Prabh Nair

Prabh Nair

Prabh Nair is a cybersecurity podcaster covering cyber risk, ransomware, incident response, SOC operations, GRC, AI security, threat intelligence, digital forensics, ISO 27001, CISSP, CISM, and security leadership. Built for SOC analysts, auditors, cybersecurity professionals, students, and business leaders, each episode delivers simple explanations, practical lessons, and real-world examples to help you stay ahead in the fast-changing cyber world. #CyberSecurity #InformationSecurity #CyberRisk #GRC #SOC #IncidentResponse #Ransomware #ThreatIntelligence #AISecurity #DigitalForensics

  1. 1日前

    Bug Bounty Hunting Roadmap: From Zero to First Bounty

    Are you interested in bug bounty hunting but confused about where to start?In this podcast session, Prabh speaks with Monish about the real beginner roadmap for learning bug bounty, web security, XSS, SQL injection, Burp Suite, vulnerability reporting, and practical web application testing.This session is designed for beginners who want to learn bug bounty the right way. Instead of directly jumping into advanced tools and random payloads, Monish explains why every beginner must first understand how websites actually work.Before you start hunting bugs, you need to understand the basics of HTML, CSS, JavaScript, HTTP requests and responses, cookies, browser developer tools, frontend logic, backend logic, databases, authentication, sessions, and website technology stacks.Monish explains how these foundations help you understand real vulnerabilities like Cross-Site Scripting XSS, SQL Injection, misconfigurations, broken access control, and other common web security issues.The discussion also covers how beginners can use platforms like W3Schools, Juice Shop, OWASP practice labs, PortSwigger Web Security Academy, TryHackMe, Hack The Box, HackTricks, and Burp Suite to build practical skills in a safe and legal way.One of the most important parts of this episode is the discussion on why many bug bounty reports get rejected. Monish explains common mistakes such as submitting duplicate vulnerabilities, depending only on automated scanners, using AI without understanding the finding, missing business impact, weak proof of concept, and losing patience too early.This video is useful for cybersecurity beginners, bug bounty learners, web security students, ethical hacking aspirants, penetration testing beginners, college students interested in cybersecurity, and anyone who wants to learn bug bounty legally and practically.Bug bounty is not about randomly running tools. It is about understanding applications, finding real security impact, documenting evidence properly, and reporting vulnerabilities responsibly.Watch the full session and comment below with the next bug bounty topic you want Monish and Prabh to cover.Subscribe for more practical cybersecurity podcasts, bug bounty learning, ethical hacking guidance, web security training, SOC content, GRC insights, and real-world career advice#BugBounty #EthicalHacking #WebSecurity #CyberSecurity #PenetrationTesting

  2. 4日前

    CISSP 2026 AI Topics Questions Master Class

    Are you preparing for CISSP 2026 and wondering how AI security, AI governance, responsible AI, privacy, and model attacks can be tested in the exam?In this video, we break down important CISSP-style AI questions in a practical and exam-focused way. Instead of memorizing definitions, you will learn how to think like a CISSP candidate when facing scenario-based questions on AI systems, governance, risk management, security controls, privacy, and third-party AI platforms.AI is no longer just a technology topic. For CISSP candidates, AI connects directly with Security and Risk Management, Asset Security, Security Architecture, Security Operations, Identity and Access Management, Software Development Security, and Third-Party Risk Management.In this session, we cover AI governance, responsible AI, ethical AI, shadow AI, model poisoning, model inversion, membership inference, prompt injection, differential privacy, AI-SBOM, model cards, AI vendor risk, AI monitoring, risk appetite, risk tolerance, SOC, SIEM, SOAR, and AI security control selection. This video is useful for CISSP 2026 candidates, cybersecurity professionals, GRC professionals, SOC analysts, security managers, risk managers, and AI governance learners who want to understand how AI-related security topics may appear in scenario-based CISSP questions.Watch the full video and try answering each question before checking the explanation. That is how you build CISSP-level judgment.Subscribe for more CISSP exam preparation, cybersecurity concepts, AI security topics, and practical scenario-based questions.CISSP 2026 Coffee Shotshttps://www.youtube.com/watch?v=1krYtSQbMWc&list=PL0hT6hgexlYxKzBmiCD6SXW0qO5ucFO-J&pp=sAgCCISSP Spotify Podcast Domain 1 to Domain 7Domain 1 : https://open.spotify.com/episode/6fggB2lwYA5kzmdmz7BsCh?si=ff488838799b4baeDomain 2 = https://open.spotify.com/episode/4RkQIHgpTUC87TR3UqmkHd?si=ca4f12aea1dc473aDomain 3 = https://open.spotify.com/episode/1b59qRq9vk0hvfa0UiqRm1?si=5f9da0b4cf6545d6Domain 3 Part 2 = https://open.spotify.com/episode/4ncdZBhZEtPCZQYzbLi03m?si=041114030f904c21Domain 3 Part 3 = https://open.spotify.com/episode/3F1S1M8PzVdWMt4egBKFR2?si=dfcdb502cc8049afDomain 4 Part 1 = https://open.spotify.com/episode/6yRGRfpK51II7Od438imNA?si=f94c058f77854f5eDomain 4 Part 2 = https://open.spotify.com/episode/2b3Z8hFII1ypWcVMjqBQlC?si=a16dfb96da6a4addDomain 5 : https://open.spotify.com/episode/1ouhqFPycKwBqMYAF9v4rO?si=u-I7VHQ7Q0CjGmOPfelnSwDomain 6 https://open.spotify.com/episode/0SjIzz6eWO1YKvMg5MVpVK?si=b6980db1afce41a2Domain 7 : https://open.spotify.com/episode/2Ov3RXtw8XMq5R1jJL3o5X?si=2e1bb4ce50fa4516#cisspexam #cissp2026 #CISSP #CISSP2026 #AISecurity #Cybersecurity #aigovernance

  3. 7月23日

    Kudankulam Data Leak Explained | Critical Infrastructure, Vendor Risk & Dark Web Intelligence

    Critical infrastructure may not always be directly attacked.Sometimes, the real risk comes from vendors, contractors, suppliers, hosting providers, exposed credentials, weak access controls, and data leaked through third-party ecosystems.In this podcast episode, Prabh speaks with Rakesh Krishnan, a threat intelligence researcher, about the Kudankulam Nuclear Power Plant-related data exposure discovered on a dark web data leak site operated by the ransomware group World Leaks.00:00 - 01:04 – Highlights01:04 - 02:54 - Introduction, Guest welcome, his credentials and Agenda02:54 – 04:29 - Discovery of the Breach04:29 – 11:16 - Research Motivation and Initial Investigation11:16 – 13:13 - Risk Assessment of Sensitive Data Leaks13:13 – 15:38 - Technical Analysis and Breach Patterns15:38 – 18:26 - Adversary Attack Life Cycles18:26 – 21:47 - Global Threat Landscape and APT Rankings21:47 – 23:10 - Identifying Nationally Sensitive Data23:10 – 28:06 - Geopolitical Data Logic and Intelligence28:06 – 30:35 - Vendor Security and Leadership Lessons30:35 – 35:45 - Offensive Perspective on Data Classification35:45 – 39:12 - Evolution of Ransomware Tactics39:12 – 44:42 - CISO Incident Response and Negotiation44:42 – 48:06 - Technical Rapid Fire48:06 – 49:40 - End of the conversation by thanking Rakesh Krishnan and looking forward to doing more Podcast.The discussion explains that this was not described as a direct attack on Kudankulam Nuclear Power Plant. Instead, sensitive KKNP-related documents were discovered inside a leaked dataset connected to One of the MNC infrastructure data hosted through a third-party data center.This case is important for every CISO, SOC analyst, threat intelligence team, GRC professional, vendor risk manager, and critical infrastructure stakeholder.Why?Because attackers do not always need to breach the main organization directly.They can study leaked vendor records, engineering drawings, supplier layouts, technical specifications, financial documents, and email records to understand the ecosystem around critical infrastructure.Twitter https://x.com/RakeshKrish12Linkedin Profilehttps://www.linkedin.com/in/rakesh-krishnan-6179a94b/Detailed Bloghttps://theravenfile.com/2026/07/17/kudankulam-nuclear-power-plant-leak-an-accidental-disclosure/In this episode, we discuss:- What was discovered in the Kudankulam-related data exposure- Why the incident points toward third-party and vendor ecosystem risk- How ransomware data leak sites operate- How double extortion works- Why exposed engineering drawings and technical records are dangerous- Why compliance does not always mean security- Why critical infrastructure defenders must monitor dark web leak sites- How attackers weaponize leaked supplier and vendor information- Why no data should be considered useless- How data classification must include business, regulated, and operational data- Why CISOs must investigate exposed VPN, RDP, credential, and access patterns- Why ransomware and data-extortion-only cases must be separated during investigation- How insider threat and credential compromise affect critical infrastructure security- What SOC teams should monitor after dark web exposure- Why vendor vetting must go beyond reputation and compliance certificates- What India’s critical infrastructure ecosystem can learn from this caseWhat should organizations improve first — dark web monitoring, vendor risk assessment, data classification, or SOC detection?#kudankulam #Kudankulamdatabreach #Kudankulamsec

