Coffee, Chaos and ProdSec

Cameron Walters and Kurt Hendle

Coffee, Chaos & ProdSec is where cybersecurity meets caffeine-fueled chaos. Hosts Kurt (security architect and chaos tamer) and Cameron (ProdSec wrangler and DevSecOps junkie) dive into hacking, AppSec, supply chain failures, AI surprises, and the everyday madness of defending modern systems. With humor, sharp insight, real breach breakdowns, bad password confessions, and a few questionable impressions, they explore the messy reality of security and how teams survive it. New episodes Every Wednesday at 5 AM Eastern.

  1. 1D AGO

    Ep 38 - Governance Without Enforcement Is Theater and Shadow AI Knows It

    🎙️ Coffee, Chaos and ProdSec, Ep 38 Your org told everyone to use AI. The budget ran out. Someone found a better free tool. Boom, shadow AI just happened. This week Cameron and Kurt record on four hours of sleep fresh off two days in Austin talking AI and identity with practitioners, and somehow that makes this episode better. They get into where shadow AI actually lives across the corporate surface and the SDLC, what you can detect today with EDR, SIEM, SASE, and a GitHub search bar, and where current detection completely falls apart. From AISPM getting called out as a category that overpromises, to live threat modeling on how a developer could run a local model cluster at home and stay invisible to every control your team has, to why governance without enforcement is just theater with better fonts, this one is honest about what security teams can and cannot see right now. If you work in AppSec, DevSecOps, or Security Architecture and have ever written an AI acceptable use policy without knowing what AI your org actually uses, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 1m

  2. MAY 13

    Ep 37 - Scattered Spider Called Your Help Desk and Your TPRM Annual Review Missed It

    🎙️ Coffee, Chaos and ProdSec, Ep 37 Your vendor filled out the questionnaire. They have a SOC 2. And they just got you popped. This week Cameron and Kurt get into the third-party risk management conversation that the industry keeps avoiding. Not the checkbox version, the one where Scattered Spider is social engineering your managed service provider's help desk and you're finding out about it from a news alert. They cover why SOC 2 is a report and not a certification, why vendor management and TPRM are two completely different functions that most companies let collapse into one spreadsheet, why open source dependencies are third-party risk that nobody owns, and what continuous monitoring actually looks like when you stop pretending an annual audit is a security control. Plus the Delve incident, goblins in AI training data, and Kurt reading the scope statement while Cameron does the actual research. If you work in Product Security, Application Security, DevSecOps, or GRC and you have ever accepted a SOC 2 Type 1 as proof that someone takes security seriously, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    57 min

  3. MAY 6

    Ep 36 - Stop Blaming Mythos - The Defender Playbook Was Already Overdue

    🎙️ Coffee, Chaos and ProdSec, Ep 36 Your risk model is lying to you. Not maliciously. Just quietly, using assumptions that stopped being accurate before Mythos ever made the news. This week Cameron and Kurt get into the part nobody wants to say out loud: the AI threat acceleration has been building for over a year and most Application Security and Product Security programs are still running the old playbook. Pipelines shipping code faster than anyone's reviewing it, agents deployed like they're Slack bots, CVE feeds that can't keep pace with what AI is finding, and security teams absorbing a workload that was never designed for this environment. From VulnOps as a permanent function to the 10 questions that tell you whether your program can actually execute, to burnout as a real operational risk and not an HR checkbox, this one is built for the practitioner who needs actions not another threat briefing. If you're in DevSecOps, Cybersecurity, or Security Architecture and your Monday morning plan is still "check the queue," this episode is the intervention. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 2m

  4. APR 29

    Ep 35 - Mythos, the AI Exploit Printer, and Whether Security Is Actually Cooked ft. Caroline Wong

    🎙️ Coffee, Chaos and ProdSec, Ep 35 Anthropic dropped Mythos. 250 CISOs argued in a live document over a weekend. A crisis paper shipped Monday morning. And everyone's board started calling. This week Cameron, Kurt, and Caroline Wong get into what Mythos actually did differently from every model before it, whether Project Glasswing is coordinated disclosure or the most expensive press release in security history, and why the tsunami of vulnerabilities coming out of it is going to expose every program that's been doing vulnerability management wrong for a decade. They also get into the third identity class nobody is governing yet, whether risk prioritization even makes sense when AI can chain your deprioritized findings into a critical, and what the curl project quietly proved about where AI security capability actually is right now. If you work in Cybersecurity, Application Security, Product Security, or DevSecOps and the Mythos noise has made it hard to figure out what's real, this one cuts through it. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1 hr

  5. APR 22

    Ep 34 - SPVS 1.5 Is Live: AI Pipeline Security Controls ft. Farshad Abasi

    🎙️ Coffee, Chaos and ProdSec, Ep 34 AI is already in your pipeline. Your agents are making decisions. And most teams have no controls governing any of it. This week Cameron, Kurt, and returning guest Farshad Abasi crack open SPVS 1.5, the OWASP Secure Pipeline Verification Standard community feedback release that ships 132 AI and agentic pipeline security controls across 31 subcategories. From NHI governance for AI agents to AIBOM requirements, deterministic tool authorization, prompt injection classification, and adversarial testing as a hard release gate, this episode covers what the standard actually says and why building it made the gap impossible to ignore. If you work in Application Security, DevSecOps, or Product Security and you have ever approved an AI tool for your pipeline without a governance framework to back it up, this one is going to hit. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    58 min

  6. APR 15

    Ep 33 - Six OWASP AI Top 10s, Sixty Risks, Two Practitioners, One Consolidated List

    🎙️ Coffee, Chaos and ProdSec, Ep 33 OWASP published six AI security Top 10s in roughly two years. Six. That is not a framework strategy, that is a distress signal. This week Kurt and Cameron tear through all of them. LLM security, agentic applications, MCP, agentic skills, machine learning security, and the honorary sixth because AI agents have an identity problem and NHIs deserve a seat at the table. Sixty risks, one episode, zero padding. Then both hosts reveal the independent AI Top 10 lists they each built before recording and compare them live. There is overlap, there is disagreement, and there is a real conversation about whether all six frameworks can collapse into one model before the compliance world does it for us. If you work in Cybersecurity, Application Security, Product Security, DevSecOps, or Security Architecture and you have ever cited an OWASP framework in a deck without operationalizing a single control from it, this one lands differently. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 7m

  7. APR 8

    Ep 32 - Password Resets, Dev Laptop Secrets, and the NHI Mess Nobody Wants to Own

    🎙️ Coffee, Chaos and ProdSec, Ep 32 Your org is still forcing 90-day password resets. NIST said stop years ago. Nobody wants to be the one who changes it. This week Cameron and Kurt get into three trust assumptions enterprise security programs are still running on in 2026 that nobody actually validated. Mandatory rotation that creates predictable mutations instead of stronger passwords, developer laptops loaded with production credentials that agentic coding tools now inherit without anyone scoping that access, and non-human identities that most teams can't inventory let alone govern when something goes wrong. From the compliance inertia keeping dead controls alive, to the blast radius sitting on every developer machine in your environment, to whether NHI taxonomy is a useful governance framework or just a cleaner slide deck, this one covers the full mess with zero comfort and zero vendor sympathy. If you work in Product Security, Application Security, DevSecOps, or Cybersecurity and you have ever enforced a control you stopped believing in because nobody wanted to own killing it, this episode will hit close to home. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 2m

  8. APR 1

    Ep 31 - OSS Malware, TeamPCP, and the Supply Chain Is Not a Solved Problem ft. Jenn Gile

    🎙️ Coffee, Chaos and ProdSec, Ep 31 Open source malware is not a harder version of CVE management. It is a completely different problem, and most orgs are running the wrong playbook. This week Cameron and Kurt are joined by Jenn Gile, co-founder of OpenSourceMalware.com and advisor at Endor Labs, and she comes prepared to take everyone to school. They dig into how attacks like TeamPCP actually work, why your scanner is not built to catch them, and what detection looks like across the full pipeline. From install-time execution to account takeovers to the dependencies nobody vetted, the attack surface is bigger than most teams have mapped. Then they get into what a real defense program looks like, and why owning a tool is not the same as owning the problem. Spoiler: the supply chain is not a solved problem, and this episode makes that very clear. If you work in Application Security, Product Security, DevSecOps, or Software Supply Chain Security, this one is going to hurt a little. In the best way. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 9m
See All (39)

Trailer

About

Coffee, Chaos & ProdSec is where cybersecurity meets caffeine-fueled chaos. Hosts Kurt (security architect and chaos tamer) and Cameron (ProdSec wrangler and DevSecOps junkie) dive into hacking, AppSec, supply chain failures, AI surprises, and the everyday madness of defending modern systems. With humor, sharp insight, real breach breakdowns, bad password confessions, and a few questionable impressions, they explore the messy reality of security and how teams survive it. New episodes Every Wednesday at 5 AM Eastern.

Information

  • Creator
    Cameron Walters and Kurt Hendle
  • Years Active
    2025 - 2026
  • Episodes
    39
  • Rating
    Clean
  • Copyright
    © Cameron Walters and Kurt Hendle
  • Show Website
    Coffee, Chaos and ProdSec

You Might Also Like