ZeroSum

Aaron Mog

ZeroSum is a new cybersecurity podcast that aims to talk honestly about the state of the cybersecurity industry. The show rejects standard "threat of the week" news breakdowns and instead focuses on the reality of the market. Viewing the industry through the lens of game theory, the podcast explores how the current cyber market is no longer a rising tide that lifts all boats; for massive VC gambles to win, the burnt-out practitioners on the ground are often the ones losing. The show features guests from all perspectives, including vendors, investors, workers, and CISOs.

  1. 1 day ago ·  Video

    Hackers Waited 40 Days to Pick Their Victims - with Jason Lancaster

    An attacker phished a government employee, took over the mailbox, and then did nothing for 40 days. SpyCloud Chief Investigations Officer Jason Lancaster on how that quiet turned out to be the attack: hundreds of victims, filtered down to the ones with access to money. Jason joins Aaron to talk about what AI is changing on both sides of cybercrime. They get into why patient, agent-driven campaigns are now worth running against small businesses, how stolen AI API keys and session tokens are fueling model distillation, why breached data may soon be worth more as training data than as ransom, why IT handed Jason a "useless" locked-down AI agent, and why an investigation agent has to explain every step and every negative finding. Plus the Agentic Intel Community, the peer network Jason founded for practitioners applying AI to threat intelligence. TIMESTAMPS 0:00 Cold Open 0:36 Welcome, Jason Lancaster 1:21 From defender to SpyCloud 3:40 Most excited in three decades 6:03 The defenders' data advantage 9:45 Red team models miss human motives 11:36 Encoding investigator intuition 16:08 Tokens aren't cheap 17:30 Is the vulnpocalypse real? 21:00 The Nigerian Prince got eloquent 21:51 Patient, agentic attackers 26:24 The 40-day dormant mailbox 29:37 Stolen tokens fuel AI distillation 32:20 Breached data as training data 36:23 Was AI built on theft? 38:55 Will AI labs report your breach? 41:15 Stolen AI keys on the forums 44:23 Personal AI assistants and work creds 49:45 Don't trust the magic eight ball 54:36 The Agentic Intel Community 59:51 Where to find Jason ABOUT JASON Jason Lancaster is Chief Investigations Officer at SpyCloud, where he has built the investigations capability since the company's early days, and founder of the Agentic Intel Community. He has spent about 27 years in cybersecurity, from defense and red teaming to building a research team at HP that profiled state and cybercrime actors. LinkedIn: https://www.linkedin.com/in/jasonlancaster/ Agentic Intel Community: https://agenticintel.community SpyCloud research: https://spycloud.com ABOUT ZEROSUM ZeroSum is a cybersecurity podcast for practitioners and leaders navigating AI, breaches, and the business of security, hosted by Aaron Mog. #cybersecurity #threatintelligence #cybercrime #AIsecurity #infostealers #SpyCloud #ZeroSum

  2. 19 Oct ·  Video

    Tenable’s Founder: You Can’t Vibe Code a Customer - with Ron Gula

    “You can’t vibe code a customer.” Ron Gula started as an NSA pentester, co-founded Tenable and grew it into the company behind Nessus. Today he invests in cybersecurity and AI startups through Gula Tech Adventures. He has a front-row seat to the AI gold rush in security, and he’s not buying all of it. We get into why AI may be blowing up entry-level jobs and entry-level companies alike, the hidden cost of “we’ll just build it ourselves,” who’s liable when your AI agent goes rogue, why phones are the weakest link in the enterprise, and why 2026 looks a lot like 1996. Ron also breaks down how he builds vRon, his AI alter ego that publishes a new video almost every day, and the five questions every founder should be able to answer. 🔗 Ron Gula on LinkedIn: https://www.linkedin.com/in/rongula/ 🔗 Gula Tech Adventures: https://www.gula.tech 🔗 Ron’s videos (and vRon): https://www.youtube.com/@GulaTechAdventures Chapters 0:00 Cold Open 0:51 Meet Ron Gula 1:59 How Ron feels about cyber right now 5:27 You can’t vibe code a customer 7:47 The hidden cost of “we’ll just build it” 10:37 Software margins and whether SaaS is cooked 15:53 Overfunded vs. underfunded in AI security 19:02 Who’s liable for your AI agent? 22:08 AI regulation and AI in the classroom 26:18 Why Ukraine may be the next Israel for startups 34:03 How a cyber startup breaks through the noise 39:50 Why nobody has automated risk yet 44:30 Your phone is the weakest link 45:50 How vRon gets made 56:00 Advice for founders and new cyber pros Subscribe to ZeroSum for conversations with the people building and breaking cybersecurity. #cybersecurity #AI #ZeroSum #startups #venturecapital

