エピソード

  • The messy middle of AI-powered bug disclosure

    The messy middle of AI-powered bug disclosure
    2026/10/15
    AI is making vulnerabilities easier to find, but who’s going to fix them? On this episode, Greg Otto talks with Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure about the growing flood of AI-generated security reports. Bressers explains why those findings are increasingly legitimate, how VulnCheck uses AI to streamline incoming reports, and why coordinating fixes still requires a human touch. They also explore the pressure on open-source maintainers, the risks of AI-generated patches, and the widening gap between the cost of discovering vulnerabilities and fixing them. The conversation turns to a fundamental question: What would it take to fund and maintain open-source software like the essential infrastructure it is?
    続きを読む 一部表示
    33 分
  • Which nation-sate should worry us most

    Which nation-sate should worry us most
    2026/10/08
    What has changed in the cyber threat landscape—and what should defenders do about it? On this episode of Safe Mode, CyberScoop’s Greg Otto speaks with retired U.S. Air Force Lt. Gen. Robert Skinner, former director of DISA and current chairman of Axonius Federal Systems’ board. Skinner assesses the risks posed by China, Russia, Iran and North Korea, arguing that adversaries are increasingly prepositioning in critical infrastructure for potential disruption at a time of their choosing. He explains why China remains the top strategic cyber threat, how AI is shifting the advantage between offense and defense, and why visibility, context and continuous validation are central to protecting both IT and operational technology environments. They also discuss the security of telecommunications and water systems, supply-chain risk, botnet disruptions, Zero Trust as a continuous-improvement journey, and why cybersecurity must become inseparable from military operations.
    続きを読む 一部表示
    37 分
  • What AI alignment means for cybersecurity

    What AI alignment means for cybersecurity
    2026/10/01
    The debate over AI alignment often centers on guardrails, model behavior, and whether increasingly capable systems could act in unexpected ways. But what does that conversation look like through a cybersecurity lens? In this episode of Safe Mode, Greg speaks with Adam Meyers, CrowdStrike’s head of counter-adversary operations, about the security implications of goal-driven AI agents, open-weight models, and guardrails that can be removed or bypassed. Meyers argues that systems described as “rogue” may instead be pursuing their assigned objectives in ways their operators failed to anticipate—making containment, monitoring, and clearly defined permissions central cybersecurity concerns. The conversation examines how AI-enabled adversaries are accelerating operations, why open-weight models complicate alignment and safety debates, and how defenders can use AI to keep pace with faster exploitation and shrinking patch windows. Meyers also shares what CISOs and policymakers should focus on: visibility into how AI is being used, controls over what agents can access, and practical safeguards that match the technology’s real-world risks.
    続きを読む 一部表示
    33 分
  • Jailbreaks, sandboxes, and the limits of AI safeguards

    Jailbreaks, sandboxes, and the limits of AI safeguards
    2026/09/24
    Matt Fredrikson, associate professor at Carnegie Mellon and CEO and co-founder of Gray Swan AI, built the world's largest AI red teaming arena, with more than 15,000 people breaking AI systems for prize money. He walks us through how the attacks actually work, from jailbreaks found on small open weights models that transferred straight to frontier systems, to training AI attackers with reinforcement learning. Matt also explains why the recent sandbox escapes didn't happen during safety testing but during cybersecurity capability evals with the guardrails off, what the Agent Harm benchmark revealed about models that refuse harmful requests in text but comply once handed tools, and why the bare minimum of best practices has changed whenever a capable model runs on your infrastructure. In our reporter chat, Greg talks with Matt Kapko about the ShinyHunters-FBI hack.
    続きを読む 一部表示
    38 分
  • ClickFix and the social engineering of routine

