Security Weekly Podcast Network (Audio)

Geinbot, SolarWinds, Brave, UNK_Deaddrop, durabletask, Insta, Aaran Leyland, and More on the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-588

Most AppSec teams are working through more findings than their teams can validate. SAST surfaces thousands of potential issues. DAST generates alert volume that outpaces triage capacity. Somewhere in that output are the vulnerabilities that matter, the ones that are actually exploitable in production. This conversation explores why automated testing often stops short of the hardest part of the job: proving what is real. We dig into how business logic flaws and authorization vulnerabilities get missed by tools that scan without reasoning, what exploit validation looks like at runtime, and how security engineers are shifting toward findings that developers will actually act on.
The segment is sponsored by XBOW. Visit https://securityweekly.com/xbow to see how autonomous AI pentesting delivers expert-quality findings in hours with real exploit validation your team can actually act on.
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-386

Interview with Filip Stojkovski on the State of AI in SecOps
Filip joins us to talk through the 2+ year rollercoaster that Security Operations tooling has been on since AI entered the chat. We discuss the AI SecOps market, which Filip closely tracks through his SecOps Unpacked project. We also discuss how most of the market has traditionally been focused on the "middle" of the process, which is effectively alert management. Where the conversation really gets interesting is shifting left to discuss building better quality detections.
Segment Resources:
Be sure to check out SecOps Unpacked - it has more than just vendor information: there are articles, frameworks, podcast episodes, research, and articles/thought leadership
Topic: The Unintended Consequences of Vulnmaxxing
We discuss my latest blog post where I share a theory that perhaps Project Glasswing is a clever exclusive freemium tier, where Anthropic is hoping to ensnare the world's largest producers of software into using its most expensive model to fix their code for the foreseeable future, creating a much needed new revenue stream for the AI giant with a Trillion dollar valuation.
There are some potential unintended consequences that come along with an expensive vulnerability discovery/remediation process that threatens to raise the security poverty line and leave less wealthy companies behind.
The Weekly Enterprise News
Finally, in the enterprise security news,
If you were starting a cybersecurity company today, which category would you pick?
layoffs
funding
the White House AI executive order
OpenAI’s frontier governance framework
Anthropic’s Zero Trust for AI agents guide
IBM’s vulnmaxxing efforts
RICO as a service for job seekers
Instagram had possibly the most embarrassing hack ever
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-462

Local AI, Salesforce, Fluttershell, Aspose, http/2 bomb, Passwords, Cisco, Used Tech, Josh Marpet, and More on this episode of the Security Weekly News
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-587

This week in the security news:
Security Researchers Are Threat Actors according to Microsoft
Hands-free malicious firmware
If you've ever typed "ls" in Windows, this is for you
Cisco makes more patches, wants you to pay
Ambiguous Secure Boot bypass
Threat actors love network edge devices, and I have the chat logs and leaks to prove it
The downside of chip sanctions
Your VoIP phone is hacked
Vulnerability disclosure and incentives
Claude reccovers Bitcoin wallet
an Instagram "Exploit"
Turn the plane around
The worms will continue
PAN-OS global protect vulnerability
The 1-Click Github token stealer
Data-nuking prompt injection
Turning Buses into spies
SymJack
NIST NVD mistakes, and how CNAs need to up their game
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-929