Trailer: Responsible Disclosure Podcast

On this episode of Responsible Disclosure, we sit down with our own Sanaz Yashar, Co Founder and CEO of Zafran. Sanaz spent 15 years in intelligence and later led investigations at Mandiant before founding Zafran with Ben, the colleague who knocked on her door with the idea. We get into the Mandiant investigation that led to Zafran: a ransomware attack on a chain of hospitals where the attacker wiped the backups two months before deploying, came in through an SSL VPN vulnerability, and left a trail across security tools that never talked to each other. Sanaz explains why the industry is missing a defensive coordinator, how one of Zafran’s largest customers justified the purchase against hiring 14 subject matter experts, and the 74% MTTR reduction Zafran customers see. We also cover why agentic remediation will arrive in evolutionary steps across culture, trust, and technology, what to do when a patch would break a critical system, and what consolidation looks like when it stays vendor agnostic. Plus: how a chemistry student found her way into cyber, and a Furious Five round that ends on big dogs and plastic cups. 00:00 Intro 00:42 Growing up in Tehran 06:13 How Sanaz found her way into cyber 11:43 Women in cybersecurity 15:06 What practitioners were missing 17:09 The hospital ransomware case 22:16 The idea that became Zafran 25:21 Making the budget case 28:06 Consolidation and autonomous remediation 31:39 Will AI end vulnerabilities? 32:33 What agentic remediation really means 36:36 The self healing platform 39:27 Mitigate first, remediate in phases 40:53 Rethinking consolidation 41:39 The source of truth problem 42:32 Furious Five 46:01 Outro Follow Us: Responsible Disclosure on X: https://x.com/Zafran_io Responsible Disclosure on LinkedIn: https://www.linkedin.com/company/zafran-security Responsible Disclosure on Instagram: https://www.instagram.com/responsible.disclosure/ Follow Nate on LinkedIn: https://www.linkedin.com/in/nathan-rollings-02b65b43/ Follow Steve on LinkedIn: https://www.linkedin.com/in/wscobb/ Follow Steve on X: https://x.com/Prot3ctD3f3nd Follow Sanaz Yashar: https://www.linkedin.com/in/sanaz-yashar/ Zafran: https://www.zafran.io

On this episode of Responsible Disclosure, we sit down with Doppel Co Founder and CEO Kevin Tian to talk about how AI changed social engineering, from meeting his Co Founder Rahul on day one at Uber to starting Doppel after an early look at ChatGPT in 2022.We get into how groups like Scattered Spider and ShinyHunters target help desks with look alike domains, why fake LinkedIn personas are entering hiring pipelines, and why Doppel’s deepfake agents keep help desk staff on the phone for an average of nine minutes. We also talk about when security awareness training changes behavior, why takedowns now span domains, social media, paid ads, phone numbers, and GEO poisoning in LLMs, and why Doppel calls its work social engineering defense instead of brand reputation management. Plus: the fake LinkedIn profile that spent weeks emailing a payroll team, and whether AI is a bigger gift to attackers or defenders.Chapters: 00:00 Intro 01:12 Origin Story: From Uber to Doppel 02:42 From Crypto Fraud to Cybersecurity 03:41 The State of Social Engineering in the AI Era 05:40 Who Owns Brand Reputation? 07:24 Creating the Social Engineering Defense Category 08:48 Deepfake Agents and the Nine Minute Call 12:16 Does Security Awareness Training Change Behavior? 14:30 Vishing and Smishing 15:29 Multichannel Takedowns and GEO Poisoning 16:53 Why Attackers Build Fake LinkedIn Profiles 20:32 How CISOs Can Cut Through AI Hype 21:30 Furious FiveFollow Kevin Tian: https://www.linkedin.com/in/ktian00/Learn more about Doppel: https://www.doppel.com/ Follow Responsible Disclosure on LinkedIn: https://www.linkedin.com/company/zafran-security Follow Responsible Disclosure on X: https://x.com/Zafran_ioHosted by Nathan Rollings and Steve Cobb Produced by Bigfable

