『The Security Strategist』のカバーアート

The Security Strategist

The Security Strategist

著者： EM360Tech
無料で聴く

【Amazonプライム会員限定】今ならプレミアムプランが4か月 月額99円。

10月19日まで。※適用条件あり
With cyber attacks more common than ever before and each attack becoming increasingly sophisticated, security teams need to be one step ahead of cybercrime at all times. “The Security Strategist” podcast delves into the depths of the cybercriminal underworld, revealing practical strategies to keep you one step ahead. We dissect the latest trends and threats in cybersecurity, providing insights and expect-backed solutions to protect your organisation effectively. Tune into this cybersecurity podcast as we dissect major threats, explore emerging trends, and share proven prevention strategies to fortify your defences.Copyright 2026 EM360Tech 政治・政府 経済学
エピソード
  • Does Behavioural Detection Work Against AI Agent API Traffic?

    Does Behavioural Detection Work Against AI Agent API Traffic?
    2026/10/15

    Imagine a customer logged in to your online portal. Their token is valid, and so is their session. Then one number at the end of an API call changes, and the response comes back with a different customer's account. The WAF sees a well-formed request from an authenticated user. The schema check passes. Nothing in the log says attack.

    That is an abuse of business logic; cybersecurity analyst Jonathan Care refers to it as a series of "perfectly valid calls in a sequence you never anticipated, doing something you never intended."

    In this episode of The Security Strategist podcast, Jonathan Care, lead analyst at KuppingerCole, sat down with Uri Dorot, Senior Product Marketing Manager at Radware, to talk about possibilities and impossibilities of API tooling, how detection can tell the difference between an attacker and an unusual customer, and the steps a CISO can take when working with a limited budget.

    Also Watch: Can Runtime Security Keep Autonomous AI Under Control?

    Key Takeaways
    • Majority of enterprises fail to detect more than 90% of their APIs.
    • Developers are familiar with Shadow APIs, whereas zombie APIs are not.
    • Endpoint tools can be located cheaply via AI tools and crawlers.
    • Attacks based on business logic make use of valid calls; schema checks can’t detect them.
    • Business logic attacks use valid calls, so schema checks miss them.
    • Response inspection catches reused tokens and PII leaving.
    • Identity alone is insufficient; behaviour and context also matter.
    • A gateway does not replace an API security platform.
    • Every discovered API needs a named owner.

    Chapters
    • 00:01 Business logic abuse and the 90% figure
    • 05:34 Shadow, zombie and deprecated APIs
    • 11:18 Telling abuse from legitimate use
    • 22:20 AI agents and behavioural detection
    • 42:35 Budget and ownership

    Connect with Jonathan Care on LinkedIn

    Connect with Uri Dorot on LinkedIn

    Explore more episodes on The Security Strategist podcast

    #APISecurity #Cybersecurity #Radware #TechPodcast #CloudSecurity #Infosec #ArtificialIntelligence #businesslogic #APIGateway #AITraffic #AIBotTraffic #GuardrailsforAI

    続きを読む 一部表示
    38 分
  • What Are Self-Improving AI Agents? Ask OpenAI’s Rogue Agent

    What Are Self-Improving AI Agents? Ask OpenAI’s Rogue Agent
    2026/09/30

    In the recent episode of The Security Strategist podcast, host Shubhangi Dua, podcast host and producer at EM360Tech, sits down with Chenxi Wang, Managing General Partner at Rain Capital, a cybersecurity veteran of more than two decades, a Fortune 500 board member and a VentureBeat Women in AI Award winner. They talk about self-improving AI agents (SIA) and their more advanced cousin, recursive self-improving agents (RSIA), from what they are, why they're suddenly dominating research conferences, and why most enterprises, especially regulated ones, aren't remotely ready to run them without a human in the loop.