  3. 12 Oct ·  Video

    The Firewall CISO Era Is Over - wtih Gina Yacone

    Some CISOs "can't handle the fire that's coming." Advisory CISO Gina Yacone on why the leaders who came up guarding the firewall are running out of road, and what the job looks like now. Gina joins Aaron to trace how security leadership changed: from castle-and-moat network defense, to cloud and identity, to AI agents working inside the walls. They get into why compliance isn't governance, why budgets buy visibility but never remediation, how shadow AI turned employees into insiders, why board metrics only describe a sliver of the environment, and what resiliency means beyond backups. Plus Gina's advice for anyone who wants to lead security in the next era. TIMESTAMPS 0:00 Cold Open 1:09 Welcome, Gina Yacone 2:44 From castle-and-moat to cloud to AI 8:28 Compliance isn't governance 10:42 Visibility budgets, no remediation 12:30 Why would AI security be free? 13:55 Gina's AI advice for CISOs 18:18 Shadow AI and data loss 21:26 Developers were incentivized wrong 23:48 Mythos and exposure management 27:24 The short-tenure CISO problem 32:38 Why security metrics are flawed 36:32 Tokens as a metric 40:42 AI layoffs or bad bets? 44:16 How much trouble are we in? 49:48 Never waste a good crisis 51:43 Personal resiliency and cyber careers 58:08 Where to find Gina ABOUT GINA Gina Yacone is an advisory CISO at Trace3, Vice President of ISSA Denver, a Rotarian, and a frequent keynote speaker. Follow her on LinkedIn: https://www.linkedin.com/in/ginayacone/ ABOUT ZEROSUM ZeroSum is a cybersecurity podcast for practitioners and leaders navigating AI, breaches, and the business of security, hosted by Aaron Mog. #cybersecurity #CISO #AIsecurity #securityleadership #shadowAI #infosec #ZeroSum

  4. 6 Oct ·  Video

    AI Attacks That Take Six Months, Not Six Minutes - with Jackson Reed

    Jackson Reed built the red team at the US Army Corps of Engineers and took it through certification, then spent four years rebuilding and leading Target's. He isn't worried about swarms of agents overwhelming your SOC — defenders are good at bursty and anomalous. What concerns him is the operator with ten thousand actions a day of compute budget who spends ten of them, in each of a thousand environments, for a year. We get into what a six-month timeline does to log retention and correlation windows, the two opposite ways red teams fail, why the frontier labs stopped measuring what matters in their system cards, and the Bronze Age analogy that explains most of the AI tooling being built right now. TIMESTAMPS 0:00 Cold Open 1:14 Meet Jackson Reed 6:29 Are You Hopeful or Upset? 12:33 Patience Beats Zero-Days 21:21 Agents Criminals Don't Have to Trust 24:01 Red Teaming in a Hall of Mirrors 29:46 Can AI Clone a World-Class Red Team? 33:35 What's Actually Scalable with AI 38:05 One Frontier Model, or Ten Thousand Custom? 40:58 AI Overkill: When Less Is More 44:58 YOLO Security 46:08 Chinese Models and Who Has Your Data 52:05 Barding: Can You Handle an Intrusion? 53:32 What System Cards Stopped Measuring 1:02:35 AI's Bronze Age 1:07:34 Holding an Industry Hostage 1:10:44 Where to Find Jackson ABOUT JACKSON Jackson Reed studied international affairs before moving into computer science through the CyberCorps Scholarship for Service. He did think tank and SOC analyst work, then threat attribution and intelligence analysis at CrowdStrike, built and led the red team at the US Army Corps of Engineers through certification, and rebuilt and led Target's. He launched Barding Defense in March and works with BT6 on assessments and jailbreaking for frontier labs. Blog: twelvetables.blog Barding Defense: bardingdefense.com #cybersecurity #redteam #aisecurity #threatintel #infosec #aiagents

