Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!
Your RSA talk highlights lessons learned from two years of AI red teaming at Google. Could you share one or two of the most surprising or counterintuitive findings you encountered during this process?
What are some of the key differences or unique challenges you've observed when testing AI-powered applications compared to traditional software systems?
Can you provide an example of a specific TTP that has proven effective against AI systems and discuss the implications for security teams looking to detect it?
What practical advice would you give to organizations that are starting to incorporate AI red teaming into their security development lifecycle?
What are some initial steps or resources you would recommend they explore to deepen their understanding of this evolving field?
Something about vuln exploitation vs credential abuse in today’s breaches–what’s driving the shifts we’re seeing? DBIR
Are we at peak ransomware? Will ransomware be here in 20 years? Will we be here in 20 years talking about it?
How is AI changing the breach report, other than putting in hilarious footnotes about how the report is for humans to read and and is written by actual humans?
SIEM is hard, and many vendors have discovered this over the years. You need to get storage, security and integration complexity just right. You also need to be better than incumbents. How would you approach this now?
Decoupled SIEM vs SIEM/EDR/XDR combo. These point in the opposite directions, which side do you think will win?
In a world where data volumes are exploding, especially in cloud environments, you're building a SIEM with ClickHouse as its backend, focusing on both parsed and raw logs. What's the core advantage of this approach, and how does it address the limitations of traditional SIEMs in handling scale?
Cribl, Bindplane and “security pipeline vendors” are all the rage. Won’t it be logical to just include this into a modern SIEM?
You're envisioning a 'Pipeline QL' that compiles to SQL, enabling 'detection in SQL.' This sounds like a significant shift, and perhaps not to the better? (Anton is horrified, for once) How does this approach affect detection engineering?
With Sigma HQ support out-of-the-box, and the ability to convert SPL to Sigma, you're clearly aiming for interoperability. How crucial is this approach in your vision, and how do you see it benefiting the security community?
What is SIEM in 2025 and beyond? What’s the endgame for security telemetry data? Is this truly SIEM 3.0, 4.0 or whatever-oh?
Why is your AI-powered MDR special? Why start an MDR from scratch using AI?
So why should users bet on an “AI-native” MDR instead of an MDR that has already got its act together and is now applying AI to an existing set of practices?
What’s the current breakdown in labor between your human SOC analysts vs your AI SOC agents? How do you expect this to evolve and how will that change your unit economics?
What tasks are humans uniquely good at today’s SOC? How do you expect that to change in the next 5 years?
We hear concerns about SOC AI missing things –but we know humans miss things all the time too. So how do you manage buyer concerns about the AI agents missing things?
Let’s talk about how you’re helping customers measure your efficacy overall. What metrics should organizations prioritize when evaluating MDR?
Can you describe the key components of an AI software supply chain, and how do they compare to those in a traditional software supply chain?
I hope folks listening have heard past episodes where we talked about poisoning training data. What are the other interesting and unexpected security challenges and threats associated with the AI software supply chain?
We like to say that history might not repeat itself but it does rhyme – what are the rhyming patterns in security practices people need to be aware of when it comes to securing their AI supply chains?
We’ve talked a lot about technology and process–what are the organizational pitfalls to avoid when developing AI software? What organizational "smells" are associated with irresponsible AI development?
We are all hearing about agentic security – so can we just ask the AI to secure itself?
Top 3 things to do to secure AI software supply chain for a typical org?
Can you explain the concept of "MLSecOps" as an analogy with DevSecOps, with 'Dev' replaced by 'ML'? This has nothing to do with SecOps, right?
What are the most critical steps a CISO should prioritize when implementing MLSecOps within their organization? What gets better when you do it?
How do we adapt traditional security testing, like vulnerability scanning, SAST, and DAST, to effectively assess the security of machine learning models? Can we?
In the context of AI supply chain security, what is the essential role of third-party assessments, particularly regarding data provenance?
How can organizations balance the need for security logging in AI systems with the imperative to protect privacy and sensitive data? Do we need to decouple security from safety or privacy?
What are the primary security risks associated with overprivileged AI agents, and how can organizations mitigate these risks?
Top differences between LLM/chatbot AI security vs AI agent security?
At RSA 2025, did we see solid, measurably better outcomes from AI use in security, or mostly just "sizzle" and good ideas with potential?
Are the promises of an "AI SOC" repeating the mistakes seen with SOAR in previous years regarding fully automated security operations? Does "AI SOC" work according to RSA floor?
How realistic is the vision expressed by some [yes, really!] that AI progress could lead to technical teams, including IT and security, shrinking dramatically or even to zero in a few years?
Why do companies continue to rely on decades-old or “non-leading” security technologies, and what role does the concept of a "organizational change budget" play in this inertia?
Is being "AI Native" fundamentally better for security technologies compared to adding AI capabilities to existing platforms, or is the jury still out? Got "an AI-native SIEM"? Be ready to explain how is yours better!
What is the hardest thing about turning distinct incident reports into a fun to read and useful report like M-Trends?
How much are the lessons and recommendations skewed by the fact that they are all “post-IR” stories?
Are “IR-derived” security lessons the best way to improve security? Isn’t this a bit like learning how to build safely from fires vs learning safety engineering?
The report implies that F500 companies suffer from certain security issues despite their resources, does this automatically mean that smaller companies suffer from the same but more?
"Dwell time" metrics sound obvious, but is there magic behind how this is done? Sometimes “dwell tie going down” is not automatically the defender’s win, right?
What is the expected minimum dwell time? If “it depends”, then what does it depend on?
Impactful outliers vs general trends (“by the numbers”), what teaches us more about security?
Why do we seem to repeat the mistakes so much in security?
Do we think it is useful to give the same advice repeatedly if the data implies that it is correct advice but people clearly do not do it?
So, another Next is done. Beyond the usual Vegas chaos, what was the overarching security theme or vibe you [Tim] felt dominated the conference this year?
Thinking back to Next '24, what felt genuinely different this year versus just the next iteration of last year's trends?
Last year, we pondered the 'Cloud Island' vs. 'Cloud Peninsula'. Based on Next 2025, is cloud security becoming more integrated with general cyber security, or is it still its own distinct domain?
What wider trends did you observe, perhaps from the expo floor buzz or partner announcements, that security folks should be aware of?
What was the biggest surprise for you at Next 2025? Something you absolutely didn't see coming?
Putting on your prediction hats (however reluctantly): based on Next 2025, what do you foresee as the major cloud security focus or challenge for the industry in the next 12 months?
If a busy podcast listener listening could only take one key message or action item away from everything announced and discussed at Next 2025, what should it be?
