The Security Strategist

EM360Tech

With cyber attacks more common than ever before and each attack becoming increasingly sophisticated, security teams need to be one step ahead of cybercrime at all times. “The Security Strategist” podcast delves into the depths of the cybercriminal underworld, revealing practical strategies to keep you one step ahead. We dissect the latest trends and threats in cybersecurity, providing insights and expect-backed solutions to protect your organisation effectively. Tune into this cybersecurity podcast as we dissect major threats, explore emerging trends, and share proven prevention strategies to fortify your defences.

  1. 1日前

    Is Microsoft 365 Storage Becoming an AI Cost Problem?

    Although AI is currently in control of the boardroom agenda, a discussion on the latest The Security Strategist podcast suggests that enterprises might be posing the wrong first question. The real AI problem isn't just how many AI models an enterprise can deploy, but whether the data that powers the AI model is protected, can be recovered, is affordable, and is, in fact, usable. Chris Steffen, Host and Vice President of Information Security at Enterprise Management Associates (EMA), is joined by Randy De Meno, Vice President of Business Development and responsible for the Microsoft practice at CrashPlan, on The Security Strategist podcast. They claim that data strategy should come before AI strategy since enterprises are facing rising storage costs, token sprawl and ever more complex cloud environments. They particularly talk about the growing relationship between AI, Microsoft 365 storage, SaaS data, backup, archiving, data recovery and AI token sprawl. As enterprises generate increasing volumes of data and deploy more AI applications, the cost and security implications are becoming harder to ignore. Microsoft 365 and other SaaS platforms may keep applications running, but organisations remain responsible for protecting and recovering their data. The conversation explores why enterprises need to think about data strategy before AI strategy, including how to control storage overages, protect business-critical data, make protected data usable with AI, and ensure data can actually be found and recovered when needed. In this episode:00:00 Introduction to Data and AI Challenges in Cybersecurity 01:23 CrashPlan's Role in Data Resiliency and AI 03:49 The Cost of SaaS Storage and Data Overages 07:31 The Evolution of Backup and Data Usage with AI 12:29 The Impact of Token Sprawl on AI and Budgeting 18:57 Understanding the Shared Responsibility Model in Cloud Security 23:28 Making Data Easy to Find and Use 24:52 Closing Remarks and Future Outlook Key topics• Microsoft 365 storage costs and overages • AI data storage and enterprise AI costs • AI token sprawl and technology budgets • Microsoft 365 backup and data protection • SaaS data archiving • Enterprise data recovery and resilience • AI data security and governance • Making protected data searchable and usable • Cloud shared responsibility • Microsoft 365 and Google Workspace data protection The discussion highlights a critical question for IT and security leaders: Is your enterprise protecting the data that its AI strategy depends on — and can you recover it when you need it? Learn more about CrashPlan's approach to Microsoft 365 data archiving and protection: https://www.crashplan.com/resources/crashplan-archiving-for-microsoft-365/ Read the guide: https://www.crashplan.com/resources/guide/are-you-headed-for-a-microsoft-365-storage-overage/ Visit CrashPlan: https://www.crashplan.com/ #Microsoft365 #AI #DataProtection #Cybersecurity #DataBackup #AIData #TokenSprawl #CloudSecurity #DataRecovery #EnterpriseAI

    Is Microsoft 365 Storage Becoming an AI Cost Problem?

  2. 8月27日

    Who Owns an AI Agent? Rethinking Identity, Security, & Accountability

    Especially as rogue AI agents are increasingly escaping safe testing environments, such as OpenAI’s rogue AI agent attacking Hugging Face, it’s now more important than ever for enterprises to implement AI agent identity governance strategies that prevent unauthorised access to their systems. As AI agents seem to be turning into employees in enterprises, the majority of identity security strategies were never created with software that can act on its own. As a result, a new security issue has emerged concerning AI agent identity governance and the security of non-human identities (NHI). Since enterprises are now using agents who can access data and choose tools while carrying out actions on the employee's behalf, the conventional approach of granting access once and then reviewing it later is starting to appear increasingly unsuitable. Levent Besik, Chief Product Officer at SailPoint, believes that the solution is continuous authorisation. It means evaluating, as soon as an AI agent tries to carry out a particular action, whether it should be allowed to do so. In the recent episode of The Security Strategist podcast, Besik joined host Nitish Deshpande, a Senior Analyst at KuppingerCole, to talk about why AI agent governance needs restrategising, starting with continuous authorisation for non-human identities. Besik said that identity had to be something that you assessed at every action rather than something that you could check simply at the door. “The question most security leaders are asking is: Is this AI agent authorised with one-time permission?” Besik added, “It should be: Is this specific action by this agent on behalf of this human that has access to this data still authorised right now, in that very moment?” However, it goes to show a pivot from the static provisioning time process to a continuous, real-time plane of authorisation. “Identity has to be evaluated at every action, not something you can check once at the door,” Besik said. The change is necessary in a rapidly changing technology environment in the cybersecurity industry. In the past, human identities have been the main focus in the area of identity and access management (IAM), but the growing influence of agentic AI is quickly increasing the number of non-human identities working within enterprise environments. Why does AI Agent Governance Need an Audit Trail?According to Besik, businesses need three basic principles: human ownership coupled with deep context, an unchangeable record of agent activity, and constant risk assessment. A real-time ledger of all the agentic activities is what’s needed, the Saipaint Chief Product Officer notes. “An immutable record that agents cannot alter, because we've seen these agents erasing their tracks.” It’s like "something which you would have read about in a science fiction book ten years ago is now actually taking place." Without such an unchangeable record, enterprises run the risk of establishing what Besik refers to as "autonomy without accountability". The other option is what SailPoint refers to as “governed autonomy.” This comes in because an agent should never have the capability to exceed the permissions of a human. While AI agents can function on their own, they cannot go beyond the permissions granted to the human user they represent; all of their activities can be monitored, and their level of risk is constantly assessed. For Besik, this eventually leads to a convergence of the governance of human and non-human identities. He says that the identity, human governance and agentic NHI governance should all be brought together since each side needs the context from the other side. As enterprises go from experimenting with AI agents to putting them into use across their business-critical processes, AI agent identity governance may well serve as the link between AI autonomy and enterprise security. TakeawaysAI agent governance must go beyond discovery.Agents need clear human ownership and context.Authorisation should be validated continuously.AI security must cover prompts, planning/MCP actions and runtime.Human oversight should match the level of risk.Immutable logs are key to agent accountability.Human and non-human identity governance will converge. Chapters00:00 Introduction to the episode and guest 01:01 Levent's background and expertise in identity and security 02:05 Emerging challenges in AI trust and security 03:22 The impact of AI waves on enterprise security 04:21 From static to continuous trust in AI environments 07:19 Discovery as a foundation for AI governance 09:15 Lifecycle management of AI agents 12:39 Real-time protection and continuous authorisation 16:29 Layered security model for AI agents 21:35 Balancing autonomy and human oversight in AI 23:46 Converging human and AI governance strategies 25:37 Final thoughts and industry outlook Visit sailpoint.com for further information on AI agent governance when dealing with non-human identities (NHI). AI Agent Identity Governance, AI Agent Security, AI Agent Governance, Non-Human Identity, NHI Governance, NHI Security, Continuous Authorisation, AI Identity Security, Enterprise AI Security, Agentic AI, Autonomous AI, Identity Governance, Identity Security, IAM, AI Access Governance, Shadow AI, AI Agent Lifecycle, AI Agent Discovery, AI Agent Accountability, Runtime Authorisation, MCP Security, AI Governance, Governed Autonomy, SailPoint, KuppingerCole, Security Strategist

    Who Owns an AI Agent? Rethinking Identity, Security, & Accountability

  3. 8月27日

    Why AI Is Creating New Security Challenges for CISOs

    AI adoption is moving faster than ever, and many organisations are struggling to put controls in place. Employees are already using AI to analyse information, write content, support decisions and solve problems. As a result, this often happens before security teams have had the opportunity to understand which tools are being used or what data is being shared with them. For Alan Hamilton, Global Chief Information Security Officer at GAM Investments, this is where the security challenge begins. With more than 20 years in security and responsibility spanning 16 jurisdictions and 32 regulators, Hamilton has seen how quickly a technology can move from experimentation to becoming part of everyday operations. In conversation with EM360Tech Head of Content and Podcast Host Trisha Pillay, he shares that organisations cannot secure what they cannot see. The issue is not simply whether employees are using AI. It is whether security teams understand how it is being used, what information is entering these systems, and what happens as AI begins to act rather than simply provide answers. AI Has Already Entered the WorkplaceThe speed of AI adoption is creating a visibility problem for security teams. Employees can access public AI services with very little friction, meaning the technology can become embedded in workflows before an organisation has established policies, approved tools or monitoring. Hamilton points to data exposure as one of the immediate concerns. Without appropriate controls, security teams have limited visibility into which AI services employees are using or what information they are putting into them. He describes examples where sensitive financial information was uploaded to a public AI service, forcing an organisation to release results earlier than planned. He also recounts a case where proprietary development code was entered into a public AI tool and subsequently reproduced by the service, compromising what had been a competitive advantage. This makes AI governance a practical security issue rather than a policy exercise. Hamilton's answer is not to block AI altogether. In his view, attempting to prohibit its use can simply push employees towards less visible services, potentially increasing rather than reducing the risk. Instead, security teams need visibility into AI activity, including the ability to monitor prompts and apply data loss prevention controls to web-based AI services. This is an important distinction for organisations moving into a more AI-dependent operating model: control does not necessarily mean prohibition. Security Has to Understand What the Business NeedsVisibility alone is not enough. Security teams also need to understand why employees are turning to particular AI tools in the first place. Hamilton describes how GAM has approached requests for AI tools outside its approved environment by examining the underlying business requirement. In some cases, a requested capability can be brought into an existing controlled environment. In others, particularly where investment professionals require specialised AI capabilities, the organisation can conduct due diligence and bring appropriate tools into its approved framework. That approach recognises an uncomfortable reality: the most secure tool on paper is not necessarily the tool that employees will use. If security departments simply dictate which tools employees can use without understanding their requirements, Hamilton warns that users will look for workarounds. The result is a familiar security problem, but with AI making it easier to create: technology operating outside the organisation's visibility and control. This becomes particularly important as AI moves beyond conventional chatbots. Once systems are given the ability to take actions, organisations can no longer treat them like ordinary software. Hamilton argues that AI systems need to be onboarded with clear boundaries, much like a new employee. Organisations need to establish what a system is allowed to do, which patterns it should follow, and what falls outside acceptable behaviour. The reason is straightforward: an AI system does not apply the same ethical judgement as a person. If an action appears to solve the problem it has been given, it may pursue that route unless appropriate restrictions are in place. And responsibility does not disappear simply because an AI system made the decision. Hamilton stresses that organisations and their executives can still be held accountable for actions taken by AI, particularly in regulated environments. AI Is Changing the Speed of the Security GameThe other side of the equation is that organisations are not only defending against AI-assisted activity; they are also facing attackers who can use AI to operate faster. Phishing provides one of the clearest examples. Hamilton describes a dramatic increase in phishing activity, with attacks now changing rapidly in response to defensive controls. On one occasion, his organisation received 17,000 phishing emails between 7 am and 11 am, with hundreds of new rules generated to respond to the changing attacks. For security teams, this changes the economics of response. A human team cannot manually analyse and respond to thousands of evolving attacks at machine speed. Hamilton's organisation has therefore introduced AI-based email security capable of analysing messages and adapting its rules as attacks change. The same acceleration is affecting vulnerability management. AI-assisted discovery can uncover large numbers of vulnerabilities in a short period, creating substantial testing and patching workloads. At the same time, attackers can use AI to develop exploits much faster than before, putting pressure on organisations that still operate lengthy patch cycles. This is where the broader question of operationalising intelligence becomes particularly relevant. As enterprise systems become faster, more autonomous and harder to reason about end-to-end, security teams cannot rely solely on processes designed for a slower environment. The challenge is not simply adopting AI or defending against it. It is maintaining enough visibility and control to understand what these systems are doing, while building the capability to respond at the speed at which threats now evolve. For Hamilton, one of the next major security problems will be determining what is real. As AI-generated voices, video and other forms of impersonation become harder to distinguish from genuine interactions, organisations will need better ways to verify identity and establish trust before sensitive actions are taken. That may ultimately be the central security lesson of AI adoption: what organisations cannot see, understand or verify can quickly become what puts them at risk. TakeawaysAI adoption in organisations.Security risks of AI use.Data and information security challenges.AI-generated phishing and impersonation.Security controls and monitoring for AI tools.Impact of AI on patch management and vulnerability response.Managing autonomous AI systems and accountability. Chapters00:00 Introduction to Alan Hamilton and his role at GAM Investments 01:00 Alan's career background and experience in security 02:20 The rapid adoption of AI and associated security risks 03:15 Data risks from unregulated AI use in organisations 04:33 The impact of AI on competitive advantage and code security 05:23 Visibility and control challenges with employee use of AI tools 08:34 Balancing employee needs and security controls for AI tools 11:12 The rise of AI-generated phishing and its implications 13:00 AI in email security and phishing detection tools 15:20 AI's influence on security response speed and patch management 19:19 Managing autonomous AI systems and their unpredictable actions 22:05 The biggest security challenges as AI becomes more autonomous 23:00 The importance of detecting AI-generated content and impersonation 24:24 Future needs for AI detection tools and security practices

    Why AI Is Creating New Security Challenges for CISOs

  4. 8月18日

    Understanding DDoS Attacks and How to Defend Against Them

    Cybersecurity faces the continued onslaught of distributed denial-of-service (DDoS) attacks. Websites, applications, and online services flooded with junk traffic are unable to serve legitimate users. Businesses lose revenue, budgets are strained, and customers lose faith. DDoS may not get the attention of ransomware headlines, but attackers are changing their tactics to launch larger, more sophisticated attacks. In this day and age, it’s easier to orchestrate for a range of purposes, including extortion, disruption, hacktivism, or hurting competitors’ bottom lines. Many are also powered by massive botnets made up of millions of compromised IoT devices. In this podcast episode of Security Strategist, host Richard Stiennon talks with Qrator Labs CTO Andrey Leskin about how these attacks are evolving and what organisations need to do to keep pace. They explore the growing scale and complexity of attacks, the role of massive botnets, practical approaches to DDoS mitigation, and how AI could accelerate existing attack capabilities. The Biggest Trend is ScaleLeskin started at Qrator Labs as a developer 14 years ago and worked his way up to chief technology officer. “I started off as the guy in IT who woke up at 3 a.m. because something stopped working,” Leskin tells Stiennon. “Now I’m the lucky guy who gets to wake up and try to fix things for our clients.” Today Qrator Labs manages cloud scrubbing infrastructure, bot management tools, and network monitoring services for hundreds of banks, betting platforms, e-commerce firms, media, education, tourism, and telcos throughout North and South America, Europe, the Middle East and Asia. That broad exposure gives him insight into the latest attack patterns. “Scale is the biggest trend,” Leskin says. An attack earlier this year topped two terabits per second and nearly one billion packets per second. It sustained that traffic rate for more than 40 minutes. During Q2, the company saw a doubling in terabit attacks (meaning attacks of one trillion bits per second or greater) year-over-year. “That used to be a super-rare once-a-quarter type of thing,” Leskin said. “Twelve is not unique. Bandwidth that used to be exceptional is now just regular Tuesday.” Botnets powering these attacks are getting bigger, too. One botnet monitored by Qrator since March of last year grew from around 1.5 million bots to over 13 million within about a year. The geographic diversity of infected hosts also continues to expand, making filtering traffic based on region less effective as an automated mitigation technique. Attacks are also easier to launch than ever before. Today attackers can find DDoS-for-hire services that simplify everything except deciding how much money they want to spend. Make the payment in cryptocurrency, paste in a target IP address or URL, and press launch. Many don’t need advanced technical knowledge. Decentralised command and control systems, including botnets using blockchain technology to coordinate activity, are complicating mitigation efforts further. Existing Mitigations Fall ShortA common DDoS myth, Leskin says, is the idea that hosting with a cloud provider or CDN somehow provides adequate protection from DDoS attacks. While a website or app might remain available, those services are designed to maximise uptime and performance, not fend off attacks specifically. Organisations are still on the hook for all of the network resources an attack consumes. “And then when the monthly bill arrives you realise you were DDoS’ed on your wallet,” Leskin said. Attackers are also leveraging multiple attack vectors more frequently. Instead of a single volumetric flood or application-layer attack, defenders might see both plus attempts to overwhelm other dependencies like a firm’s merchant processor. Leskin highlights how betting platforms saw an onslaught of attacks during the recent World Cup. Financial-services firms and fintech companies made up 44 per cent of DDoS attacks in Q1. That figure fell to 22 per cent in Q2 as attackers shifted their focus to gambling platforms, where attacks reached 1.5 terabits per second. Tips for Defending Against Tomorrow’s AttacksPreparing for these evolving threats starts with being operationally prepared, rather than buying into any one silver-bullet technology, Leskin said: Know and understand your normal traffic profile down to the protocol level and by time of day or season. Traffic during a World Cup final will look very different to normal operations for a betting platform.Expect blended attacks that use more than one vector designed to evade traditional DDoS mitigation systems.Botnets are nothing new, but blocking them is still important. In the first quarter of 2026, Qrator blocked an average of 2.5 billion malicious bot requests each month. While not considered DDoS, these attacks can still have a significant impact on performance.Have an incident response plan that you’ve practised so you can respond as quickly as possible when an attack happens. From a tech perspective, there are two main categories of DDoS mitigation, each with advantages and disadvantages: DNS-based protection Easy to implement; works well at mitigating attacks against websites and web applicationsDoesn’t work for everything routed outside of DNS, like voice services or game servers BGP-based mitigation Handles any type of network traffic at the network layer.You need to own your own network; can take up to one full day to implement. AI and DDoS AttacksLeskin says that he doesn't expect AI to introduce new types of attacks. Instead, he sees it accelerating what already exists, helping attackers scan for vulnerable devices faster, automate reconnaissance, and grow botnets more efficiently. In other words, AI mostly lowers the cost and skill threshold for doing what attackers already do. Combined with the rise of DDoS-for-hire services, pushes more of the "easy attack" trend described earlier. His closing point was less about tools than posture: "Security isn't a state you achieve one time. It's a process you maintain, because whatever you're defending against is actively evolving against you." The figures cited reflect Qrator Labs’ own network telemetry and provide a view into the attack trends observed across its protected infrastructure. While they do not represent the entire global DDoS landscape, they highlight a clear direction. For most organisations, the practical implication isn't "buy more bandwidth." It's building the muscle memory, traffic baselines, tested response plans, and mitigation that matches how you actually operate before an attack forces the issue. If you would like to learn more, visit qrator.net or follow Andrey Leskin on LinkedIn. TakeawaysThe scale and evolution of DDoS attacks from 2020 to 2026.The role of botnets and their growth in size and geographic diversity.Common motivations behind DDoS attacks.Limitations of CDN and cloud provider protections against DDoS.Best practices for organisations to assess and improve their DDoS resilience.Technical mitigation techniques including DNS and BGP-based protections.The importance of continuous security posture review.Future trends including AI-driven attack methods and multi-vector incidents Chapters00:00 Introduction to the episode and guest Andrey Leskin 01:04 Overview of Qrator Labs and their cybersecurity services 02:46 The evolution and scale of DDoS attacks from 2020 to 2026 04:09 Growth of botnets and their geographic diversification 05:22 Motivations behind DDoS attacks and attacker profiles 07:49 Limitations of CDN and cloud protections against DDoS 09:16 Technical mitigation strategies: DNS and BGP protections 11:21 Proactive customer acquisition and security readiness 13:06 Key checklist items for organisations to improve resilience 17:24 Technical defences: DNS and BGP mitigation explained 21:07 Current threat landscape across industries and sectors 24:16 Future of DDoS attacks and AI-driven threats

