Down the Security Rabbithole Podcast (DtSR)

TL;DR: AI doesn't care about your firewall policy. We dig into the uncomfortable question many security teams are quietly asking: Are firewalls still relevant in the age of AI, agent swarms, and automation?Guest:Anton ChuvakinVideo: https://youtu.be/SkeVmc6NVucDescription: Your firewall policy looks solid right up until an AI agent decides it’s negotiable. We dig into the uncomfortable question many security teams are quietly asking: are firewalls still relevant in the age of AI, agent swarms, and automation that can probe systems faster than any human ever could? Our take is blunt and practical. If there’s no access, there’s no access, but almost nobody manages segmentation and firewall rules as cleanly as they think they do [or should].We break down what people are starting to call an “AI firewall" (I feel like I should apologize for that), and why that label can mean two totally different things: a firewall that controls AI traffic (prompts, tool calls, model access, data exfil paths) and a firewall that uses AI to manage policy (untangling years of exceptions, spotting risky openings, and making rulebases make sense again). From there, we spar over hardware versus virtual controls, the appeal of a real kill switch, and why “AI changes everything” and “AI changes nothing” are both lazy answers.The second half gets grounded in day-to-day operations: local inference versus managed models, the real economics of tokens versus hardware, and where AI actually helps today. We’re bullish on using AI in the SOC to eliminate manual triage, ticket chasing, and context gathering, but we’re skeptical it can replace human judgment. Models can be technically correct and operationally wrong, and only experienced analysts can supply the feedback and intuition that tighten the loop.If you’re building an AI security strategy, hardening network controls, or wondering how agentic AI changes governance, this conversation is for you. Subscribe, share it with a teammate, and leave a review with your spiciest take: do you trust “virtual” guardrails, or do you want something you can power off?Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Stop vibe-coding your detections! This week's pod features Matt Coons at GitLab as we talk about detection engineering, but with AI agents.GuestMatt CoonsDescriptionYour detection backlog is endless, your alert queue never stops, and “just tune it out” quietly creates blind spots. From the floor of BSides Atlanta, we sit down with Matt Coons from GitLab to talk about a different path: agentic detection engineering that moves faster while staying provable, testable, and human-owned.We get concrete about what changes when AI agents enter the loop. Matt explains how end-to-end validation can work in practice, from running real API calls to ensuring the right events land in the logging platform and trigger the intended rule. We also unpack the difference between detection engineering and detection tuning, why time-bound tuning beats “mute forever,” and where human judgment still matters when an agent suggests exclusions that might hide real malicious behavior.A big theme is designing security operations for scale. We explore signals versus detections, grouping signals by entity to expose patterns, and using multi-agent triage to reduce SOC burnout without losing visibility. Matt shares how model tiering can control cost, why newer frontier models can deliver more production-ready detection content, and why the real bottleneck is shifting toward human approval and accountability. We also hit prompting discipline, skill files, and how to get summaries that are actually shorter than the original.If you care about AI in cybersecurity, SOC automation, threat hunting, MITRE ATT&CK coverage, and reducing false positives while catching more real incidents, this one is for you. Subscribe, share it with a teammate, and leave a review, then tell us: what part of your detection workflow would you trust an agent to handle first?Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Xavier Ashe was there when that first DDoS attack by MafiaBoy went down. He's got stories, and we're going to tell them. Recorded live at BSides Atlanta in 2026.GuestXavier AsheDescription: A DDoS attack used to be something you could “just block” once you saw the source. Then defenders learned the hard way that thousands of small senders can knock over a giant, and the playbook changed for good. From the stage at B-Sides Atlanta at Georgia Tech, we sit down with security veteran Xavier Asht for story time from the defender’s seat during one of the earliest recorded distributed denial-of-service incidents and what that night still teaches security operations teams today.From there, we follow the thread into the modern SOC: the messy gap between “something is broken” and “we are under attack,” the endless tooling arms race, and why AI makes some problems easier while creating brand new trust issues. We talk candidly about non-deterministic systems, why “AI will triage everything” keeps falling apart in practice, and how AI may be most useful when it helps glue together fragmented enterprise data the pain point SIEM tools have tried to solve for decades.We also shift to the human side of cybersecurity: neurodiversity in the workplace, why so many of us feel more at home in hacker spaces than in “normal” environments, and how strengths like hyperfocus can be a superpower only in the right context. We close with a grounded five-year outlook on AI economics, regulation, and what happens when today’s cheap access meets real-world business pressure.Subscribe for more conversations from the Security Rabbit Hole, share this episode with a friend, and leave a review so more defenders can find it.Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's pod is a conversation about AI and "Open-Weight Models", and if you aren't intimately familiar with what these are this is an episode for you. Wes has a lot of insight, and this is a discussion rather than an info dump.Guest: Wes WidnerDescriptionThe most disruptive AI feature might not be a new chatbot trick; it might be the ability to download the model and run it yourself. Recorded live at B-Sides Atlanta 2026, we sit down with Wes Widner, senior principal engineer at Cyber Haven and a veteran of McAfee threat intel and CrowdStrike, to unpack what open-weight models really are and why they’re changing the rules for security teams.We break down the practical side of local LLMs: model weights, quantization, laptop-friendly variants, and why the open model ecosystem on Hugging Face has become a real “model store.” Then we go straight into the uncomfortable part: if a model runs on your hardware, the guardrails are optional. Wes explains how “locks” and refusals get removed, why safety and alignment consume huge effort for frontier labs (not labs), and why trying to regulate distribution can backfire by driving unlocked models into underground channels.From there, the conversation turns into cybersecurity reality. AI doesn’t reliably understand context like “medical-critical” versus “normal” IoT, and reverse engineering firmware at home can look identical to reversing a sensitive system. Our takeaway is blunt: stop assuming the attacker is limited, and start designing detection, response, and secure engineering for a world where both sides have powerful AI copilots.YouTube: https://youtu.be/xGIjifjdjnMChannel: https://www.youtube.com/@DTSR_PodcastHave something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Phile has been penetration testing for a long time. The difference now is that he's having a much easier time with it thanks to AI. It's an interesting world, and he's here to explain the offensive side of it.Guest: Phil BrassDescriptionZero-days are not a once-in-a-career event anymore. From B-Sides Atlanta, we sit down with veteran penetration tester Phil Brass to unpack what happens when large language models make vulnerability research dramatically faster and cheaper, not just for defenders, but for attackers too.We get specific about where AI penetration testing actually moves the needle: LLM-assisted security research that can turn a normal two-week internal pen test into a hunt for brand-new bugs in the commercial software your environment depends on. Phil walks through the mindset shift from “scan the network and review configs” to “download the exact products the client runs and start looking for flaws,” including lessons learned from targeting VMware infrastructure and finding critical issues in vCenter, the control plane that can unlock everything downstream.That power comes with consequences. We talk responsible disclosure, vendor response, and the uncomfortable reality that patches can be reverse-engineered quickly, leading to real-world exploitation soon after fixes land. On the defense side, the guidance is refreshingly direct: tighten patch cycles, take threat intelligence seriously, and implement real micro-segmentation so one foothold does not expose every dependency on your network. We also dig into third-party risk management and why asking suppliers about LLM-assisted testing may become a new baseline.We close with the human side of AI in security: validating LLM output, dealing with hallucinations, avoiding intellectual laziness, and making judgment calls that protect production systems. If you found this useful, subscribe, share it with a teammate, and leave a review so more builders and defenders can find the show.Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Mehul joins Rafal live from BSides Atlanta to talk about how AI is changing how vulnerabilities are found and exploited at scale and cost. It's an interesting conversation about how much it costs to break into an organization's software stack.Video: https://youtu.be/kGajA9ipsp4GuestMehul RevankarDescriptionA disclosed vulnerability no longer needs weeks of hacker effort. When exploitation becomes an automated, agentic workflow measured in minutes and dollars of compute, the way we rank risk, plan patching, and measure security maturity has to change.Recorded live at B-Sides Atlanta, we sit down with Mehul Revankar, co-founder and chief product officer at Quantro Security (Contro.security), to unpack what “agentic AI offense” looks like in the real world. Mehul shares results from research on building and validating exploits at startling speed, why compute budget is becoming the true limiter, and how model escalation and exploit mutation loops turn yesterday’s “low priority” bugs into today’s fast-moving threats. We also pressure-test the comforting idea that you can simply patch your way out, and we ask what happens to common metrics like EPSS or “not exploited in the wild” when an AI agent only needs to succeed once.From there, we shift to defense. We talk about compensating controls that still matter, including web application firewalls, tighter firewall policies, and practical ways to reduce exploitation even when you cannot patch everything. We dig into attack surface reduction, the hard problem of legacy software, and why decommissioning old systems may become more realistic as AI lowers the cost of rebuilding. Finally, we explore what AI-native scanners and defensive agents could look like when they can reason on the fly rather than follow brittle, rules-based logic.If you’re thinking about vulnerability management, cyber risk management, AI security, and the future of cyber defense, this conversation will recalibrate your threat model. Subscribe, share this with your security team, and leave a review with the one metric you think still holds up in an agentic era.Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This episode is all about an essential skill few of us have mastered. How do you communicate value? What is it? And how do you make sure you're evaluating value in a way that makes sense to the person you're talking to? This is something that's essential to your career, your business, and your life, and Michael is a master of this art. Don't miss this one.Guest: Michael SantarcangeloDescriptionMost cybersecurity pros know the feeling: you ship real work, you reduce real risk, and the reaction is a polite nod and a budget cut. We sit down with returning guest Michael Tandarcangelo (aka Mr. Santa), who’s turned decades of “problems that don’t have names” into a clear philosophy at ValueSmith: delivering value in a world built to overlook it.We get concrete about what “value” actually means and why it so often gets misread inside security programs. If leaders see the cost on a spreadsheet but can’t see the benefit, the mental math turns negative fast and security becomes a cost center. We talk through better ways to frame work like PCI DSS and SOC 2, how to connect controls to outcomes people care about, and why value is a dialogue not a declaration.Then we go upstream to the real failure mode: solving the wrong problem perfectly. Michael shares a simple way to slow down just enough to ask smarter questions without looking “weak,” so you can align with the person who must recognize the result as valuable and make that value travel up the chain. We also dig into how market demand shifts over time, why certifications can be noisy signals, and why paying for outcomes beats paying for hours when you want great work.If you want clearer stakeholder communication, stronger budget conversations, and a better handle on your own career value, hit play and grab Michael’s free Value Delivery Check. Subscribe, share with a teammate, and leave us a review if this helps you change how you show impact.Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's podcast features Rafal & Anton discussing the hype and hysteria that surrounds today's AI headlines. Which side is right, which side is propaganda, and what's real? Listen and find out.GuestAnton ChuvakinDescriptionAI panic has officially gone mainstream, and we’re feeling it from every direction: “AI will kill us” on one end and “AI is useless hype” on the other. Rafal brings in Anton Chuvakin to filter the noise and ask a simpler question: what’s actually true when you strip away the social media fever dream?Anton shares why he’s genuinely torn between two models of reality. Some days, AI looks like a normal enterprise technology wave, complete with failed pilots, dirty data, and brittle implementations. Other days, the pace of improvement feels like an exponential curve, especially when you hear what thoughtful engineers inside major AI labs are seeing firsthand. We talk about why that insider perspective matters, how it clashes with “AI doesn’t work” skepticism, and why both the doomer and booster narratives can miss the point.Then we get practical. Even if AI capabilities grow fast, the physical world often doesn’t: batteries, robotics, infrastructure, clinical trials, and regulation impose time and physics constraints that no model can simply will away. We connect that to cybersecurity realities too: if you don’t have logs and telemetry, no AI agent can conjure evidence that was never collected. Finally, we tackle the quieter fear that hits close to home: overreliance. If GPS weakened navigation skills, what happens when AI becomes the default for writing, maths, and judgment?If you want a grounded take on AI safety, AI hype, and real-world limits, listen now, then subscribe, share the episode, and leave a review with your take: are we overreacting, underreacting, or arguing the wrong point?Video: https://youtube.com/live/v0pkpH1SgXIHave something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: This week's guest is Richard Bird, who has a new book coming out. He says, "Cybersecurity measures activity while its adversaries measure opportunity," and thirty years of spending has been priced against the wrong scoreboard. Great start, and you know it's going to get a little punchy.Guest:Richard BirdDescriptionCybersecurity spending has exploded for 30 years, and the scoreboard still looks brutal. We sit down with Richard to talk about his new book, “Built Wrong: Why Cybersecurity is Failing and How We Can Rebuild It,” and we don’t sugarcoat the core claim: defenders measure activity while adversaries measure opportunity, and our metrics push us toward more tools, more dashboards, and more noise instead of fewer breaches and smaller blast radii.We dig into why common security metrics behave like “measuring the weather” and how that creates a self-perpetuating cycle of reports, blinky lights, and ROI stories that don’t hold up in financial terms. Richard shares a blunt economic lens through his Hacker in a Hoodie framing, then we connect the dots to cyber insurance and how premium pricing can accidentally reward planned security purchases rather than proven loss reduction. If losses go up while premiums go down, something is broken in the measurement and incentive chain.From there we get practical: how do we justify investments like firewall upgrades without relying on vendor promises and buzzwords? We talk about using real evidence like the Verizon DBIR and OWASP Top 10, and Richard offers a simple way to organize security thinking and metrics into three buckets: exposure, interdiction, and consequence. We also push on the leadership problem: if “security is everyone’s job” but only the CISO gets penalized, accountability will always be uneven.If you care about cybersecurity metrics, cyber risk management, CISO leadership, and building a security program that speaks the CFO’s language, this conversation will challenge your defaults. Subscribe, share this with a security leader who’s tired of vanity metrics, and leave us a review with one measurement you think the industry needs to stop using.YouTube Video: https://youtu.be/sOdKjIibIKcHave something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast

TL;DR: Robert "RSnake" Hansen & Jeremiah Grossman join the pod to talk about the "Vuln-pocalypse", or rather, the lack thereof. We do some math, discuss whether it's worth patching vulnerabilities attackers don't exploit, and discuss a potential alternative to the madness of vuln management and patching we're all living with today.GuestsRobert "RSnake" HansenJeremiah GrossmanDescriptionThe “vulnerability apocalypse” makes great headlines, but our day-to-day reality is stranger: more scanners, more CVEs, more urgency, and still the same breaches. We sit down with Jeremiah Grossman and Robert Hansen from Root Evidence to ask a blunt question most security teams avoid saying out loud: if the overwhelming majority of known vulnerabilities are never exploited, why are we treating every patch like a debt we must repay at any cost?We dig into where vulnerability management went off the rails. CVSS scores and severity tiers often turn into a kind of black magic, especially at enterprise scale where “patch everything” can be operationally impossible and sometimes actively dangerous. We share real-world patching fallout, talk about why prioritizing millions of findings is like turning the Titanic with a teaspoon, and outline what “reasonable” can look like when you stop optimizing for perfect dashboards and start optimizing for outcomes.The turning point is data. Cyber insurance carriers and DFIR teams perform root cause analysis on real claims, and that actuarial view shows which remotely exploitable vulnerabilities actually drive financial loss. We talk about focusing on known exploited vulnerabilities, why a relatively small list of CVEs can matter more than thousands of “critical” alerts, and how controls like MDR, canary tokens, and segmentation help prevent exploitation from becoming a business-ending event.We also pressure-test the AI panic. According to multiple carriers, AI-attributed losses are effectively zero when you exclude phishing, raising an uncomfortable thought: are we funding fear instead of risk reduction? If you want a more evidence-based approach to patch management, cyber risk, and cybersecurity ROI, hit play, subscribe, and share the episode, then leave us a review with the one change you’d make to how your team prioritizes vulnerabilities.YouTube Video: https://youtube.com/live/wC1v8Vg7qr4Have something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast