Distilled Security Podcast: Daily Summaries Delivered

Episode 30: Exec Conference Takeaways, PCI & AICPA on Auditing AI & the PHP Apocalypse

Episode 29: TRIS Pittsburgh, CMMC Update & Should We Be Pacing AI? — feat. Doug Salah

In Episode 29, Doug Salah returns as DSP's first-ever repeat guest. We preview TRIS Pittsburgh 2026 (October 22nd, $118K+ in scholarships over 9 years), break down the real implications of the CMMC pause and class deviation, and debate whether pacing AI development makes any sense when adversaries won't slow down. Plus Angel's Envy Cask Strength 2026 and a surprise guest bottle. 🥃⏱️ TIMESTAMPS:00:00 – Intro & Welcome Back Doug Salah 🎉02:32 – TRIS Pittsburgh 2026 Preview10:35 – Scholarships, Sponsors & How to Get Involved19:35 – CMMC Pause & Class Deviation Explained27:00 – NIST Rev 3, Post-Quantum & Self-Reporting Risk33:00 – Prime Supplier Readiness Programs45:00 – C3PAOs: Still Auditing55:56 – TPRM Is Dead — Teaser 👀1:03:00 – 🥃 Angel's Envy Cask Strength 20261:15:17 – Should We Be Pacing AI?1:23:10 – Pacing vs. Gating: What's the Right Move?1:36:00 – Small Models, Nation States & AI Weapons1:49:00 – Purpose Creep & Ungoverned Automation2:02:29 – Wrap-Up🎙️ Hosts Justin Leapline – @justinleapline Joe Wynn – @wynnjoe Rick Yocum – @rickyocum🎤 Guest Doug Salah — linkedin.com/in/douglassalah📬 Send Us Your Questions! ask@distilledsecuritypodcast.com🌐 Connect with Us Website: distilledsecuritypodcast.com X: @DisSecPod Email: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthly security and compliance insights.

Episode 28: Flock Cameras & Privacy, Hacking Water Systems & How to Pick a Good Bourbon

This episode covers the growing controversy around Flock cameras: what they are, how their centralized license plate reader network enables powerful searches across jurisdictions, the documented cases of abuse by law enforcement, and why the real problem isn't the technology itself but the lack of governance and oversight. We also explore the broader privacy implications of always-on surveillance in public spaces and where the line should be drawn.Then we break down a coordinated cyberattack that hit 30+ water systems across 12 states, exposing just how vulnerable US critical infrastructure really is. With 90% of community water systems having zero IT security budget, we discuss what basic OT hygiene should look like and spotlight the volunteer group Water Watch Center doing incredible work to fill the gap.And for something a little different we do a deep dive into how to actually pick a good bourbon. Red flags on the shelf, what terms like "small batch" and "handcrafted" really mean, why older isn't always better, the massive barrel surplus reshaping the industry, and the distillation process behind what's actually in your glass.🥃 Spirit Review: Boondocks Port Finished Straight Bourbon Whiskey 6 years, finished in port wine barrels, picked up in KentuckyTakeawaysFlock cameras raise concerns about privacy, abuse, and the need for oversightThe use of surveillance technology has broader ethical and societal implicationsSurveillance technology presents ethical and moral dilemmasThe need for checks and balances and governance in surveillance technologyMarketing gimmicks can influence consumer choicesProof and distillation process impact the quality of whiskeyThe whiskey industry is experiencing a surplus of barrelsWater utilities face cybersecurity challenges due to limited budgets and resourcesBasic cybersecurity measures, such as removing unnecessary internet access, replacing default credentials, and using multi-factor authentication, are crucial for protecting critical infrastructureChapters00:00 Introduction to Flock Cameras03:00 Capabilities and Controversy08:12 Ethical Implications and Privacy Concerns16:00 Data Collection and Surveillance Technology30:36 Challenges of Surveillance Technology36:04 Ethical and Moral Considerations41:43 Governance and Oversight52:37 Privacy Concerns and Public Trust57:24 Impact of Marketing Gimmicks58:07 Significance of Proof and Distillation Process01:00:42 Surplus of Barrels in the Whiskey Industry01:07:11 Tasting Notes and Availability of Specific Bourbon01:25:27 Hacking of Utilities and Water Systems01:26:15 Challenges Faced by Water Utilities01:38:24 Implications of Compromised Water Systems01:43:17 Role of Volunteer Organizations and Basic Cybersecurity MeasuresHostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocumSend Us Your Questions!ask@distilledsecuritypodcast.comConnect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com👍 Subscribe for monthly security and compliance insights.

