Security Weekly Podcast Network (Audio)

America has lived through technological and economic upheaval before. Farm workers moved to factories. Factory workers moved into services. New industries replaced old ones. Productivity rose. Living standards improved. But are we ready for the greatest disruption in American history?
Ben Gilliland, author of the upcoming book Breaking the Compact, joins Business Security Weekly to discuss why business leaders need to be prepared for the upcoming AI disruption. The impact of AI, which has not fully materialized, goes far beyond security and job displacement. It will impact our economy, our privacy, and our way of life. The closest recent warning is the "China shock," the period of rapidly increasing import competition that followed China's integration into the global trading system. AI will dwarf that. Ben will discuss the human advantage and how we can prepare now.
In the leadership and communications segment, Cybersecurity’s Economics Are Broken. Automation Alone Won’t Fix It, The business case for burning down security debt: A practical approach for CISOs, The last human relationship in cybersecurity, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-457

Nudification, Yeats, LegacyHive, ACR Stealer, Hugging Face, Route 53, 764, Wordpress, Kieran Human from Threatlocker, and More.
Segment Resources:
Malicious Edge extension abuses Native Messaging as bridge to malware: https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware/
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-600

Appsec often frames usability and security as at odds with each other. Apple's software has famously emphasized the importance of usability while also creating a solid security foundation. Patrick Wardle talks about how he's seen malware shift from Windows to macOS, how Apple's aggressive stance on deprecation benefits security, and the areas of the OS where he still sees plenty of opportunity for more security research. We discuss how developers make defensible design choices, why privacy needs security, and some security principles that any app developer should keep in mind regardless of their programming language or operating system.
Resources:
https://objective-see.org/blog/blog_0x86.html
https://objective-see.org/products/lulu.html
https://objectivebythesea.org/v9/index.html
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-392

Interview with Keith Hollender, CEO and Co-Founder of Arcova
Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem
As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.
In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.
Keith also shares how Arcova’s practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova’s continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.
Segment Resources:
https://arcova.com/sectors/
https://arcova.com/category/blog/
For more information about Arcova and how they can help your enterprise shape what's next, please visit:
https://securityweekly.com/arcova
Topic: CMMC Pause creating chaos among federal contractors
This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide. The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.
I think Howard Holton nails it here when he says:
"100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."
PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.
What this means:
Phase II is paused
Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)
NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required
60-day review aims to reform CMMC
DoW opened an RFI for industry perspectives on what they should do
CMMC characterized as a "compliance burden" and "red tape"
False Claims Act and DOJ's cyber-fraud enforcement are still on the table
More resources:
CIO Davies' post on Twitter
Administrator of the Small Business Administration, Kelly Loeffler's post
A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)
Weekly Enterprise News
Finally, in the enterprise security news,
will AI eliminate more cybersecurity jobs than it creates?
Linus’s law, amended
the biggest patch Tuesday ever
AI context bombs
AI workflows are a security disaster
people using AI in areas they don’t understand
ransomware crews are hitting legal firms hard
lessons learned from CISA’s recent github leak
demystify your USB cables!
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-468

M. Thénardier, LastPass, GitHub, EBS, Spirals, Pegasus, Shaft, Josh Marpet, and More on this episode of the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-599