    Key Takeaways
    • RSIA updates the mechanism that improves the agent, not just the agent
    • Sandbox "no" feedback pushes agents toward workarounds, not compliance
    • Governance depends on evidence chains and observability, not approval gates
    • Self-improving agents haven't reached production at scale
    • Regulated industries aren't ready for zero-human-in-the-loop agents
    • C-suites should focus on adoption pressure and provable policy enforcement

    Chapters

    00:00 Introduction to Self-Improving AI Agents and Security Risks

    02:30 What Are Self-Improving AI Agents and Their Current State

    05:15 Challenges and Risks of Recursive Self-Improving AI

    08:38 Real-World Use Cases and Deployment in Enterprises

    11:08 Security and Governance Challenges of Autonomous AI

    15:50 Case Study: Hugging Face Cyber Attack and AI Behavior

    21:25 Future Outlook and Risks of Self-Improving AI in Business

    22:12 Key Takeaways for C-Suite Leaders
    続きを読む 一部表示
    24 分
  • Rethinking Zero Trust: How AI Reshapes Data Security

    Rethinking Zero Trust: How AI Reshapes Data Security
    2026/09/28
    What happens when the walls of your organisation can no longer keep your data safe? AI, remote work, and fast-moving data are changing how organisations operate, and the traditional perimeter model is becoming harder to maintain. In this episode of the Security Strategist Podcast, host Chris Steffen sits down with Dr Bill Anderson of Mattermost and JP Ayyappan, Director of Product Management at Virtru, to explore why the future of security isn't about stronger walls. It's about protecting the data itself.Zero Trust Beyond the NetworkAnderson, who trained as a cryptographer, says this blind spot has been around for decades. Organisations built networks like fortresses, assuming that anyone inside could be trusted. But that approach no longer reflects how people work. Employees use phones, home networks and third-party platforms every day, meaning the traditional security perimeter is no longer enough. Major breaches have shown how risky that assumption can be.This is where zero trust comes in. But Anderson argues that many organisations still apply it mainly to networks and devices, rather than to the data moving through them. Collaboration tools have made this gap even clearer. People are creating and sharing sensitive information every day through meetings, chats and shared documents, often without a way to identify and protect that data as soon as it is created.How AI Changes Data ClassificationThe conversation then turned to one of the biggest challenges facing security teams: AI can combine information in ways that are difficult to predict. Anderson described how a series of seemingly harmless questions about flight paths, weapons ranges, and timing could be combined by an AI system to produce sensitive information, even if no one set out to create it.Steffen gave a similar example. A simple first prompt can lead to a series of follow-up questions, with each response shaping the next. By the third or fourth exchange, the AI could produce highly sensitive information without a clear record of how it was created. This creates a problem for traditional data classification. Rules designed for static documents are harder to apply when information is generated and combined in real time.Ayyappan pointed out that AI can also help address this problem. It can be trained to classify and tag information as new context emerges, but only if organisations already have a clear and consistent tagging structure.Security That Protects the DataRather than relying on network access to determine who can be trusted, Virtru's approach applies permissions directly to the data through an open framework called the Trusted Data Format. Ayyappan explained that files can carry their own access rules, allowing organisations to control who can access them regardless of the network or device being used. This approach keeps protection with the data, even when a file is shared outside the organisation. It can also make it easier to give external partners or emergency teams access to specific information without giving them access to the wider network.AI Agents Need Access Controls TooBoth guests agreed that AI agents, integrations and plugins need to be treated as identities within an organisation's access control model. Anderson explained that Mattermost applies the same user, resource and action controls to AI agents as it does to people. This allows organisations to control what each AI system can access.Ayyappan added that two executives using the same AI agent and accessing the same data could receive different answers based on their individual permissions. This allows organisations to use AI without giving every user or system access to all available data. For security teams, both experts recommended starting with clear limits on which AI systems different groups can access. As organisations develop clearer classification rules, more of these controls can be automated.Ayyappan also stressed that data privacy and protection need to be considered from the start. Once sensitive information has been exposed through an AI workflow, fixing the problem afterwards may be too late. The shift towards AI means organisations need to rethink how they classify, protect and control data. Instead of relying only on network security, organisations need controls that stay with the data wherever it goes. Listen to the full episode and learn how Mattermost and Virtru are helping organisations take a data-first approach to security. Visit mattermost.com or virtru.com to learn more, and follow Dr Bill Anderson and JP Ayyappan on LinkedIn.TakeawaysRethinking zero trust by putting security closer to data.The role of AI in enhancing data security and decision support.Challenges of data classification and access control in AI environments.The concept of data self-description and attribute-based access control.Treating AI agents as quasi-human entities in security models.The importance of disciplined data tagging and classification.Risks of data ...
    続きを読む 一部表示
    32 分
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません