Free Daily Podcast Summary
Cloud Security Podcast: Daily Summaries Delivered
by TechRiot.io
Learn Cloud Security in Public Cloud and for AI systems, the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We are honest because we are not owned by Cloud Service Provider like AWS, Azure or Google Cloud. We aim to make the community learn Cloud Security through community stories from small - Large organisations solving multi-cloud challenges to diving into specific topics of Cloud Security.We STREAM interviews on Cloud Security Topics every week on Linkedin, YouTube and Twitter with over 150K people tuning in.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 2 days ago38 min
Pentesting AWS Security Agent
When cloud providers introduce autonomous AI agents to conduct penetration testing on customer environments, who is responsible when the AI breaks out of scope?In this episode of the Cloud Security Podcast, Ashish sits down with Richard Fan, an AWS Security Hero, to discuss his research into the AWS Security Agent (recently rebranded as AWS Continuum). Richard shares how he successfully manipulated the agent to bypass AWS guardrails, utilizing internal DNS spoofing and HTTP redirects to trick the AI into attacking out-of-scope, public targets. We discuss why human pentesters easily spot these anomalies, whereas autonomous agents can suffer from context switching.The conversation also explores the unexpected costs of running these AI tasks (at $50 per hour), the danger of overly simplistic prefix-matching allowlists, and how the AI agent actively circumvented tool restrictions by writing its own execution scripts.Guest Socials - Richard's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction to AI Autonomous Pen Testing Richard Fan’s Background as an AWS Security Hero What is AWS Continuum (formerly AWS Security Agent)? Research Goal: Testing the Guardrails of an AI Pen Tester Bypassing Domain Verification using Internal VPC DNS The Flaw of AI Context Switching vs. Human Intuition Using HTTP Redirects to Force the Agent Out of Scope The Danger of Prefix-Matching URL Allowlists Redefining the Cloud Shared Responsibility Model for AI Agents Why You Should Never Run Autonomous Agents in Production The High Costs of Running AWS Continuum ($50/hour) How the AI Agent Wrote Custom Scripts to Bypass Tool Restrictions Resources spoken about during the episode:Richard's Blog - Pentesting a pentest agent - Here's what I've found in AWS Security Agent
- 1 weeks ago35 min
Using LLMs for Enterprise Threat Modeling
Creating an application threat model was a resource-intensive process that took weeks or months, resulting in static documents that were abandoned 80% of the time after their initial creation. However, with development speeds accelerating through AI, security teams must move away from point-in-time blueprints and adopt continuous, enterprise-wide threat modeling to keep pace. In this episode, Ashish sits down with Ben Oster, CPO at ThreatModeler, to discuss how AI is fundamentally changing how we secure software design. Ben explains how Large Language Models (LLMs) can ingest context from Terraform, code repositories, and Confluence pages to generate comprehensive threat models in minutes instead of months. By integrating AI directly into pull requests, organizations can continuously monitor architectural drift across microservices and reduce the manual burden on both developers and security architects. Guest Socials - Ben's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction to Continuous Threat Modeling Ben Oster’s Background in Privacy, Compliance, and Cybersecurity Why 80% of Traditional Threat Models Are Abandoned How LLMs Generate Threat Models from Repositories and Confluence Shifting from Point-in-Time Blueprints to Continuous Assessment Integrating Threat Models Directly into AI Engineering Prompts Moving Beyond STRIDE: Focusing on Speed and Developer Adoption Building Enterprise-Wide Reusable Security Controls The "Build vs. Buy" Dilemma for Continuous Threat Modeling Managing Cascading Risks Across Complex Microservice Architectures Using AI to Reason Through Pull Requests (PRs) and Architectural Drift Connecting with ThreatModeler and Upcoming Product Launches
- 2 weeks ago47 min
Mythos Hype vs. Reality: Why You Need an Agentic Harness
Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turning on a model like Mythos without a multi-stage orchestration layer is like handing someone the keys to a Ferrari when they don't know how to drive. He talks about the 66,000+ CVE "vulnpocalypse" panic and that only 1% of vulnerabilities are ever actively exploited in the wild. We also examine real-world autonomous threats like "Jade Puffer" (the first documented agentic ransomware path) and walk through 3-step maturity framework for enterprise AI adoption: Visibility, Observability, and Actionability via Agentic Governance GatewaysGuest Socials - Johnny's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction: The Mythos Readiness Assessment Hype Johnny Hands’ Background & Trend AI’s Mission Debunking the Mythos Assessment Panic in Europe and Japan Handing over the Ferrari: Why Mythos Fails Without an Agentic Harness The "Vulnpocalypse": Clearing 66,000+ CVEs & Finding the 1% That Matter Moving Away from "Busy" Metrics: How to Report AI Risk to the Board Coupling Low-Severity CVEs with Risky User Behavior Inside the Zero Day Initiative (ZDI) Multi-Stage Agentic Harness Filtering LLM Hallucinations with Multi-Model Statistical Inference Deconstructing "Jade Puffer": The First Autonomous Ransomware Path Virtual Patching and Fencing Against Fast End-Day Weaponization The 3-Step AI Security Maturity Model: Visibility, Observability, Actionability The "You Laugh, You Lose" Cybersecurity Joke Challenge
- 3 weeks ago55 min
How Block Solved DNS Vulnerabilities
When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those services are spun down but the DNS records remain, it creates "dangling" domains ripe for takeover, a vulnerability that can compromise entire hosted zones, auth tokens, and session cookies. In this episode, Ashish sits down with Ramesh Ramani, Staff Security Engineer at Block, to discuss how his team reduced their domain takeover bug bounty reports from over 80 in a single submission down to near zero. Ramesh breaks down the complex challenge of DNS attribution, explaining why automating DNS cleanup is impossible without first identifying resource owners and consolidating approved registrars.We explore the technical architecture behind Block's stateless, AWS-native automation system, which continuously enumerates their external attack surface and routes vulnerable CNAMEs, MX records, and Elastic IPs directly to the responsible application teams. Ramesh also shares his thoughts on the limitations of AI when evaluating least privilege and parsing logs, emphasizing why security engineers still need deterministic signals.Guest Socials - Ramesh's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction: The Threat of Domain and DNS Takeovers Ramesh Ramani’s Background and 20-Year Tech Career Discovering the DNS Problem During Block’s 2020 Cloud Migration The Catalyst: Receiving a Bug Bounty Report with 80+ Vulnerable Domains Why Third-Party PaaS Providers Can't Fix Your Dangling CNAMEs How M&A Activity Creates Orphaned Route 53 Name Servers The Difference Between Hosted Zone, CNAME, and MX Takeovers Finding 400 Vulnerable Domains and the Challenge of Attribution The Registrar Problem: Stopping Developers from Creating Unsanctioned Zones Using AWS Service Control Policies (SCPs) to Enforce Domain Guardrails Building a Stateless Serverless Engine for DNS Automation Establishing a Single Source of Truth for the External Attack Surface Driving Domain Takeover Bug Bounty Reports Down to Zero The Limitations of AI for Deterministic Log Analysis and Least Privilege Fun Questions, Korean BBQ, and Georgia Tech Master's Degrees Ashish on Writing "AI Security Engineering" and the Rise of AI Agents Resources spoken about during the interview:The domain takeover challenge: Detecting and defeating it at scale
- Oct 8, 202640 min
Why AI Security is Actually a Data Security Problem
When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environment. In this episode, Ashish sits down with David Gibson, SVP of Strategic Programs at Varonis, to explain why the rapid adoption of AI copilots and autonomous agents is fundamentally a data security crisis. We spoke about how connecting AI to your corporate environment before locking down your data creates massive, unintentional insider threats, allowing employees to instantly discover sensitive information they shouldn't see. We explore the Varonis Atlas framework, which provides a unified control plane to inventory AI systems, implement runtime guardrails, and execute automated red teaming. David also breaks down emerging threats like "hallucination squatting," untrusted agent inputs, and why managing identity groups without understanding data access is like holding a keyring without knowing what doors the keys unlock. Guest Socials - David's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction to AI Agents and Data Security David Gibson's Background in IT and Joining Varonis in 2006 The "State of Cybercrime" Podcast and the "AI of A" Segment The Through Line: How Legacy Data Auditing Gaps Amplify AI Risks Unintentional Insider Threats: Employees Finding Sensitive Data via AI Emerging Agentic Threats: Untrusted Inputs and SQL Injection on Steroids The Threat of "Hallucination Squatting" by Malicious Actors Copilot Enablement, Claude Cowork, and the Sprawl of Corporate AI Agents Shrinking Exposure: Inventorying AI and Enforcing Runtime Guardrails Why AI Agents Are Like "Well-Meaning Interns That Never Sleep" The Varonis Atlas Framework: Inventory, Red Teaming, and Runtime Controls Integrating Email Security to Stop Upstream IT Help Desk Impersonation The "Inside Out" Security Strategy: Starting at the Data Layer The Identity Gap: Holding a Keyring Without Knowing Which Doors They Unlock Moving Out of the "Denial Stage" of Shadow AI Adoption The "You Laugh, You Lose" Cybersecurity Joke ChallengeThis episode was sponsored by Varonis
