Enterprise Security Weekly (Audio)

Interview with Barrett Lyon
Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.
This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.
Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!
Segment Resources:
The main website: https://doxx.net
Doxx.net Discord channel: https://discord.gg/595hAxHH4
Barrett's previous work mapping the internet for the Opte project: https://www.opte.org
Vibe Check
Which security acronym/phrases deserves to be retired?
38% - XDR
25% - Zero Trust
25% - UEBA
6% - CNAPP
6% - Non-Human
0% - Other (leave a comment)
Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants.
I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"?
I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????
Top Comments
"Other - The "AI TRiSM" term can go kick the biggest of rocks"
"Other - Shift left"
"My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over"
Enterprise Weekly News
Finally, in the enterprise security news,
We check out funding
There are a lot of acquisitions
And a round of layoffs
A tech startup goes out of business after two breaches
Private keys should be larger than "4"
PHP2Shell disrupts everyone's plans this week
Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-482

Interview with Michael Jenkins from ThreatLocker
Securing AI on the Endpoint - Zero Trust or Bust
Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given.
We explore how execution control and ringfencing can add some sanity and security to the process.
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Topic Segment: Anthropic Dreams of AI Replicants
Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research.
It is too loose to be an academic paper, but maybe should have been?
Is really a pressing AI risk we should be worried about right now?
Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices?
Weekly Enterprise News
Finally, in the enterprise security news,
we discuss the vibes
certified organic books
don't mess with criminals
the history of ShinyHunters
building strategies on the wrong lessons
crypto wallet supply chain drama
Hot refrigerators
Reddit is great for breach tracking
Microsoft patch Tuesday is on track to hit 12,000 patches by next April
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-481

Interview with Hadar Krasner, Co-Founder and CPO of Bold Security
This week's interview with Hadar is a fascinating dive into the history of data security and why they chose to tackle endpoint-focused data security. We discuss why securing data is traditionally such a challenging task, making it clear why Bold is such a fitting name for the company. After 30 minutes, we barely scratched the surface and are hoping we can have them back soon for another interview!
Segment Resources:
https://www.bold.security/blog/endpoint-data-ai-human-risk-convergence
https://www.bold.security/blog/what-is-real-time-endpoint-data-protection-bold-makes-it-a-reality
This segment is sponsored by Bold Security. Visit https://securityweekly.com/bold-security to learn more about them!
Topic - Don't Let AI Ruin Your Talk
In this week's topic segment, we discuss the emerging epidemic of low-effort AI-generated slides. AI can definitely make slide creation less painful, but you still need to put some effort in to make a good looking deck that makes sense. If you don't, your audience WILL notice.
Enterprise Security News
Finally, in the enterprise security news,
we discuss the Sawtooth problem
cybersecurity is center stage in AI
not everyone is a big fan of passkeys
Ross Haleliuk is back with some interesting essays
insider threats: sometimes the cybercriminal was inside your organization all along
AI can now read your mind
and as always, we'll kick off with the vibes
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-480

Interview with Aqsa Taylor
Exaforce's Chief Security Evangelist, Aqsa, joins us to discuss the current state of the AI SOC and why it covers so much more than it did over 2 years ago, when our podcast first started covering this market. Exaforce also recently released AI Security and its ExaGo mobile app - we're very excited about the possibility of analyzing incidents at the grocery store!
This segment is sponsored by Exaforce. Visit https://securityweekly.com/exaforce to learn more about them!
Topic Segment - Regulating AI
The AI industry's sandbox escapes have had a big impact on everyone and unsurprisingly, there's a bill proposing to ban some AI products and pause the development of others.
It seems that, increasingly, as pro-AI and anti-AI groups become more polarized and divided, you could start an entire podcast that does nothing but fact-check both sides. We're an emotional species and it seems the more heated debate gets, the more folks on both sides are willing to straight-up fabricate things to help argue their points.
Today's focus is this YouTube video: https://www.youtube.com/watch?v=WXsTCJl7sU4
It's the most on-the-nose type of propaganda - straight up claiming the government is going to break into your house and take your GPUs and LLMs. Could the bill proposed by Bernie Sanders and Greg Casar be characterized as extreme? Sure, but it's nowhere near as extreme as the title of the video, "They're Banning AI Servers at Home" suggests.
The hardest things to swallow about the video:
it characterizes Bernie Sanders as "the government", as if he's representative of most of the US government rather than an outlier that has little to no chance to get a bill like this passed
it never mentions the fact that the bill establishes a model cutoff, measured in training effort (10^25 flops, which doesn't include the open weight models you're using at home, unless you have an 8x cluster of DGX Sparks - $40k+ worth of AI compute)
Enterprise News
Finally, in the enterprise security news,
we check the vibes
massive, connected funding
NVIDIA OpenShell
cars are still hackable
a ransomware arrest turned into a murder investigation
AI welfare
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-479

