Cloud Security Podcast
Andere apps
Pocket Casts Overcast Castro Castbox Podcast Addict AntennaPod RSS-feed
Learn Cloud Security in Public Cloud and for AI systems, the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We are honest because we are not owned by Cloud Service Provider like AWS, Azure or Google Cloud.
We aim to make the community learn Cloud Security through community stories from small - Large organisations solving multi-cloud challenges to diving into specific topics of Cloud Security.
We STREAM interviews on Cloud Security Topics every week on Linkedin, YouTube and Twitter with over 150K people tuning in.
Afleveringen
-
Pentesting AWS Security Agent
5 november 2026 · 39 min
When cloud providers introduce autonomous AI agents to conduct penetration testing on customer environments, who is responsible when the AI breaks out of scope?
In this episode of the Cloud Security Podcast, Ashish sits down with Richard Fan, an AWS Security Hero, to discuss his research into the AWS Security Agent (recently rebranded as AWS Continuum). Richard shares how he successfully manipulated the agent to bypass AWS guardrails, utilizing internal DNS spoofing and HTTP redirects to trick the AI into attacking out-of-scope, public targets. We discuss why human pentesters easily spot these anomalies, whereas autonomous agents can suffer from context switching.
The conversation also explores the unexpected costs of running these AI tasks (at $50 per hour), the danger of overly simplistic prefix-matching allowlists, and how the AI agent actively circumvented tool restrictions by writing its own execution scripts. Lees meerGuest Socials - Richard's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- …
-
Using LLMs for Enterprise Threat Modeling
27 oktober 2026 · 36 min
Creating an application threat model was a resource-intensive process that took weeks or months, resulting in static documents that were abandoned 80% of the time after their initial creation. However, with development speeds accelerating through AI, security teams must move away from point-in-time blueprints and adopt continuous, enterprise-wide threat modeling to keep pace. In this episode, Ashish sits down with Ben Oster, CPO at ThreatModeler, to discuss how AI is fundamentally changing how we secure software design. Ben explains how Large Language Models (LLMs) can ingest context from Terraform, code repositories, and Confluence pages to generate comprehensive threat models in minutes instead of months. By integrating AI directly into pull requests, organizations can continuously monitor architectural drift across microservices and reduce the manual burden on both developers and security architects. Lees meer
Guest Socials - Ben's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- …
-
Mythos Hype vs. Reality: Why You Need an Agentic Harness
21 oktober 2026 · 48 min
Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turning on a model like Mythos without a multi-stage orchestration layer is like handing someone the keys to a Ferrari when they don't know how to drive. Lees meer
He talks about the 66,000+ CVE "vulnpocalypse" panic and that only 1% of vulnerabilities are ever actively exploited in the wild. We also examine real-world autonomous threats like "Jade Puffer" (the first documented agentic ransomware path) and walk through 3-step maturity framework for enterprise AI adoption: Visibility, Observability, and Actionability via Agentic Governance Gateways
Guest Socials - Johnny's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- Cloud Security Newsletter …
-
How Block Solved DNS Vulnerabilities
13 oktober 2026 · 55 min
When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those services are spun down but the DNS records remain, it creates "dangling" domains ripe for takeover, a vulnerability that can compromise entire hosted zones, auth tokens, and session cookies. Lees meer
In this episode, Ashish sits down with Ramesh Ramani, Staff Security Engineer at Block, to discuss how his team reduced their domain takeover bug bounty reports from over 80 in a single submission down to near zero. Ramesh breaks down the complex challenge of DNS attribution, explaining why automating DNS cleanup is impossible without first identifying resource owners and consolidating approved registrars.
We explore the technical architecture behind Block's stateless, AWS-native automation system, which continuously enumerates their external attack surface and routes vulnerable CNAMEs, MX records, and Elastic IPs directly to the responsible application teams. Ramesh also shares his thoughts on the limitations of AI when evaluating least privilege and parsing logs, emphasizing why security engineers still need deterministic signals.
Guest Socials - Ramesh's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-…
-
Why AI Security is Actually a Data Security Problem
8 oktober 2026 · 40 min
When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environment. In this episode, Ashish sits down with David Gibson, SVP of Strategic Programs at Varonis, to explain why the rapid adoption of AI copilots and autonomous agents is fundamentally a data security crisis. We spoke about how connecting AI to your corporate environment before locking down your data creates massive, unintentional insider threats, allowing employees to instantly discover sensitive information they shouldn't see. We explore the Varonis Atlas framework, which provides a unified control plane to inventory AI systems, implement runtime guardrails, and execute automated red teaming. David also breaks down emerging threats like "hallucination squatting," untrusted agent inputs, and why managing identity groups without understanding data access is like holding a keyring without knowing what doors the keys unlock. Lees meer
Guest Socials - David's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube…
-
Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats
12 september 2026 · 1 uur 11 min
Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, security engineers at the AI software creation platform Lovable, to discuss how they actively secure AI-generated code and protect creators from supply chain risks. Lees meer
Focusing on solutions rather than alarmism, Marcus and Samuel detail their response to an incident where malicious contractors mimicked AI agent commits. They outline their multi-layered defense strategy: securing a predefined tech stack, utilizing integrated security scanners, and tuning coding agents with strict guardrails to ensure secure output by default. The conversation also covers the evolution of the shared responsibility model in the AI era, the critical importance of foundational hygiene like Git commit signing, and the necessary transition from local "YOLO mode" to secure, sandboxed agent environments. Discover how platforms can leverage AI not just to write code, but to actively assist users in finding and resolving security issues through concepts like "CISO agents."