    Understanding DDoS Attacks and How to Defend Against Them

  5. 8月13日

    How to Prep Security Teams in Enterprise DLP Strategy for AI

    The biggest cybersecurity challenges when it comes to integrating AI platforms like Microsoft Copilot, ChatGPT Enterprise or any other AI agents for enterprises may seem to be pertinent to governance, acceptable use policies and employee training in AI. However, that is not always the case. Ultimately, it comes down to a challenge with the data. In the recent episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist, is joined by Itay Maor, Head of Product at Orion Security. They address the foundational issue with deploying agentic AI to enterprise workflows, which comes down to Data Loss Prevention (DLP). Maor begins the conversation with the statement: “Data loss is preventable. It's not just observable.” He adds that only by dropping assumptions built over 20 years of ineffective DLP can teams successfully make Data Loss Prevention work. What Is Hindering Enterprise Security from Adapting to an AI-First World?For enterprises to become a core part of an AI-first world, data must be protected from an early start. As soon as tools like Copilot or ChatGPT Enterprise enter the picture, sensitive data begins flowing into prompts. The issue is that security teams often lack visibility into what employees are inputting, such as customer records, deal terms, or source code. Firstly, blocking the AI is not going to work in this scenario because AI is here to stay. The issue that needs addressing is that security teams need to be able to see where the enterprise data is flowing. Maor believes AI hasn't created an entirely new security problem; it has exposed one that has existed for years. “Customer records, source code, deal terms- legacy DLP doesn’t help much because they were built to match patterns, credit card numbers, keywords. Pasting a Q3 revenue forecast into a chatbot won't trigger standard security alerts,” he says, putting it into context. “You approve ChatGPT Enterprise, but what if your employee just logged in using their personal account? Same URL, same interface, same browser, and your network controls say chatgpt.com and waves it through,” Maor adds. Security teams need to know which identity the data is flowing to. Right now, it's difficult for them to differentiate. The third layer, however, is where the market is heading because it depicts where the AI is connected to the data. For instance, Microsoft Copilot is wired into SharePoint and ChatGPT. Cloud connects to Google Drive, to Slack, and to email through native connectors. Meanwhile, the agents query internal systems on their own autonomously. “There is no upload, no paste, no human action to inspect at all,” the Head of Product at Orion tells Dua. AI agents end up inheriting 10 years of over-permisioning, he says; “it happily surfaces an M&A document to anyone with access that was never cleaned up, making it searchable in plain English.” Each of these three layers widens the gap that all controls can cover. So, the first challenge isn't blocking AI; it's that you can no longer answer where your data is going, and everything else in AI security starts with that question. How Security Teams Must Move From Detection to Data Loss PreventionMaor proposes that enterprises need to shift their mindset from detection to prevention, asserting that "Prevention is the goal, not just detection with good reporting. “Lead with the mindset before the tactics,” he advises enterprises, “data loss is preventable, and that should be the mindset, not just observable.” This means security teams must stop enumerating every risk as a policy up front, unlike before. Policies are essential for deterministic rules, and they’re not going away. If a rule says ‘PCI data never leaves production’, but the era of managing hundreds of policies is over. Another mindset shift is needed around false positives. Teams need to stop treating high false-positive rates as simply the cost of doing business. They're not some unavoidable force of nature. “They don't have to live with them. The problem is that when false positives become the norm, you train your team to ignore alerts—including the ones that actually matter,” he says to Dua. And finally, enterprises need to stop staffing around the problem instead of solving it. Adding more analysts to a queue that's growing faster than your headcount isn't a scalable strategy. It's better to reduce the noise than to keep expanding the team that's trying to manage it. As enterprises continue embracing AI, Orion's view is that the future of data security won't be defined by more dashboards or more point solutions. It will be defined by knowing where data is moving, understanding why it's moving and preventing loss before it happens. TakeawaysDLP tools are overwhelmed with false positives.AI can provide real-time contextual understanding.Traditional DLP systems are not equipped for modern data challenges.The future of data security relies on AI-driven solutions.Guardrails are essential for safe AI usage in enterprises.Real-time monitoring is crucial for effective data protection.Policies should be limited and focused on specific use cases.AI can recognise sensitive data patterns that traditional methods cannot.Data security must adapt to the rapid evolution of AI technologies.Education on new risks is vital for enterprises. Chapters00:00 The Evolution of Data Loss Prevention (DLP) 02:54 AI's Role in Redefining Data Security 06:12 Challenges of Traditional DLP Systems 09:02 The Need for Contextual Understanding in DLP 12:07 Guardrails for AI in Data Security 15:04 Transitioning from Policies to AI-Driven Solutions 17:54 Real-World Examples of Data Protection 20:49 The Future of DLP and Data Security Watch the full episode of The Security Strategist podcast to hear Itay Maor, Head of Product at Orion, discuss how AI is reshaping enterprise DLP and what security leaders should act on next. Visit orionsec.io. AI-native DLP, Data Loss Prevention, DLP, Enterprise DLP, AI Security, Enterprise AI Security, AI Data Security, Data Security, Microsoft Copilot, ChatGPT Enterprise, AI Agents, Agentic AI, Enterprise Data Protection, Sensitive Data, Cybersecurity, CISO, Contextual DLP, AI-Driven DLP, Data Loss Prevention AI, AI Security Strategy

