Cloud Security Podcast by Google

Guest:

• Royal Hansen, VP of Engineering at Google, former CISO of Alphabet

Topics:

• The "God-Like Designer" Fallacy: You've argued that we need to move away from the "God-like designer" model of security—where we pre-calculate every risk like building a bridge—and towards a biological model. Can you explain why that old engin...

Guest:

• Chris Sistrunk, Technical Leader, OT Consulting, Mandiant

Topics:

• When we hear "attacks on Operational Technology (OT)" some think of Stuxnet targeting PLCs or even backdoored pipeline control software plot in the 1980s. Is this space always so spectacular or are there less "kaboom" style attacks we are more concerned about in practice?

Guest:

• Bruce Schneier

Topics:

• Do you believe that AI is going to end up being a net improvement for defenders or attackers?  Is short term vs long term different?
• We're excited about the new book you have coming out with your co-author Nathan Sanders "Rewiring Democracy".  We want to ask th...

Guest:

• Heather Adkins, VP of Security Engineering, Google

Topic:

• The term "AI Hacking Singularity" sounds like pure sci-fi, yet you and some other very credible folks are using it to describe an imminent threat. How much of this is hyperbole to shock the complacent, and how much is based on actual, observed capabilities to...

Guest:

• Caleb Hoch, Consulting Manager on Security Transformation Team, Mandiant, Google Cloud

Topics:

• How has vulnerability management (VM) evolved beyond basic scanning and reporting, and what are the biggest gaps between modern practices and what organizations are actually doing?
• Why are so many organizations stuck with 1990s VM practices?
• Why mitigation ...

Guests:

• Sivanesh Ashok, bug bounty hunter
• Sreeram KL, bug bounty hunter

Topics:

• We hear from the Cloud VRP team that you write excellent bugbounty reports - is there any advice you'd give to other researchers when they write reports?
• You are one of Cloud VRP's top resea...

Guests:

• Alexander Pabst, Deputy Group CISO, Allianz
• Lars Koenig,  Global Head of D&R, Allianz

 Topics: 

• Moving from traditional SIEM to an agentic SOC model, especially in a heavily regulated insurer, is a massive undertaking. What did the collaboration model with your vendor look like? 

Guest:

• Ari Herbert-Voss, CEO at RunSybil

Topics:

• The market already has Breach and Attack Simulation (BAS), for testing known TTPs. You're calling this 'AI-powered' red teaming. Is this just a fancy LLM stringing together known attacks, or is there a genuine agent here that can discover a truly novel attack path that a huma...

Guest:

• Balazs Scheidler, CEO at Axoflow, original founder of syslog-ng

Topics:

• Are we really coming  to "access to security data" and away from "centralizing the data"?
• How to detect without the same storage for all logs?
• Is data pipeline a part of SIEM or ...

Guest:

• Monzy Merza, co-founder and CEO at Crogl

Topics:

• We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from ac...

Guest:

• Jibran Ilyas, Director for Incident Response at Google Cloud

Topics:

• What is this tabletop thing, please tell us about running a good security incident tabletop? 
• Why are tabletops for incident response preparedness so amazingly effective yet rarely done well?
• Read more