Interview with Christopher Crawley - The Value of SecOps
This week, we talk to Chris Crawley about his new book, The Value of Cybersecurity Operations. Chris has been training teams on security operations for years, but found that students often struggled to justify the importance of secops training and even the need for secops in general. This book was written to more broadly arm practitioners with the information they need to communicate why security operations are necessary to leadership.
The book is available in several forms: eBook, hardcover, softcover, and an audiobook read by Chris himself!
You can pick all versions up here: https://shop.montance.com/collections/all and Security Weekly listeners get 50% off with code sw-50!
The Evolving Exploitation of Trust with Josh Davies, Security Strategist at Fortra
Fortra Intelligence and Research Experts (FIRE) is Fortra's emergent threat intelligence identity, created to unify research teams across multiple security disciplines and share intelligence with the wider threat intelligence community. FIRE co-ordinator and security strategist Josh Davies joins us to share insights from original FIRE research like Calphishing, Mirage2FA, RatPressto phishkit and heavily obfuscated campaigns that evade defences. While also digging into trends from big data analysis within phishing, fraud, social engineering and credential theft.
Segment Resources:
Art of Security Podcast
Fortra Research
This segment is sponsored by Fortra. Access FIRE Research here: https://securityweekly.com/fortrabh
Why Agentic AI Security Requires a Defense-In-Depth Strategy with Kaushik Shanadi, CTO and Co-Founder of Helmet Security
Many organizations are approaching agentic AI security by stitching together individual controls, assuming that identity, network, endpoint, or application security alone is enough. Each address only one part of the problem. As AI agents become more autonomous, move across systems, and take actions on behalf of users, organizations need a true defense-in-depth strategy that combines every layer of the security stack. Kaushik can discuss how each security layer provides a different piece of the puzzle and how individually, none of the controls are sufficient. But together, they create the layered governance needed to securely deploy agentic AI.
For more information about Helmet Security, please visit https://securityweekly.com/helmetbh
Above Security on Why Legacy Tools Don't Cut It for Modern Insider Risk with Tricia Howard, Head of Marketing at Above Security
As organizations rush to adopt agentic AI, agents are often given broad access to critical business systems and sensitive data. Legacy insider risk management tools weren't built for this, and organizations have spent years on insider risk posturing and investments that leave security teams inundated with false positives while the real risk slips through undetected. In this segment, Tricia Howard draws on her decade in cybersecurity, including years watching user and entity behavior analytics (UEBA) overpromise and underdeliver, to unpack why understanding human – and now AI – intent is the missing piece.
Segment Resources:
Blog Post: Redefining Insider Threat
Blog Post: What I wanted UEBA to be, Years Ago
To learn more about Above Security and insider risk management in the era of agentic AI, visit: https://securityweekly.com/abovebh
The Identity Crisis Your Security Team Didn't See Coming: Governing AI Agents with Darren Guccione, CEO and Co-Founder of Keeper Security
AI agents outnumber human identities in enterprise environments, and traditional security software was never built to govern them. 89% of cybersecurity decision-makers recently surveyed by Keeper Security said that AI adoption has made identity management harder.
In this Black Hat USA conversation with Cyber Risk TV, Darren Guccione, CEO and Co-Founder of Keeper Security, shares a practical framework for extending identity governance to non-human identities and AI agents before the access gap becomes a breach.
Segment Resources:
Privileged Access Management
Identity Security at Machine Speed
To learn more about Keeper Security, visit: https://securityweekly.com/keeperbh
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-478