    ClickFix and the social engineering of routine
    2026/09/17
    It starts with a fake error message. It ends with a pasted command. ClickFix has become one of the most reliable ways for attackers to get an initial foothold — first adopted by criminal groups, now used by state-linked actors like APT28 and Lazarus Group. This week, Greg is joined by John Hammond, Principal Security Researcher at Huntress, who helped identify and name the technique and has tracked its evolution for the past three years. They dig into why ClickFix still drives an estimated 20+ incidents a day at Huntress even after law enforcement disrupted major infostealer infrastructure like LumaStealer, how the technique has splintered into variants like FileFix and "consent fix" targeting Microsoft 365 and browser-stored credentials, and how attackers are now smuggling payloads inside images to slip past endpoint defenses. John walks through a real incident where a single pasted command led to 11 compromised devices, explains why he still believes security awareness training — not just tooling — is the best defense, and makes the case that the browser itself has become the blurriest and most under-protected boundary between endpoint and identity security. The conversation also turns to the npm/Axios supply chain attacks, where operators built fake Slack communities and fabricated employee personas to earn open-source maintainers' trust before compromising their packages — and what, if anything, can technically guard against a threat that's fundamentally social. In our reporter chat, Greg talks with Derek Johnson about the Supreme Court deciding against the Trump administration’s push for changes to mail-in ballots. Follow John on Youtube: https://www.youtube.com/@_JohnHammond
    続きを読む 一部表示
    36 分
  • Defending in the middle of the vulnpocalypse

    Defending in the middle of the vulnpocalypse
    2026/09/03
    CyberScoop editor-in-chief Greg Otto talks with WatchTowr founder and CEO Ben Harris about how cybersecurity teams are adapting as AI accelerates vulnerability discovery, public proof-of-concepts, and exploitation timelines. They discuss the WordPress-to-shell case study, why mitigation has become essential when patching cannot happen instantly, and why Harris argues that traditional vulnerability management is “effectively dead.” Also in this episode, senior reporter Tim Starks explains Project Watershed 250, a new effort involving Texas, the private sector, and the water industry to strengthen critical-infrastructure cybersecurity.
    続きを読む 一部表示
    31 分
  • The Vulnpocalypse arrived early

    The Vulnpocalypse arrived early
    2026/08/27
    NEA partner Aaron Jacobson put $250 million behind autonomous pen testing company Horizon3.ai on the bet that cybersecurity has entered an AI-versus-AI era — and he argues the "vulnpocalypse" defenders were warned about has already arrived, with AI-discovered vulnerabilities now the primary way attackers get into enterprises. He explains why overprovisioned AI agents are the new phishing target, since an agent with a user's credentials and no common sense can be prompt-injected into exfiltrating data a human would never touch. Jacobson also separates the open weights debate from the open source one, makes the case that cheap open competition ultimately favors defenders, and closes with the thing he got most wrong 18 months ago. In our reporter segment, Greg talks with Matt Kapko about the cybersecurity implications of the GTA VI leaks.
    続きを読む 一部表示
    35 分
  • Rethinking how federal cyber hiring actually works

    Rethinking how federal cyber hiring actually works
    2026/08/20
    The federal government can't reliably say how many cybersecurity workers it has or what they cost — and that uncertainty sits at the heart of a much bigger question: is federal cyber training working, and can it keep pace with a field that's changing by the month? On this episode of Safe Mode, host Greg Otto talks with Christopher Bloor, Defense Director at the SANS Institute, about the state of the federal cyber workforce. The conversation moves through the real gap agencies face between filling job openings and actually assessing the skills their people already have, what 1,100 National Guard members revealed about morale and readiness during the CyberGuard critical infrastructure exercise, and why certifications and "qualifications" get treated as interchangeable when they shouldn't be. They also dig into some of the harder tensions in the space: whether federal training amounts to an unintentional subsidy for private-sector salaries, since the government will never be able to out-pay industry; how much of the workforce shortage is actually a skills problem versus a security-clearance bottleneck; and how AI has already flipped the day-to-day workflow for defenders, from checking AI-assisted code a year ago to now checking code AI has written itself. In this week's reporter chat, Greg talks with Tim Starks about the future of CORCA, a bill designated to fight organized retail crime that privacy experts say would create new mass surveillance capabilities for DHS.
    続きを読む 一部表示
    33 分