On this episode of Responsible Disclosure, we sit down with Schellman CEO Avani Desai to talk about 25 years in cybersecurity audit, from her start as a pen tester to leading one of the largest specialized assessment firms for cybersecurity, privacy, and sustainability, and why compliance should be a byproduct of real security. We get into Schellman research showing 74% of companies believe they can pass an AI assessment while about 27% have the controls in place, what the rise of fast, low cost SOC 2 reports means for the trust behind them, the red flags to listen for when choosing an auditor, and why continuous auditing is finally within reach after decades as a pipe dream. We also talk about how vulnerability management became a check the box control, why fear drives more behavior change than incentives, and how the US data economy produces trillion dollar companies. Plus: the story of how Avani got here, and the hyped term she says nobody can define. Chapters: 00:00 Intro 00:36 Origin Story: From India to the American Dream 02:48 From Pen Tester to the Big Four 04:28 What Schellman Does 05:32 AI Governance: 74% Think They'll Pass, 27% Can 06:57 Compliance Is a Byproduct of Security 07:56 Is SOC 2 Still a Valid Exam? 10:06 Red Flags When Hiring a SOC 2 Auditor 12:16 How Commoditization Hurts Good Firms 14:26 The Question Nobody Asks: Auditor Competency 14:46 Continuous Auditing Is Finally Real 17:52 Vulnerability Management Beyond Check the Box 19:27 Can Regulation Fix Security? 20:26 Why Fear Is the #1 Motivator 21:56 Why Trillion Dollar Companies Are American 22:50 Furious Five 24:46 Will a Human Still Sit in the CISO Seat? Watch the full episode on YouTube: youtu.be/59ISaaZNgeU Follow Us: ⚬ Responsible Disclosure on X: https://x.com/Zafran_io ⚬ Responsible Disclosure on LinkedIn: https://www.linkedin.com/company/zafran-security ⚬ Follow Nate on LinkedIn: https://www.linkedin.com/in/nathan-rollings-02b65b43/ ⚬ Follow Steve on LinkedIn: https://www.linkedin.com/in/wscobb/ ⚬ Follow Steve on X: https://x.com/Prot3ctD3f3nd ⚬ Follow Avani Desai: https://www.linkedin.com/in/avani-d-596366/ ⚬ Schellman: https://www.schellman.com/ Produced by Bigfable

In this episode of Responsible Disclosure, Cytactic Founder and CEO Dr. Nimrod Kozlovski sits down to unpack two decades at the intersection of cyber law, venture capital, and crisis management, and what AI is changing for the security leaders who have to respond when a breach hits. Nimrod shares stories from inside the room, including a homeland security company whose source code was stolen, a crypto wallet takeover, and a hospital ransomware attack that left staff unsure they could trust patient records.

In this episode of Responsible Disclosure, legendary investor and Sequoia Capital Partner Doug Leone sits down to unpack over three decades of venture capital investing, building category-defining enterprise giants, and identifying world-class startup founders. From arriving in the U.S. at age 11 without speaking English to helping scale Sequoia Capital into a global powerhouse, Doug shares rare insider stories—including how he blocked a $2.5B buyout of ServiceNow to help it reach a peak $180B valuation, why Israeli cybersecurity startups (Wiz, Cyera, Island) revolutionized the enterprise market, and the exact psychological drive he looks for in outlier founders. He also breaks down where enterprise value will accrue in the AI stack, why he fears robotics more than AI software, and the one investment regret that still bugs him today.

In cyber, the truth usually waits for the mics to come off. This week, we're launching Responsible Disclosure: a podcast putting the business of cyber on the record. Hosts Nate Rollings (Zafran CISO) and Steve Cobb (Field CISO) sit down with founders, CEOs, CISOs, and investors to talk through how they really built what they built, separating what's real from the noise.