  5. 28 Sept ·  Video

    AI Doom, and Why We Can Still Unplug the Servers - with Greg Ose

    Everyone's quitting a lab to warn us about the end of the world. Greg Ose, who has spent his career building product security programs from the inside and now does it at GitHub, isn't buying the hysteria — and his reason is boring in the best way. We built this. We can explain, step by step, how every one of these incidents actually happened, including the recent one the industry summarized as "our AI model hacked the company." Nothing mysterious is going on. And if it really came to it, we can still unplug the servers. What Greg thinks is actually worth worrying about isn't the technology getting away from us. It's whether anyone is funding the safety work at the same rate they're funding the growth. That's the last stretch of the conversation. The rest is the specifics of living with it right now: why AppSec is suddenly sucking all the oxygen out of security, whether developer security training was ever really working, why a paved path is a tier-zero product and not something one engineer writes in a week, what prompt injection looks like once you treat the agent as the most socially engineerable employee on your payroll, and why Greg thinks we should all just assume a dependency is going to be compromised and design for blast radius instead. Also: the Uber problem with AI pricing, the trust-pocalypse, and what Greg tells a 22-year-old who walks up at a con and asks how to get into security. CHAPTERS 0:00 Cold Open 0:53 Intro 1:01 Meet Greg Ose 2:33 AI hit AppSec all at once 5:51 What do you do with infinite vulnerabilities? 7:57 The supply chain was always fragile 12:53 Why AppSec money came roaring back 18:01 The people setting the fires 20:52 Does a pull request still mean anything? 25:54 Teaching security wisdom to models 28:59 Paved paths and who pays for them 33:27 "From scratch" and the token economy 36:21 Why Greg is still optimistic 42:42 Trust in a hall of mirrors 44:56 Reduce the blast radius, not the trust 50:19 Assume a dependency is compromised 53:40 Is AI going to end the world? 58:37 How to get into security now GUEST Greg Ose — GitHub https://www.linkedin.com/in/gregose/ ZEROSUM Hosted by Aaron Mog https://yellowteam.ai

  6. 21 Sept ·  Video

    EDR Gives Attackers Up to a 10-Minute Head Start - with Tim MalcolmVetter

    Tim MalcomVetter says every major EDR runs a two-to-ten-minute ingestion delay, and that it hands attackers a head start no AI SOC can close. The fix, he argues, isn't more AI. Tim ran a red team at Walmart, co-founded Wirespeed, and now runs incident response at Coalition, the cyber insurer that acquired it. That's a rare seat. He can tell you what a vulnerability actually costs, because his employer writes the check. We get into why the most expensive way to do security is people, the second most expensive is AI, and the cheapest is the deterministic code nobody wants to build. Why Wirespeed, an "AI SOC," uses AI in fewer than 2% of its verdicts. The vendor that burned $5 in tokens deciding to look up an IP address, a job deterministic code does in 20 to 30 milliseconds. Why most CISOs couldn't name their cyber insurance carrier a year ago. And the week Coalition scanned more than 100,000 companies for React2Shell, found 20 web shells, and didn't see a single claim. CHAPTERS 0:00 Cold open 0:50 Intro 2:27 Blue team first: how a defender became a red teamer 4:27 "We're not solving problems, we're just spending money" 6:57 The AI hype cycle is just relational databases again 8:52 People, AI, deterministic: the real cost hierarchy 10:17 "AI is not hard work. AI is cheating" 11:49 Founding Wirespeed and the race to the autonomous SOC 17:26 "I have to feel the shell": automating the red team 24:30 Mach 2.5 vs Mach 5: the air defense analogy 26:00 Usain Bolt's two-to-ten-minute head start 27:24 The Mexican government breach: one operator, one AI agent 33:12 $5 in tokens to decide it needed an IP enrichment 34:19 "Bring your own Claude license" and other red flags 37:06 Why a security founder ended up in insurance 39:52 Do you know who your cyber carrier is? 43:49 Brown bananas: how underwriting actually works 46:40 CrowdStrike's million-dollar policy 49:30 The IR retainer trap 53:22 React2Shell: 100,000 companies, zero claims 56:52 Custom code isn't where breaches come from 1:00:12 Identity, BEC and the $25M inbox 1:01:47 What's the next fad after AI? ABOUT TIM Tim MalcomVetter started his career on defense before moving into offensive work, including running a corporate red team at Walmart. He co-founded Wirespeed, an automated detection and response platform that Coalition acquired in November 2025. Incident response at Coalition, roughly 1,500 cases a year, now rolls up to him. Wirespeed: https://wirespeed.co Coalition: https://www.coalitioninc.com Find Tim on LinkedIn. ZeroSum is a podcast about what's actually happening in cybersecurity, not what the vendors say is happening. Practitioners, founders and operators, talking honestly about the work.

