Security Weekly Podcast Network (Audio)

Managing a cyber crisis extends far beyond the initial breach, tossing leadership into a chaotic fog where security teams, legal counsels, and executives must make high-stakes choices under extreme duress. When a catastrophic security event occurs, organizations struggle against a predictable set of systemic, technical, and operational roadblocks. How can organizations transition from a reactive state to a controlled recovery, successful crisis management state?
Mone' Ross, Vice President, Cyber Operations at JPMorganChase, joins Business Security Weekly to discuss Cyber Resilience and the leadership behaviors that determine what happens under pressure. Mone' will discuss why preparation and communication are imperative to a successful response. She has also identified the five Crisis Archetypes and how each type should or should not lead during a crisis.
In the leadership and communications segment, AI Security Now Tops Every CISO Priority for 2027, What a security strategy that survives 2027 looks like, Leaders Need to Grapple with Employee Ambivalence on AI, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-473

Bad Claude, Bad, French Fridge Fiasco Fries Fromage, Teenage Mutant Ninja AI, SonicWALL, Aaran Leyland, and More, on the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-632

AI-enabled cyber attackers will check every third-party path into an application at scale and speed. The same process can help defenders just as much, but it’s only as effective as the human expertise guiding it. Andrew Wesie, Xint co-founder and CTO. explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise.
Segment Resources:
Business logic vulns, https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference
Securing apps and their third-party access, https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks
Working with DARPA to test the infrastructure surrounding messaging apps, https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339
This segment is sponsored by Xint. To learn more, visit https://securityweekly.com/xint!
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-408

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?
The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.
Segment Resources:
Modernize your TPRM program with adaptive risk management for SaaS and AI
Nudge Security Unveils Adaptive Risk Management press release
The security work nobody wants to do is the risk nobody’s watching
OAuth grants pile up faster than you can review them BleepingComputer
This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!
Topic Segment - Coordinated Disclosure
An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.
Coordinated disclosure in 2026 is:
75% - Too slow for AI world
13% - Vendor Credit Race
13% - This is fine ????????️????
0% - Working as designed
0% - Other (tell me)
Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.
Enterprise Security News
Finally, in the enterprise security news,
A little funding
making software liable for cyber breaches
we have a new biggest bank heist ever!
more freezers defrosted
a company builds malware into their product on purpose
AI pentesting frameworks are lowering the script kiddy bar
AI hosting company hacks their competitor
there’s a new SSH bug that could be very, very bad
even MSPaint gets a vulnerability
All that and more, on this episode of Enterprise Security Weekly.
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw-484

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-631