Guest Socials - Marcus's Linkedin + Samuel's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-…
-
Why AI Won't Replace Your SOC: Federated Data & APEX Framework
1 september 2026 · 38 min
Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck at the bottom of the Pyramid of Pain, your incident response team is doused in noise while true threats slip through undetected. In this episode, Ashish sits down with Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl (former Secret Service investigator and Kroger security ops lead), to break down Cribl's open APEX framework. Nicole explains how APEX focuses on behavioral chaining, time-boxing, and clustering over raw telemetry to build high-fidelity detections without needing a thousand individual rules for every MITRE ATT&CK box. We also explore the shift from a "single pane of glass" to a deterministic "single lens" over federated data, why AI agents must be provisioned as true identities rather than unmonitored service accounts, and how to analyze hyper-fast threat archetypes like Anthropic's GTG 1002. Lees meer
Guest Socials - Nicole's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube…
-
The "Hunt First" AI Security Strategy
25 augustus 2026 · 46 min
Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-bad SIEM alerts, you may be missing the silent breaches. In this episode, Ashish is joined by Damien Lewke, Founder and CEO of Nebulock, to discuss the critical shift toward a "Hunt First" mindset. Damien explains why moving away from alert fatigue and focusing on raw, normalized telemetry (across endpoint, identity, and cloud) is the only way to proactively surface unknown threats. We also dive into how AI is finally democratizing the elite skill of threat hunting, allowing even single-person security teams to investigate and attribute complex behaviors.From hunting down shadow AI (like unapproved MCPs) to challenging the notion that AI will replace threat hunters, this episode is a masterclass in modern security operations. Lees meer
Guest Socials - Damien's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- …
-
Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?
18 augustus 2026 · 32 min
When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security tools close enough to stop it? In this episode, Ashish sits down with Michael Leland, VP, Field CTO at Island, to discuss the critical need for an Agentic Control Plane. Michael breaks down why traditional security silos (EDR, DLP, CASB) fail to provide visibility when autonomous AI agents execute tasks outside the network, and why the browser is the ultimate line of defense for monitoring user intent. We explore the massive reality of Shadow AI and the hidden danger of well-intentioned employees accidentally hooking up sensitive data to public LLMs. Finally, Michael shares practical strategies for solving token waste through "model fit steering" and managing the complex "two-hop problem" when an agent calls another agent. Lees meer
Guest Socials - Michael's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- …
-
How Adobe Uses AI Agents for building a WAF Pipeline?
4 augustus 2026 · 47 min
When vulnerability disclosures shrink the wild exploit window down to less than 24 hours (or even minutes), traditional manual patching and WAF rule creation simply cannot keep up. Lees meer
In this episode, Ashish sits down with Ammar Alim (Product Security Engineering Lead at Adobe) to break down how to build an automated, agentic WAF pipeline. Ammar shares how his team manages the scale and complexity of seven commercial and open-source WAFs (including AWS WAF, Cloudflare, Akamai, Azure WAF, Wallarm, and ModSecurity) by leveraging AI agents.
Discover how to construct an agentic harness, orchestrate deep research agents to gather exploit POCs, and utilize multi-model architectures (e.g., Anthropic for rule generation and OpenAI as an LLM judge) to eliminate false positives and safely deploy virtual patches
Guest Socials - Ammar's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
-Cloud Security Podcast- Youtube
- Cloud Security Newsletter …
Vergelijkbare podcasts
-
De Technoloog | BNR
BNR Nieuwsradio
Laatste aflevering 5 november 2026
-
De Grote Tech Show | BNR
BNR Nieuwsradio
Laatste aflevering 5 november 2026
-
Understood: The Big Bet
CBC
Laatste aflevering 26 oktober 2026
-
Machine Gods
NPR
Laatste aflevering 4 november 2026
-
9to5Mac Overtime
9to5Mac
Laatste aflevering 31 oktober 2026
-
The PetaPixel Photography Podcast
PetaPixel
Laatste aflevering 4 november 2026
- Categorieën
- Technologie
- Status
- Loopt nog
- Verschijnt
- Elke week
- Lengte
- Meestal 40 min
- Afleveringen
- 365
- Laatste aflevering
- 5 november 2026
- Eerste aflevering
- 28 november 2019
- Taal
- Engels