  7. 14 Sept ·  Video

    AI, Ransomware, & The Security Poverty Line - with Randy Rose

    Is AI closing the cybersecurity gap between big cities and small towns — or leaving under-resourced communities even further behind? In this episode of ZeroSum, Aaron sits down with Randy Rose, Vice President of Security Operations & Intelligence at the Center for Internet Security (CIS), to expose what's actually happening on the front lines of state and local government cybersecurity. Randy leads the operational missions of the MS-ISAC (Multi-State Information Sharing & Analysis Center). We dive into how ransomware crews are targeting rural school districts, why threat actors are using AI to clone writing styles for phishing, and why treating AI as a "prediction engine" rather than intelligence fundamentally changes your defense strategy. If you are a security practitioner, local government leader, or trying to break into the industry, this episode breaks down the realities of the security poverty line and what happens when a threat actor picks a small town for a payday. 🎯 What we cover: The security poverty line — and why AI might not fix itHow threat actors use generative AI for highly convincing phishing and BEC emailsThe real human cost when ransomware hits a rural hospital or school districtWhy "it's just a prediction engine" matters more than you thinkActionable advice for people trying to break into cybersecurity right now ⏱️ Chapters: 00:00 Cold Open 01:21 Introduction to the Cybersecurity Landscape 03:21 State vs Local Government Cybersecurity 06:13 Understanding the Multi-State ISAC 10:20 The Role of ISACs in Cybersecurity 12:00 Challenges Faced by Local Governments 14:50 AI's Impact on Cybersecurity 20:04 Ransomware and Business Email Compromise 24:35 Operational Technology and Municipal Challenges 25:51 Generative AI: The Great Democratizer? 32:26 Leveraging AI for Cybersecurity Skills 32:58 The Complexity of AI in Cybersecurity 35:52 Wisdom vs. Intelligence in Cybersecurity 40:11 The Growing Challenge of Cybersecurity 46:16 Building a Strong Cybersecurity Foundation 53:18 Advice for Aspiring Cybersecurity Professionals 🎙️ ZeroSum is a cybersecurity and AI podcast hosted by Aaron and Randy, digging into the real conversations security practitioners are having about AI, risk, and the future of the industry. #Cybersecurity #ArtificialIntelligence #Ransomware #InfoSec #ZeroSumPodcast

  8. 7 Sept ·  Video

    The AI Hacker Myth - with Silas Cutler

    Is artificial intelligence actually creating a new breed of super-hackers, or is the industry just selling panic? In this episode of the Zero Sum Podcast, Aaron sits down with Silas Cutler, one of the top security researchers in the industry and a Principal Reverse Engineer at Censys. Silas strips away the corporate marketing hype to reveal what threat actors are actually doing in the wild. They dive deep into the economic realities of cybercrime, how Russian military intelligence (APT28) hijacks criminal botnets, and the deadly, real-world risks of private companies legally "hacking back" against ransomware cartels. Whether you are a seasoned threat intel analyst, a security leader trying to understand the AI landscape, or an aspiring researcher looking to break into the field, this conversation provides a rare, unfiltered look into the trenches of cybersecurity. Timestamps / Chapters: 00:00 - Intro: Welcoming Silas Cutler to Zero Sum 01:36 - The State of Security Research Today 04:15 - Why Research is Underfunded (And Why That's Okay) 07:44 - Debunking the AI "Vulnerpocalypse" Hype 13:54 - How Threat Actors Actually Scale Their Operations 18:24 - Team PCP & The Rise of Supply Chain Attacks 22:00 - Google's "Beautiful Paranoia" vs. Unprepared AI Startups 29:12 - Is Ransomware a "Solved Problem"? 32:01 - Unmasking Russian APT28 and the Moobot Hijack 38:30 - Red on Red: When Cybercriminals Hack Each Other 39:53 - Letters of Marque & The Deadly Reality of "Hacking Back" 50:40 - Career Advice: How to Break Into Threat Research Follow Zero Sum & Our Guest: Subscribe to the Zero Sum Podcast: https://www.youtube.com/@zerosumpodcastFollow Silas Cutler on X / LinkedIn / MastodonHosted by Aaron Mog

See All (21)

About

ZeroSum is a new cybersecurity podcast that aims to talk honestly about the state of the cybersecurity industry. The show rejects standard "threat of the week" news breakdowns and instead focuses on the reality of the market. Viewing the industry through the lens of game theory, the podcast explores how the current cyber market is no longer a rising tide that lifts all boats; for massive VC gambles to win, the burnt-out practitioners on the ground are often the ones losing. The show features guests from all perspectives, including vendors, investors, workers, and CISOs.

Information

  • Creator
    Aaron Mog
  • Years Active
    2026
  • Episodes
    21
  • Rating
    Explicit
  • Copyright
    © 2026 Aaron Mog
  • Show Website
    ZeroSum