Security Weekly Podcast Network (Audio)

Orgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is an approach for defining customizable scenarios and testing whether those systems fail against known security threats. Mert Saltimaz talks about the background of the project, how orgs can use it as they bring more LLMs into their environment, and how the project intends to grow. Importantly, we also talk about the security controls and designs that orgs can build around the systems and data that models interact with in addition to evaluating the security of the agents and agent harnesses themselves.
Segment Resources:
https://github.com/OWASP/Agent-Security-Regression-Harness
https://youtu.be/6DWs5EwbFQ0?si=r0IJ_F0SZnkPzzYg -- "What Trading Systems Taught Me About Breaking (And Defending) Infrastructure"
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-393

Segment 1 - Interview with O'Shea Bowens
What do we really know about "AI Network Protocols"? Network security is about to get popular all over again.
Generative AI caused a disruptive explosion across all of tech and every company’s roadmap. The move from chatbots to AI agents doubled down on that disruption. Now agents need to talk to each other?
Boom: we have MCP. A2A. Universal Commerce Protocol. General purpose and specialized protocols for agent communication. What does this look like from the network perspective, though? O’Shea Bowen joins us to answer this question, and he thinks the results are interesting enough to spark a resurgence of interest in network security tooling.
Segment Resources:
https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSIMCPSECURITY.pdf?ver=bmgiSbNQLP6Z_GiWtRt6bg%3D%3D
https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-security-crisis-20260504-csa-styled/
https://cyberone.security/blog/building-an-ai-security-strategy-without-stalling-business-growth
Segment 2 - Interview with Jeremiah Grossman
Jeremiah Grossman on why we've been measuring cyber risk wrong for 20 years
After decades helping shape modern web security, and building companies that were ultimately acquired by Synopsys and Tenable, Jeremiah Grossman believes cybersecurity has arrived at an inflection point. His argument is a provocative one: for years, the industry has optimized around the wrong metrics. His latest venture, Root Evidence, aims to help security teams identify which risks are most likely to cause meaningful business loss, and he has the evidence - real-world breach data, cyber insurance claims, digital forensics intelligence, attack surface intelligence, and observed attacker behavior - to back it up.
Find all of CyberRisk TV's Black Hat 2026 coverage at: https://www.securityweekly.com/blackhat
Segment 3 - Weekly Enterprise News
Finally, in the enterprise security news,
We vibe check the AI model situation
hidden devices in California cars causes concerns
OpenAI’s models escape sandboxes and breaches another AI company, totally by accident, they promise!
Grok Build uploads all your files, totally by accident, they promise!
Eclipsium debuts a firmware version of patch tuesday!
HTTP gets a new method
common problems with incident response
Which one of the security weekly hosts would consider switching to a “dumb phone”?
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-469

Rogue AI Vehicle Porn, OpenAI, Nudes, Clop, Patches, Oracle, Palo Alto, Aaran Leyland, and More on this episode of the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-601

In the news this week:
InfraTrust and knowing what to patch
Adversary in the middle triggered command injection
Exploitarium again
FreeRDP comes with free vulnerabilities
AI breaking out of sandboxes on its own
Wordpress RCE
DMA dangers
Nightmware eclypse is at it again
Fortisandbox
Turning AI to the dark side
more prompt injection
Secure boot is broken, still and again...
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-936

America has lived through technological and economic upheaval before. Farm workers moved to factories. Factory workers moved into services. New industries replaced old ones. Productivity rose. Living standards improved. But are we ready for the greatest disruption in American history?
Ben Gilliland, author of the upcoming book Breaking the Compact, joins Business Security Weekly to discuss why business leaders need to be prepared for the upcoming AI disruption. The impact of AI, which has not fully materialized, goes far beyond security and job displacement. It will impact our economy, our privacy, and our way of life. The closest recent warning is the "China shock," the period of rapidly increasing import competition that followed China's integration into the global trading system. AI will dwarf that. Ben will discuss the human advantage and how we can prepare now.
In the leadership and communications segment, Cybersecurity’s Economics Are Broken. Automation Alone Won’t Fix It, The business case for burning down security debt: A practical approach for CISOs, The last human relationship in cybersecurity, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-457