  4. 7月23日

    How to Implement ISO 27701 in the Real World

    Want to understand how to implement ISO 27701 properly and turn privacy compliance into a working system? In this podcast, we break down the practical implementation of ISO 27701, explain how it relates to ISO 27001, and show how organizations can build a real Privacy Information Management System (PIMS) instead of treating privacy as a one-time compliance exercise.This session covers the structure of ISO 27701, the role of privacy principles, the difference between controllers and processors, and the real steps involved in operationalizing privacy controls across people, process, and technology. It also explores key implementation areas such as data processing assessments, records of processing activity, consent management, privacy impact assessments, vendor risk assessments, cross-border data transfers, training, privacy champions, and continuous monitoring.In this video, you’ll learn:What ISO 27701 is and why it mattersHow ISO 27701 extends ISO 27001 for privacy risk managementThe difference between data controllers and data processorsHow to start a practical PIMS implementationWhy records of processing activity are essentialHow to map privacy controls to regulations like GDPR and DPDPAHow to handle privacy impact assessments and vendor riskWhy privacy implementation takes months, not weeksHow privacy champions, training, and continuous monitoring support long-term complianceThis episode is useful for:privacy professionalsDPOsCISOscompliance leadersGRC teamsISO 27001 practitionersconsultants implementing privacy frameworksWhether you are starting an ISO 27701 implementation, improving your privacy governance model, or trying to align privacy operations with ISO 27001, this discussion gives you a practical roadmap.Data Privacy Professional Videohttps://www.youtube.com/watch?v=76fcelayw00&t=1734s&pp=ygUSZGF0YSBwcml2YWN5IHByYWJo0gcJCQQLAYcqIYzvInterview Serieshttps://www.youtube.com/watch?v=ugHmTNup-ys&list=PL0hT6hgexlYynj0FOvrGCPfiWZFRkMJx4&pp=sAgCGDPR Implementationhttps://www.youtube.com/watch?v=Pf_qQxeubIg&pp=ygUKZ2RwciBwcmFiaA%3D%3DPDPL Implementationhttps://www.youtube.com/watch?v=SgvOkRZgrd0&t=1338s&pp=ygUSZGF0YSBwcml2YWN5IHByYWJoSubscribe for more content on ISO 27701, privacy management, GDPR, data protection, information security governance, and compliance implementation#dataprivacy #iso27701 #cybersecurity #dataprivacyday

  5. 7月20日

    How to Pentest LLMs Like a Security Researcher Cybersecurity

    Are LLMs and AI apps really secure? In this podcast, we break down LLM security, prompt injection, LLM penetration testing, and the real vulnerabilities attackers look for when testing AI systems. From reconnaissance and enumeration to payload manipulation and lab-based exploitation, this session shows how traditional web application security testing differs from LLM security testing in real-world environments.Youtube : https://m.youtube.com/@darshanhackzInstagram : https://www.instagram.com/darshanhackzX : https://x.com/darshanhackzSecurity researcher Darshan Naik joins the discussion to explain common LLM vulnerabilities such as prompt injection, hallucinations, excessive agency, information disclosure, insecure integrations, and API misuse. The session also explores how weak validation, poor segmentation, and insecure AI workflows can expose sensitive data or create paths to unauthorized access. Practical examples and lab walkthroughs make the concepts easy to understand for both security professionals and learners.In this video, you’ll learn:How LLM penetration testing is different from traditional web app pentestingHow attackers identify whether a target is using a real LLM or static AIWhat prompt injection looks like in practiceWhy hallucinations, insecure permissions, and excessive agency create riskHow API integrations and AI agents can increase the attack surfaceWhy validation, segmentation, and secure implementation matterHow to use labs and practical exercises to improve AI security testing skillsWhat defenders should do to reduce LLM security vulnerabilitiesThis episode is useful for:penetration testersbug bounty huntersAI security researchersAppSec professionalsred teamersdevelopers building LLM applicationssecurity leaders exploring AI riskWhether you are testing AI chatbots, reviewing LLM security posture, or learning how modern attackers abuse AI systems, this conversation gives you a practical starting point.Subscribe for more content on AI security, LLM hacking, prompt injection, penetration testing, AppSec, and cybersecurity research.GEN AI Securityhttps://www.youtube.com/watch?v=aTJPKifa1VM&t=489s&pp=ygUPZ2VuIGFpIHNlY3VyaXR5#LLMSecurity #PromptInjection #AISecurity #Pentesting #CyberSecurity

