Security Weekly Podcast Network (Audio)

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?
The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.
Segment Resources:
Modernize your TPRM program with adaptive risk management for SaaS and AI
Nudge Security Unveils Adaptive Risk Management press release
The security work nobody wants to do is the risk nobody’s watching
OAuth grants pile up faster than you can review them BleepingComputer
This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!
Topic Segment - Coordinated Disclosure
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.
Coordinated disclosure in 2026 is:
75% - Too slow for AI world
13% - Vendor Credit Race
13% - This is fine ????????️????
0% - Working as designed
0% - Other (tell me)
Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.
Enterprise Security News
Finally, in the enterprise security news,
A little funding
making software liable for cyber breaches
we have a new biggest bank heist ever!
more freezers defrosted
a company builds malware into their product on purpose
AI pentesting frameworks are lowering the script kiddy bar
AI hosting company hacks their competitor
there’s a new SSH bug that could be very, very bad
even MSPaint gets a vulnerability
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-484

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-631

In the security news:
Supermarket refrigeration attacks, again!
Rapid7’s Ivanti findings and why we can’t have “nice” things
Google’s massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead’s TLS handling
Hackers hijack emergency alert apps
Taiwan’s emergency services become an AI-agent target
CUI exposed through GSA’s Google Drive
GCHQ can’t account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-951

As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself?
Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), joins Business Security Weekly to discuss why it’s not the technology that PWNs you, it’s the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them.
Segment Resources:
https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL
In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-472

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-630