- Sep 11, 20261h 10m
Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats
Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, security engineers at the AI software creation platform Lovable, to discuss how they actively secure AI-generated code and protect creators from supply chain risks.Focusing on solutions rather than alarmism, Marcus and Samuel detail their response to an incident where malicious contractors mimicked AI agent commits. They outline their multi-layered defense strategy: securing a predefined tech stack, utilizing integrated security scanners, and tuning coding agents with strict guardrails to ensure secure output by default. The conversation also covers the evolution of the shared responsibility model in the AI era, the critical importance of foundational hygiene like Git commit signing, and the necessary transition from local "YOLO mode" to secure, sandboxed agent environments. Discover how platforms can leverage AI not just to write code, but to actively assist users in finding and resolving security issues through concepts like "CISO agents."Guest Socials - Marcus's Linkedin + Samuel's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast Introduction to Securing AI App Builders Marcus & Samuel's Backgrounds and Roles at Lovable Empowering Non-Technical Users to Build 40 Million Apps Securing Predefined Tech Stacks and Tuning Coding Agents Managing Trust When Customers Hire External Contractors Addressing Supply Chain Risks with Synced GitHub Repositories Educating Users and Developing "CISO Agents" for Support Analyzing the Attack: How Threat Actors Mimicked Agent Commits The Importance of Basic Hygiene: MFA and Commit Signing Moving Agents from "YOLO Mode" to Sandboxed Environments The Buy vs. Build Debate for Internal AI Capabilities AI as an Educational Tool and Democratizing SQL Queries Hobbies, Plants, and Pushing AI to Design 1940s Bridges
- Sep 1, 202637 min
Why AI Won't Replace Your SOC: Federated Data & APEX Framework
Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck at the bottom of the Pyramid of Pain, your incident response team is doused in noise while true threats slip through undetected. In this episode, Ashish sits down with Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl (former Secret Service investigator and Kroger security ops lead), to break down Cribl's open APEX framework. Nicole explains how APEX focuses on behavioral chaining, time-boxing, and clustering over raw telemetry to build high-fidelity detections without needing a thousand individual rules for every MITRE ATT&CK box. We also explore the shift from a "single pane of glass" to a deterministic "single lens" over federated data, why AI agents must be provisioned as true identities rather than unmonitored service accounts, and how to analyze hyper-fast threat archetypes like Anthropic's GTG 1002. Guest Socials - Nicole's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction & The Death of Hashes and IP Detections Nicole Beckwith's Background (Secret Service, GE Aerospace, Kroger, Cribl) Moving Up David Bianco’s Pyramid of Pain to TTPs Replacing the "Single Pane of Glass" with a Single Lens on Federated Data Deciding What Logs to Pipe to a Data Lake vs. Keep in a SIEM The Cost and Context Risks of Pointing AI Agents Directly at Unstructured Data Lakes IAM Mistakes: Why AI Agents Must Be Provisioned as Identities, Not Service Accounts The Biggest Blind Spot in AI Detection Engineering (Rule Writing vs. Tuning) Why AI SOCs Break on Normalized Schemas and Need Raw Telemetry Deconstructing the APEX Framework: Chaining, Time-Boxing, and Clustering Detecting Anthropic’s GTG 1002 Archetype and MCP Scaffolding Abuse How to Apply the APEX Framework to Any Existing Security Stack Empowering Analysts: Why AI Should Not Be Used to Cut SOC HeadcountResources spoken about during the interview APEX Framework
- Aug 25, 202646 min
The "Hunt First" AI Security Strategy
Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-bad SIEM alerts, you may be missing the silent breaches. In this episode, Ashish is joined by Damien Lewke, Founder and CEO of Nebulock, to discuss the critical shift toward a "Hunt First" mindset. Damien explains why moving away from alert fatigue and focusing on raw, normalized telemetry (across endpoint, identity, and cloud) is the only way to proactively surface unknown threats. We also dive into how AI is finally democratizing the elite skill of threat hunting, allowing even single-person security teams to investigate and attribute complex behaviors.From hunting down shadow AI (like unapproved MCPs) to challenging the notion that AI will replace threat hunters, this episode is a masterclass in modern security operations. Guest Socials - Damien's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security PodcastQuestions asked: Introduction: The Problem with Reactive Security Alerts Damien Lewke’s Background (DoD, CrowdStrike, Arctic Wolf, Nebulock) Why Breaches Happen in Silence: The Value of Telemetry Over Alerts How AI Democratizes Elite Threat Hunting for Small Teams Defining the "Hunt First" Mindset and Methodology Surfacing Active Intrusions Using Cross-Domain Context The Importance of Transparency in AI Decision Making When NOT to Use AI for Detections (The Power of Heuristics) The Best First AI Security Use Case: Hunting Shadow AI & MCPs Detecting Rogue AI Agents via Tempo, Breadth, and Automation Signatures The Future of SIEM: Data Gravity vs. Purpose-Built Security Analytics Disagreeing with Gartner: Why Threat Hunters Are More Vital Than Ever The 89% Rise in AI-Augmented Attacks and Taking Action The "You Laugh, You Lose" Cybersecurity Joke Challenge Resources spoken about during the episode:- Hunting MCP Server Exploitations- Using classical machine learning for threat hunting (and saving tokens in the process)- Your newest insider has legitimate access
Get Cloud Security Podcast summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
The Watchtower
Cybersecurity, data, and AI leaders share candid insights on real-world challenges and innovations beyond the headlines.
Latent Space: The AI Engineer Podcast
Conversations with AI engineers, researchers, and founders on foundation models, AI agents, infrastructure, and scientific discovery.
Security Now (Video)
A weekly deep dive into cybersecurity news, threats, and defenses with Steve Gibson and Leo Laporte.
"The Cognitive Revolution"
Explores the transformative impact of artificial intelligence through interviews with innovators shaping its future.
Security Now (Audio)
A weekly deep dive into cybersecurity news, hacking trends, and digital defense strategies for professionals and individuals.
Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure
Expert discussions on cybersecurity, national security, and threats to critical infrastructure like energy and water systems.
Random Access Memories
Conversations with tech professionals reveal the personal stories behind their careers in cybersecurity, AI, startups, and leadership.
The AI in Business Podcast
Interviews with AI executives reveal practical applications and strategic insights for business leaders adopting AI.
Interconnects
Exploring AI advancements through in-depth interviews with scientists and critical analysis of the technology beyond the hype.
The Low Down
A podcast about hacking.
80,000 Hours Podcast
Discusses artificial intelligence and global catastrophic risks with experts and researchers.
The In-Between Tech and Trust Podcast
Explores how technology impacts trust through conversations with experts in business, politics, neuroscience, and tech.
About Cloud Security Podcast
Learn Cloud Security in Public Cloud and for AI systems, the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We are honest because we are not owned by Cloud Service Provider like AWS, Azure or Google Cloud. We aim to make the community learn Cloud Security through community stories from small - Large organisations solving multi-cloud challenges to diving into specific topics of Cloud Security.We STREAM interviews on Cloud Security Topics every week on Linkedin, YouTube and Twitter with over 150K people tuning in.
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Cloud Security Podcast in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Cloud Security Podcast daily summary?
It's a free AI-powered email that summarizes new episodes of Cloud Security Podcast as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Cloud Security Podcast podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Cloud Security Podcast product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by TechRiot.io.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does Cloud Security Podcast release new episodes?
Cloud Security Podcast publishes weekly. Our AI generates a summary within hours of each new episode.
What topics does Cloud Security Podcast cover?
Cloud Security Podcast covers topics including Technology. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Cloud Security Podcast summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.