  6. 7月16日

    How to Build AI Governance in 5 Practical Steps Real Usecase

    AI governance is no longer optional. In this podcast, we break down a practical 5-step AI governance framework for managing high-risk AI systems from intake and inventory to risk assessment, documentation, vendor review, and continuous monitoring.Using a fictional HR hiring model at a multinational financial institution, this session explains how organizations can build a real-world AI governance process that addresses bias, compliance, privacy, vendor risk, model drift, and regulatory expectations. We also explore how governance teams can align AI systems with business objectives, legal obligations, and frameworks such as the EU AI Act, GDPR, and the NIST AI Risk Management Framework.What you’ll learn in this video:How to create an AI governance intake processWhy AI inventory and system classification matterHow to assess data lineage, bias, and privacy risksWhat to check in AI vendor and third-party risk assessmentsHow to perform AI risk assessments for high-risk systemsWhy model cards, documentation, and audit readiness are essentialHow to implement continuous monitoring for drift, fairness, and performanceKey governance challenges when deploying AI in regulated industriesThis episode is especially useful for:AI governance professionalsrisk and compliance teamsCISOs and security leadersprivacy professionalsdata governance teamsinternal auditorsorganizations deploying high-risk AI systemsWhether you are building an AI governance framework, preparing for AI compliance, or trying to manage AI risk in enterprise environments, this conversation offers a practical roadmap you can apply.Other Videos on AI Governacehttps://www.youtube.com/watch?v=mDuqzICOZZI&t=11shttps://www.youtube.com/watch?v=PT7xmnn8FFIhttps://www.youtube.com/watch?v=OhxAdrfHVs8https://www.youtube.com/watch?v=i721IZkpG8I&t=423shttps://youtu.be/skJNr6C6O18?si=itgrpjoY9viovfL6https://www.youtube.com/watch?v=dQUML9vnlY4&t=3180shttps://www.youtube.com/watch?v=LgFBi5XD-Ow&t=5668sSubscribe for more content on AI governance, cybersecurity, privacy, compliance, risk management, and emerging technology frameworks.#AIGovernance #AIRiskManagement #EUAIAct #GDPR #AICompliance

  7. 7月13日

    vCISO Master Class: Build a Security Program From Zero

    Want to become an effective vCISO and learn how to build an information security program from scratch? This masterclass breaks down the real role of a virtual CISO, showing how to lead security through strategy, governance, risk management, compliance, stakeholder communication, and measurable execution.In this session, you’ll learn how a modern vCISO operates across the three core functions of security leadership: strategic direction, governance structure, and operational oversight. The masterclass covers how to assess low-maturity organizations, identify crown jewels, develop a security programme, build a risk register, choose the right framework, write practical policies, oversee security operations, communicate with leadership, and demonstrate measurable business value.This video is ideal for:aspiring vCISOssecurity managers moving into leadership rolesGRC professionalsconsultants building vCISO servicescybersecurity leaders who want to think more strategicallyWhat you’ll learn:What a modern vCISO actually doesThe difference between strategy, governance, and oversightHow to assess an organization with little or no security maturityHow to identify crown jewels and prioritize business-critical assetsHow to build a security programme using frameworks like NIST CSF, ISO 27001, CIS Controls, and SOC 2How to perform practical risk management and create a living risk registerHow to build policies, governance structures, and reporting cadencesHow to oversee incident response, IAM, vulnerability management, vendor risk, and business continuityHow to communicate with executives and boardsHow to become a trusted, effective virtual CISO in real-world engagementsWhether you are starting your journey into the vCISO role or improving your ability to lead an enterprise security program, this masterclass gives you a practical roadmap you can use immediately.Other VideosHow to become CISOhttps://www.youtube.com/watch?v=U2LE8Ma1kcw&t=5s&pp=ygUKQ0lTTyBQUkFCSA%3D%3DCISO Mindsethttps://www.youtube.com/watch?v=iMey5DFE2UE&t=843s&pp=ygUKQ0lTTyBQUkFCSA%3D%3DInfosec Policyhttps://www.youtube.com/watch?v=wgzFoJ14iiI&pp=ygUhaW5mb3JtYXRpb24gc2VjdXJpdHkgcG9saWN5IHByYWJoGRC Videohttps://www.youtube.com/playlist?list=PL0hT6hgexlYxM5P9v7aEYBTJl7iJyK2uKISO 27001https://www.youtube.com/watch?v=tvd1MUf3aHE&list=PL0hT6hgexlYys_9UWhal1kr9Gkz0ms0sM&pp=sAgCBuilding KPIhttps://www.youtube.com/watch?v=UkEhXbNOn9w&pp=ygUJS1BJIFBSQUJI0gcJCdQKAYcqIYzvISO Risk Assessmenthttps://www.youtube.com/watch?v=EAgQ6u7ARIA&t=1882s&pp=ygUpaW5mb3JtYXRpb24gc2VjdXJpdHkgcmlzayBwcmFiaCBpc28gMjcwMDE%3DEnterprise Risk Assessmenthttps://www.youtube.com/watch?v=5ywJMfsYDgo&t=600s&pp=ygUJZXJtIHByYWJoSubscribe for more content on vCISO leadership, cybersecurity strategy, information security governance, risk management, compliance, and AI governance.#vCISO #CyberSecurity #InformationSecurity #RiskManagement #ISO27001