Episode 27: AI Hacking AI, EU AI Act Delays, CMMC Updates & The Duress Code Case

In Episode 27, we recap BSides Pittsburgh 2026 (914 attendees, best turnout yet), then dive into AI models breaking out of sandboxes and hacking Hugging Face, the EU AI Act transparency rules now in effect, the CMMC Phase 2 pause and what it doesn't change, and the precedent, setting case of a US citizen criminally charged for using a phone duress code at the border. Plus Wayne Gretzky No. 99 Whisky. 🥃⏱️ Timestamps00:00 – Intro 01:28 – BSides Pittsburgh 2025 Recap & Numbers 05:33 – Villages, Sponsors & Planning for Next Year 10:46 – The After-After Party at The Lion 🍸 20:43 – AI Hacking AI: The Hugging Face Incident 25:46 – What CISOs Should Do Now 33:54 – Agentic IR Teams & Kill Switch Governance 45:00 – AI Patching & Configuration Management 57:04 – EU AI Act: The Deadline That Wasn't 1:04:33 – AI Inventory & Third-Party SaaS Risk 1:23:56 – 🥃 Spirit: Wayne Gretzky No. 99 Whisky 1:28:37 – CMMC Phase 2 Pause: What It Means 1:44:15 – Duress Code Case & Corporate Travel Policy 2:04:00 – Digital Privacy at the Border & Employee Training 2:15:37 – Wrap-Up🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum📬 Send Us Your Questions!ask@distilledsecuritypodcast.com🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthly security and compliance insights.

Episode 26: How to Run a Conference, Why Most Pen Tests Fail, and HIPAA's Ransomware Reckoning

In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon. 🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses🔗 Chaining vulnerabilities and what separates a checkbox test from a real one💸 Why pen testing so often becomes an ineffective use of resources📋 Compliance and contractual drivers vs. genuine risk reduction🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement🤝 Engaging pen testers as partners and maturing the process over time🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare🥃 Bourbon tasting and discussion⏱️ Timestamps00:00 Intro01:26 Guest introduction & background02:18 RareMed Solutions & patient assistance programs05:01 Book writing & amateur radio08:11 BSides Pittsburgh overview15:04 Running a conference: planning & organization22:05 Marketing & audience engagement25:07 Dividing responsibilities as you grow27:59 The value of ticket pricing31:50 BSides & the conference model46:11 Penetration testing & scoping57:28 The purpose of pen testing58:23 When pen testing goes wrong01:00:16 Reasons for pen testing & compliance drivers01:03:04 Continuous monitoring, testing & detection01:06:19 Is your company ready for a pen test?01:07:07 A risk-based approach01:13:58 Scenario-based testing & resilience01:17:31 Evaluating the value of pen testing01:29:01 The constant state of change01:31:01 Compliance & cyber insurance01:32:19 Bourbon tasting01:36:32 Government scoring & risk analysis01:50:36 HIPAA compliance & ransomware01:55:01 Wrap-up & call to action🎧 Distilled Security PodcastCybersecurity, GRC, and leadership, one pour at a time.🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum🎤 GuestJon Buhagiar linkedin.com/in/jonbuhagiar📬 Send Us Your Questions!ask@distilledsecuritypodcast.com🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodYouTube: @distilledsecurityEmail: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthlysecurity and compliance insights.

