecurity Where You Are (video)

In episode 211 of Cybersecurity Where You Are, Sean Atkinson speaks with Joshua Palsgraf, Sr. Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS, about the scariest malware of 2026. From an infostealer that hides its command infrastructure on the Ethereum blockchain to artificial intelligence (AI) agents running chunks of intrusions, they break down what makes malware “terrifying,” why takedowns are getting harder, and what defenders can still do about it.
Here are some highlights from our episode:
02:08. The three factors that make malware strains "terrifying"
03:39. How the expansion of "as a Service" offerings complicates malware investigations
05:10. How member reporting helps to link the stages of an investigation
06:31. A move to more automation: Threat actors' use of AI to run chunks of the kill chain
07:38. Abuse of trusted applications and services over the development of customized tools
10:04. The single scariest malware strain of 2026 and the techniques it uses to earn that title
14:45. How an emerging technique calls traditional malware takedown playbooks into question
16:21. The challenging, never-ending, and even fun effort of keeping up with new malware
22:19. The cost of running a cybercrime operation: “A couple hundred dollars a month”
23:38. Real-world examples of threat actors giving more operational control to AI agents
26:31. Why essential cyber hygiene still holds sway in defending against the scariest malware
29:05. Recommendations for defending against clever malware evasion techniques
30:33. The Thing and Facehugger: How these malware names capture today's threat landscape
32:48. Looking ahead to 2027: AI as an assistant and infrastructure beyond seizure
Resources
Multi-State Information Sharing and Analysis Center®
CIS Cyber Threat Intelligence Team
Episode 159: The Scariest Malware of 2025
SLTT C2 Traffic Tied to Remus Malware Distribution Operation
ClickFix: An Adaptive Social Engineering Technique
Episode 124: The Many Layers of a Malware Takedown Operation
Disrupting the first reported AI-orchestrated cyber espionage campaign
Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia
Taiwan says it was targeted last month in AI-driven hacking campaign
Cloudflare deploys protections against php2shell vulnerability
Real-Time Indicator Feeds
Living off the Land: Threats Looming From Within
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 210 of Cybersecurity Where You Are, Sean Atkinson speaks with Patrick Cooper, Security Operations Center (SOC) Analyst II at the Center for Internet Security® (CIS®), and Nathaniel Ludke, SOC Analyst II at CIS. Together, they take listeners inside the 24x7x365 CIS SOC, from alert prioritization and severity-based escalation to member reporting and the use of artificial intelligence (AI) for open-source intelligence, packet analysis, and SQL querying. They explain why AI is the tool and the human is the loop for U.S. State, Local, Tribal, and Territorial (SLTT) government members of the Multi-State Information Sharing and Analysis Center® (MS-ISAC®).
Here are some highlights from our episode:
01:20. What a typical shift for a CIS SOC analyst looks like
03:29. Challenge: Supporting members while minimizing overwhelm and stress
06:25. Common indicators of compromise (IOCs) as impetus to take a deeper look
07:01. Prioritization: First in first out with a few noteworthy exceptions
07:41. How severity of an alert affects the CIS SOC's communication with members
08:51. The typical path of escalation for alerts
09:36. Hot IP entries and agency notes inform false-positive judgments
10:42. Designating the severity of false positives
14:09. Automated (monthly), manual, historical, and other types of reports from the CIS SOC
17:01. No news is good news? Why MS-ISAC members both welcome and worry about silence from the CIS SOC
18:01. The CIS SOC's use of AI for open-source intelligence and information gathering
20:07. Human is the loop: How AI supports packet analysis, SQL querying, and more
22:20. AI enablement, not replacement: Keeping security operations human
23:42. How AI can function as an additional security threat
25:23. Hallucination risk and the SOC analyst “spidey sense”
26:25. Relationships with MS-ISAC members: The "lost art" of knowing when something's off
Resources
The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
CIS Cyber Incident Response Team
CIS Cyber Threat Intelligence Team
Cybersecurity Services
You Have a Cybersecurity Incident. Now What?
Episode 190: Separating Mythos AI Fact from Fiction
CIS Controls v8.1 Incident Response Policy Template
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 209 of Cybersecurity Where You Are, Sean Atkinson argues that most organizations prepare for operational failure like they're bracing for a hurricane while most adversaries are playing chess. Drawing on security chaos engineering and game theory, he walks through a structured approach that blends threat modeling, internal red teaming, and constructive disagreement to empirically test and strengthen a defensive posture.