  8. 7月9日

    Practical Purple Teaming in Action 2026

    What is Purple Teaming in Cybersecurity? In this podcast episode, Aditya Rai explains purple teaming in a practical, easy-to-understand way through real-world demonstrations using Splunk, Caldera, Atomic Red Team, Windows logging, and Sysmon.If you want to understand how red team and blue team collaboration improves threat detection, security monitoring, and detection engineering, this episode is for you. Aditya shares his journey into cybersecurity, explains why purple teaming matters, and shows how organizations can identify logging gaps, validate detections, and improve visibility across their environment.Resourceshttps://controlcompass.github.io/threat-modelhttps://www.securityblue.team/blog/posts/windows-logging-enhanced-visibility-guidehttps://caldera.mitre.orghttps://www.atomicredteam.ioIn this episode, you will learn: What purple teaming means in real-world cybersecurityThe difference between red team, blue team, and purple team activitiesHow Splunk helps with log collection, analysis, and alerting Why Windows logging and command-line visibility are critical for detectionHow PowerShell activity can be detected and analyzedHow Caldera and Atomic Red Team support adversary emulationWhy Sysmon is valuable for stronger detection and investigation How Windows event IDs and log codes support better threat analysisThis episode is valuable for:SOC analysts Blue teamersDetection engineers Cybersecurity students Security professionals learning Splunk, Sysmon, or MITRE ATT&CKTopics covered:Purple Teaming, Cybersecurity, Splunk, Windows Logging, Sysmon, PowerShell Detection, Atomic Red Team, Caldera, MITRE ATT&CK, Detection Engineering, Threat Detection, Security Monitoring, Red Team vs Blue Team, Adversary EmulationWatch till the end to understand how practical purple teaming can help defenders create better detections, validate security controls, and reduce blind spots in modern environments.Subscribe for more practical cybersecurity podcasts, blue team learning, SOC insights, and hands-on security content. Cyber Warfare Playlisthttps://www.youtube.com/watch?v=KKNtazH1qFs&list=PL0hT6hgexlYw8lc75YSbOts1GhOFl1Ofr&pp=sAgCSOC Playlisthttps://www.youtube.com/watch?v=zCLlrFZU0M8&list=PL0hT6hgexlYxd24Jb8OE7vZoas-iTcHAc&pp=sAgCThreat Intelligencehttps://www.youtube.com/playlist?list=PL0hT6hgexlYxb9mXpcgmEU-_AOmQdrZYO#PurpleTeaming #CyberSecurity #Splunk #BlueTeam #RedTeam #SOCAnalyst #DetectionEngineering #Sysmon #AtomicRedTeam #MITREATTACK #ThreatDetection #WindowsLogging

すべて見る（144）

番組について

Prabh Nair is a cybersecurity podcaster covering cyber risk, ransomware, incident response, SOC operations, GRC, AI security, threat intelligence, digital forensics, ISO 27001, CISSP, CISM, and security leadership. Built for SOC analysts, auditors, cybersecurity professionals, students, and business leaders, each episode delivers simple explanations, practical lessons, and real-world examples to help you stay ahead in the fast-changing cyber world. #CyberSecurity #InformationSecurity #CyberRisk #GRC #SOC #IncidentResponse #Ransomware #ThreatIntelligence #AISecurity #DigitalForensics

情報

  • クリエイター
    Prabh Nair
  • 配信期間
    21年 - 26年
  • エピソード
    144
  • 制限指定
    不適切な内容を含まない
  • Copyright
    © Prabh Nair
  • 番組のWebサイト
    Prabh Nair