Episode 25: AI, Vulnerability Management & The Future of GRC Engineering

In this episode of the Distilled Security Podcast, we dive into AI-driven vulnerability management, a massive breach hitting 9,000 educational institutions, and the future of GRC engineering, including a live preview of what autonomous compliance agents actually look like in practice.🔹 AI & Vulnerability Management — Why the next 6–18 months will be a patching crisis, how AI models are accelerating zero-day discovery, the operational reality of back-to-back criticals, surge scenario planning, burnout risk, and Microsoft's M-Dash orchestrated agent approach🔹 The Canvas/Instructure Breach — 275 million records exposed, finals week disrupted across 9,000 universities, a rumored $10M ransom negotiated by the SaaS provider, the ShinyHunters connection, and what this means for critical infrastructure concentration risk🔹 GRC Engineering Meets AI — Deterministic vs. non-deterministic testing explained, why auditors can't rely on AI-generated evidence, autonomous agents with segregation of duties, the episki 2.0 platform preview, and the emerging role of the "orchestration conductor" in security teams🥃 Spirit Review: Heaven Hill Grain to Glass (DSP KY-1)⏱️ Timestamps00:00 – Intro & Topics Overview01:27 – AI & The Coming Vulnerability Surge07:00 – Patching Windows, Burnout & Operational Reality16:40 – Surge Scenarios, Fix-It Weeks & Recommendations21:20 – Microsoft M-Dash: Orchestrated Agent Scanning25:56 – The Canvas/Instructure Breach Breakdown33:18 – Critical Infrastructure & Third-Party Concentration Risk47:00 – Black Kite 2026: Third-Party Breach Report53:11 – Spirit Review: Heaven Hill Grain to Glass57:07 – BSides Pittsburgh 2026 Update1:04:01 – GRC Engineering Meets AI1:19:00 – Deterministic vs. Non-Deterministic Testing Explained1:25:00 – episki 2.0 Platform Preview1:47:00 – AI Segregation of Duties & Three Lines of Defense1:53:00 – The Orchestration Conductor: A New Security Role2:02:31 – Outro & Wrap-Up🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum📬 Send Us Your Questions!ask@distilledsecuritypodcast.com🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthly security and compliance insights.

Episode 24: 2 Years, 24 Episodes & The State of Security in the Age of AI

In this episode, we celebrate our 2nd anniversary and Episode 24 of Distilled Security! We cover the Vercel breach, how a Roblox script led to compromised Google Workspace credentials via an unauthorized OAuth connection. Then we dive into HackerOne, pausing their own bug bounty program, overwhelmed by low-quality, AI-generated submissions. And we close out with the State of Vibe-Coded Security—4,783 AI-assisted apps scanned, 727 critical issues found, and the real question: are you vibe coding or vibe deploying? Plus, a quick look at Claude for Security dropping into public beta and what that means for the industry. All of that, and we crack open a Peerless Double Oak to toast two years of Distilled Security. 🥃⏱️ TIMESTAMPS:00:00 – Intro & 2-Year Anniversary 🎉01:26 – Behind the Scenes & Favorite Moments08:26 – Podcast Metrics & Global Reach24:20 – BSides Pittsburgh 2025 Update 🛡️34:31 – The Vercel Breach & OAuth Risk58:57 – HackerOne Pauses Bug Bounty1:16:05 – Spirit: Peerless Double Oak 🥃1:20:27 – Vibe Coding vs. Vibe Deploying1:26:46 – Claude for Security & AI News1:41:27 – Cheers to Two Years! 🥃🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum📬 Send Us Your Questions!ask@distilledsecuritypodcast.com🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthly security and compliance insights

Episode 23: Nobody read the report

In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry. Topics CoveredThe Delve scandal—leaked reports, copy-pasted audits & pervasive deficienciesThe AICPA peer review process & AC Corp's adverse findingsSOC 2 vs ISO 27001—oversight models, witness audits & accreditationThe incentive structure driving compliance to the bottomCompliance automation — what works, what doesn't & AI's real roleWhat to ask your auditor before signing anythingTrust centers — done right vs. compliance theaterIs SOC 2 dead? What needs to change & who has to change itHostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocumHostsMatthew J. Schiavone - (Sikich) Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com