Here are some highlights from our episode:
00:33. The RSA Conference 2025 presentation behind this episode
00:48. How artificial intelligence (AI) is only accelerating adversaries' evolution
01:23. Hurricanes and chess: Analogies for different types of disaster preparedness
04:03. Overview of chaos engineering and game theory
05:01. Understanding threat vectors in our environment and how MITRE ATT&CK can help
05:50. Why adversaries "need a vote" when planning for failure
07:03. Red teaming and the need for penetration testing as part of an internal process
07:50. Going beyond technology to understand business objectives and strategy
08:51. Continuity as a consideration for continually adapting and updating controls
10:12. Transition from three separate threat silos to multidimensional threats
10:45. Game theory: It's not just a tabletop exercise (TTX)
12:15. Goalkeeper: An analogy for addressing "predictability of weakness"
13:52. Testing where our weaknesses are: An important element of chaos engineering
14:58. Accounting for biases and finite resources when evaluating strengths and weaknesses
17:56. Vulnerability identification: An example of how a strength can become a weakness
22:25. The need to resist getting too sophisticated with internal red teaming too quickly
24:23. Rigor for pushing back against tired adages like "it's never happened to us before"
26:22. An implementation strategy focused on communication
27:00. Dr. Tyler Moore's Return on Security Investment and the consequences of doing nothing
28:03. Debate and commit: A leadership principle for getting the most out of disagreement
30:42. Start small, provide notice to those affected, and consider a "surprise audit"
32:12. Minimize the blast radius, build hypotheses, balance bias, and other best practices
37:38. Parting thoughts of how to break down this approach
Resources
Episode 208: Secure Harness Engineering for Agentic AI
Game Theory Informed Security Chaos
Book - Security Chaos Engineering: Sustaining Resilience in Software and Systems
CIS Community Defense Model v3.0: Turning Threat Intelligence Into Action
CIS Red Team Services and Exploit Demo
Penetration Testing
CIS Critical Security Control 18: Penetration Testing
MS-ISAC Guide to DDoS Attacks
Episode 121: The Economics of Cybersecurity Decision-Making
Episode 166: Foundations of Actuarial Science in Cyber Risk
CIS Leadership Principles
Netflix TechBlog
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 208 of Cybersecurity Where You Are, Sean Atkinson breaks down secure harness engineering for agentic artificial intelligence (AI). Noting the risks posed by AI agents acting without oversight, he highlights "episodes" as auditable elements that help to provide feedback, and he walks through 15 controls spread across five stages as a way to engineer an AI harness with security in mind. He also differentiates secure harness engineering from prompt engineering, guardrails, frameworks, logs, and universal wrappers for AI agents.
Here are some highlights from our episode:
01:23. The need for a control system in light of agent escape incidents
02:19. Analogy of a financial analyst to understand why separation of duties is important
02:57. Revolution and then evolution: How AI models have changed exponentially since 2022
04:54. Where secure harness engineering has a capability
05:42. Making decisions traceable: The need for an evidence chain to build controls effectively
07:15. Smartphones: A parallel for understanding the value of each new AI model
11:20. Engineering controls, not standard policies for all models
12:22. Secure harness engineering vs. prompt engineering
12:51. Models' evolving role: How it invites new security questions to be posed
15:16. AI agents without oversight: The insider persona with which defenders need to contend
16:02. The need for determinism and an effective diagram to build for it
18:22. Definition of secure harness engineering
19:36. Episodes and the importance of log assessment in mediating model capability
20:42. Reality verification: A feedback loop that gets into the concept of forensic assessment
21:27. Questions to ask as you get into an AI agent's evidence chain
22:56. Moving through intent, authority, reasoning, synthesis, decision, and enforcement
25:38. Side effects: What they are and how they actualize risk
27:16. Verification and audit: How they empower you to look at control opportunities
28:49. Five stages and 15 controls for secure harness engineering
29:47. What secure harness engineering is and is not
32:11. Three questions to help you get started
32:52. An important question for the future
Resources
Artificial Intelligence (AI) Agents Companion Guide
The Secure Harness: A Governance Architecture for Agentic AI
When Agent Capability Outruns Control: Lessons from the July 2026 OpenAI and Hugging Face Incident
Episode 202: Delineating AI Security and Cybersecurity
Harness Engineering & Agent Orchestration
OWASP Top 10 for Large Language Model Applications
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 207 of Cybersecurity Where You Are, Sean Atkinson makes the case for treating artificial intelligence (AI) not as software but as an ongoing trust relationship. He highlights the value of integrating best practices from regulations like the EU AI Act, walks through the three stages of an AI governance lifecycle, and explains how AI risk management fits into organizational governance, change management, and other business processes.
Here are some highlights from our episode:
01:16. The trust component of AI governance
02:02. A need to align to regulatory best practices and bring them into AI risk management
03:47. Advice: Contextualize, don't generalize, your risks associated with AI use
04:40. Common questions that lead to AI governance as a requirement
06:59. Grounding an agile AI governance process on foundational principles
07:46. How the "fortress" approach overlooks the relationship element of AI security
09:51. A direct invitation: Listener feedback on AI governance thinking
11:44. Evaluating trust and relationship in machine learning and generative AI
14:04. The role of human oversight in realizing AI as a method that gets to a solution quicker
14:53. AI governance boards: A potential solution to elevating AI literacy internally
16:00. AI governance lifecycle: Three phases from current business processes to value generation
18:55. Overview of the future of AI security
23:16. The need for foundational security controls and AI-specific controls
25:00. AI governance assessment: Why it needs to happen across the organization
26:28. How AI governance ties into organizational governance
29:49. Ethics and responsible AI practice
29:57. Change management considerations with AI deployment
30:35. A concluding call to action to get stronger together
Resources
CIS Critical Security Controls®
Episode 198: AI Privacy from a Risk-Based Perspective
Episode 122: DeepSeek AI Security and Utility Considerations
Episode 120: How Contextual Awareness Drives AI Governance
AI Playbooks for SLTT Cybersecurity Leaders
CIS Controls v8.1.2 AI Security Guidance Workbook
Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
Mapping and Compliance with the CIS Controls
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.