Enterprise Security Weekly (Audio)

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?
The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.
Segment Resources:
Modernize your TPRM program with adaptive risk management for SaaS and AI
Nudge Security Unveils Adaptive Risk Management press release
The security work nobody wants to do is the risk nobody's watching
OAuth grants pile up faster than you can review them BleepingComputer
This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!
Topic Segment - Coordinated Disclosure
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.
Coordinated disclosure in 2026 is:
75% - Too slow for AI world
13% - Vendor Credit Race
13% - This is fine ????????️????
0% - Working as designed
0% - Other (tell me)
Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week's vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.
Enterprise Security News
Finally, in the enterprise security news,
A little funding
making software liable for cyber breaches
we have a new biggest bank heist ever!
more freezers defrosted
a company builds malware into their product on purpose
AI pentesting frameworks are lowering the script kiddy bar
AI hosting company hacks their competitor
there's a new SSH bug that could be very, very bad
even MSPaint gets a vulnerability
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-484

Interview with Casey Ellis
Our focus for this interview with Casey Ellis are the massive changes in:
Vulnerability Discovery
Vulnerability Disclosure
Exploitation and Remediation
The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?
Vibe Check
This week's vibe check explores the question, which security project always takes twice as long as planned?
55% - Enforcing data classification
18% - SOAR automation buildout
9% - Rolling out SSO
9% - Moving to passwordless auth
9% - AI agent discovery
0% - Other
News Segment
Finally, in the enterprise security news,
funding and M&A
PHP2Shell update
floods of bugs
silent train
breaches
the script kiddy bar has been lowered
the basics continue to be important
an AI lab pulls a PR stunt
an old squirrel story was a scam!
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-483

Interview with Barrett Lyon
Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.
This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.
Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!
Segment Resources:
The main website: https://doxx.net
Doxx.net Discord channel: https://discord.gg/595hAxHH4
Barrett's previous work mapping the internet for the Opte project: https://www.opte.org
Vibe Check
Which security acronym/phrases deserves to be retired?
38% - XDR
25% - Zero Trust
25% - UEBA
6% - CNAPP
6% - Non-Human
0% - Other (leave a comment)
Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants.
I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"?
I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????
Top Comments
"Other - The "AI TRiSM" term can go kick the biggest of rocks"
"Other - Shift left"
"My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over"
Enterprise Weekly News
Finally, in the enterprise security news,
We check out funding
There are a lot of acquisitions
And a round of layoffs
A tech startup goes out of business after two breaches
Private keys should be larger than "4"
PHP2Shell disrupts everyone's plans this week
Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-482

Interview with Michael Jenkins from ThreatLocker
Securing AI on the Endpoint - Zero Trust or Bust
Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given.
We explore how execution control and ringfencing can add some sanity and security to the process.
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Topic Segment: Anthropic Dreams of AI Replicants
Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research.
It is too loose to be an academic paper, but maybe should have been?
Is really a pressing AI risk we should be worried about right now?
Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices?
Weekly Enterprise News
Finally, in the enterprise security news,
we discuss the vibes
certified organic books
don't mess with criminals
the history of ShinyHunters
building strategies on the wrong lessons
crypto wallet supply chain drama
Hot refrigerators
Reddit is great for breach tracking
Microsoft patch Tuesday is on track to hit 12,000 patches by next April
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-481

Interview with Hadar Krasner, Co-Founder and CPO of Bold Security
This week's interview with Hadar is a fascinating dive into the history of data security and why they chose to tackle endpoint-focused data security. We discuss why securing data is traditionally such a challenging task, making it clear why Bold is such a fitting name for the company. After 30 minutes, we barely scratched the surface and are hoping we can have them back soon for another interview!
Segment Resources:
https://www.bold.security/blog/endpoint-data-ai-human-risk-convergence
https://www.bold.security/blog/what-is-real-time-endpoint-data-protection-bold-makes-it-a-reality
This segment is sponsored by Bold Security. Visit https://securityweekly.com/bold-security to learn more about them!
Topic - Don't Let AI Ruin Your Talk
In this week's topic segment, we discuss the emerging epidemic of low-effort AI-generated slides. AI can definitely make slide creation less painful, but you still need to put some effort in to make a good looking deck that makes sense. If you don't, your audience WILL notice.
Enterprise Security News
Finally, in the enterprise security news,
we discuss the Sawtooth problem
cybersecurity is center stage in AI
not everyone is a big fan of passkeys
Ross Haleliuk is back with some interesting essays
insider threats: sometimes the cybercriminal was inside your organization all along
AI can now read your mind
and as always, we'll kick off with the vibes
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-480