Guest:

• Craig H. Rowland, Founder and CEO, Sandfly Security

Topics:

• When it comes to Linux environments – spanning on-prem, cloud, and even–gasp–hybrid setups – where are you seeing the most significant blind spots for security teams today?
• There's sometimes a perception that Linux is inherently more secure or less of a malware target than Windows. Could you break down some of the fundamental differences in how malware behaves on Linux versus Windows, and why that matters for defenders in the cloud?
• 'Living off the Land' isn't a new concept, but on Linux, it feels like attackers have a particularly rich set of native tools at their disposal. What are some of the more subtly abused but legitimate Linux utilities you're seeing weaponized in cloud attacks, and how does that complicate detection?
• When you weigh agent-based versus agentless monitoring in cloud and containerized Linux environments, what are the operational trade-offs and outcome trade-offs security teams really need to consider?
• SSH keys are the de facto keys to the kingdom in many Linux environments. Beyond just 'use strong passphrases,' what are the critical, often overlooked, risks associated with SSH key management, credential theft, and subsequent lateral movement that you see plaguing organizations, especially at scale in the cloud?
• What are the biggest operational hurdles teams face when trying to conduct incident response effectively and rapidly across such a distributed Linux environment, and what's key to overcoming them?

Resources:

• EP194 Deep Dive into ADR - Application Detection and Response
• EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines

Guest:

• Dominik Swierad, Senior PM D&R AI and Sec-Gemini

Topics:

• When introducing AI agents to security teams at Google, what was your initial strategy to build trust and overcome the natural skepticism? Can you walk us through the very first conversations and the key concerns that were raised?
• With a vast array of applications, how did you identify and prioritize the initial use cases for AI agents within Google's enterprise security?
• What specific criteria made a use case a good candidate for early evaluation? Were there any surprising 'no-go' areas you discovered?"
• Beyond simple efficiency gains, what were the key metrics and qualitative feedback mechanisms you used to evaluate the success of the initial AI agent deployments?
• What were the most significant hurdles you faced in transitioning from successful pilots to broader adoption of AI agents?
• How do you manage the inherent risks of autonomous agents, such as potential for errors or adversarial manipulation, within a live and critical environment like Google's?
• How has the introduction of AI agents changed the day-to-day responsibilities and skill requirements for Google's security engineers?
• From your unique vantage point of deploying defensive AI agents, what are your biggest concerns about how threat actors will inevitably leverage similar technologies?

Resources:

• EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP224 Protecting the Learning Machines: From AI Agents to Provenance in MLSecOps
• EP227 AI-Native MDR: Betting on the Future of Security Operations?
• EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil

Guest:

• Kim Albarella, Global Head of Security, TikTok

Questions:

• Security is part of your DNA. In your day to day at TikTok, what are some tips you’d share with users about staying safe online?
• Many regulations were written with older technologies in mind. How do you bridge the gap between these legacy requirements and the realities of a modern, microservices-based tech stack like TikTok's, ensuring both compliance and agility?
• You have a background in compliance and risk management. How do you approach demonstrating the effectiveness of security controls, not just their existence, especially given the rapid pace of change in both technology and regulations?
• TikTok operates on a global scale, facing a complex web of varying regulations and user expectations. How do you balance the need for localized compliance with the desire for a consistent global security posture? How do you avoid creating a fragmented and overly complex system, and what role does automation play in this balancing act?
• What strategies and metrics do you use to ensure auditability and provide confidence to stakeholders?
• We understand you've used TikTok videos for security training. Can you elaborate on how you've fostered a strong security culture internally, especially in such a dynamic environment?
• What is in your TikTok feed?

Resources:

• Kim on TikTok @securishe and TikTopTips
• EP214 Reconciling the Impossible: Engineering Cloud Systems for Diverging Regulations
• EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud
• EP14 Making Compliance Cloud-native