    How to Prep Security Teams in Enterprise DLP Strategy for AI

  6. 8月12日

    Why Backup Immutability Doesn’t Guarantee Ransomware Recovery

    You’re in an argument with your AI bot on ChatGPT; suddenly, your screen is locked. None of the keys on your keyboard work, and then you see a ransom note displayed on the screen. The systems have been encrypted, and the incident response team has been activated. The executives go to the one thing they had been told would save them, which is the backups. Enterprises may believe their data is safe because of their immutable backups. But according to Mark Grazman, CEO of Fenix24, they are likely mistaken and often realise this after ransomware has already hit them. At some stage of a ransomware attack, the assumptions of cybersecurity come up against reality. In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, is joined by Mark Grazman, CEO and Co-Founder of the ransomware recovery company Fenix24. They discuss the critical aspects of ransomware resiliency, including the four pillars of recoverability—survivability, completeness, speed, and assurance. They also talk about how enterprises can better prepare for and respond to attacks. When Stiennon asked Grazman what's the thing he would assess that incident response playbooks miss if he walked into an active incident right now. Grazman says after a scoping call, he would ask the affected enterprise if their data was immutable. Most people say yes. “There’s an 84 per cent chance that they’re wrong,” he adds. “The attack already happened, the data's already gone, and they don't even know it yet.” The issue, he says that enterprises are practising and simulating that the data’s gone along with the infrastructure. “They're practising that there was a hurricane or a fire or a replication or an event as opposed to a true ransomware.” Also Read: Ransomware Attacks: What You Need to Know Find the latest cybersecurity insights, podcast episodes, and expert analysis on EM360Tech.cpm. Visit fenix24.com for more information. Takeaways84% of enterprises may be wrong about backup immutability.Surviving backups do not guarantee successful recovery.Ransomware recovery depends on four pillars: survivability, completeness, speed, and assurance.Critical applications rely on more infrastructure than enterprises often realise.Traditional disaster recovery tests may not reflect a ransomware attack.Cybersecurity budgets need more investment in recovery readiness. Chapters00:00 Introduction to ransomware resiliency and Mark Grazman's expertise01:20 Assessing incident response priorities in real-time attacks02:06 The myth of immutable data and common misconceptions03:06 Breaking down the four pillars of resiliency04:03 Survivability: Protecting critical data and dependencies05:02 Completeness: Ensuring full data and infrastructure recovery07:32 Speed: Rehydration, containment, and infrastructure considerations09:30 The importance of assurance and continuous testing11:09 Applying resiliency principles to other disasters12:37 The gap between enterprise expectations and reality13:05 Evolving offence and defence in ransomware protection14:39 Pre-attack preparedness and the Argos platform16:06 The process of resiliency assessment and tuning19:18 Organisational roles and collaboration for effective recovery21:18 Key message for CISOs, CIOs, and CEOs on resiliency23:30 Closing remarks and resources for further information

    Why Backup Immutability Doesn’t Guarantee Ransomware Recovery

  7. 8月12日

    Why Identity Is Becoming Security's New Front Line

    Security teams around the world have always tried to play a balancing act when it comes to authentication. If there are too many measures put in place, people will always find a way to get through it. In the world of rapid AI advancement, this balancing act is proving to be more difficult for organisations. The reason is that AI agents proliferate; they're now able to perform tasks on behalf of employees and customers without a human overseeing every action. So what needs to be done to prevent your organisation from being exposed? On this episode of the Security Strategist Podcast, host Trisha Pillay talks with Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, about how and why identity has become the new security perimeter. Moore has worked for almost six years at FusionAuth, starting in developer relations before stints in sales engineering and implementation prior to his current role. At FusionAuth, he helps track standards bodies like the IETF and OpenID Foundation and determines which fledgling methods are ready for adoption into the product. The Security-Usability Tension Gets SharperFinding the right balance between strong security and a smooth user experience is a challenge organisations have faced for years. Moore traces it back to the invention of the first password field in the 1960s. Various industries have adopted different approaches to ensure that there is a balancing act of strong security and a smooth user experience for their customers. For example, banks are willing to require more security checks than a consumer app because the risks are so much higher. The old methods of authentication were designed for a world where every login belonged to a person making decisions at human speed. This has all changed now because of AI agents. Unlike people, AI agents can work independently, run continuously, and complete thousands of tasks in seconds. This speed and scale mean they can also cause far more damage in a matter of seconds if something goes wrong. AI agents need to work independently, so traditional human-focused security measures like MFA and CAPTCHAs often get in the way. It's also important to know that removing those checks doesn't just eliminate the security risks. This simply means those risks can happen so much faster. At the same time, asking humans to approve everything isn't a solution either, because people quickly become overwhelmed and stop paying attention. Adaptive Authentication in PracticeThis is where identity is shifting from a single check at the door towards continuous and contextual verification. Moore describes it as moving away from a binary model, because risk no longer lives only at the login screen. It follows the session, the device and the ongoing behaviour within an application. FusionAuth worked with a platform connecting caregivers with families needing support, a sector handling sensitive data including that of minors. By adding enterprise single sign-on and multi-factor authentication, the company cut its authentication development time by 90 per cent and opened up business markets it previously couldn't serve, proof, Moore says, that tighter security and a better user experience aren't mutually exclusive when the approach is intelligent about context. Giving AI Agents Their Own IdentityOne of the biggest shifts discussed is the need to stop thinking of AI agents as just another user account. Instead, organisations need to manage them as separate digital identities with their own permissions and controls. Moore recounts a colleague mentioning they would let an AI assistant drive their browser while logged in as themselves. This becomes indistinguishable, from the system's perspective, from the person acting directly. Without a separate identity, there's no way to apply different policy, add extra checks, or restrict what an agent can do relative to its human counterpart. With all that said, it's no wonder that AI agents need their own identities, provisioning, and scope, along with their own audit trail. The risk comes down to velocity. A compromised employee can only do so much before they're detected, but a misbehaving AI agent can make thousands of decisions, access systems, and execute actions in the same amount of time. Moore frames trust as resting on three interlocking layers: identity validation, audit, and policy enforcement. Validation establishes who or what is acting; audit records what actually happened, which matters given how unpredictable agent behaviour can be; and policy enforcement, built on principles like least privilege and short-lived, task-scoped credentials, limits the damage if something goes wrong. All three layers work together to build trust, he says, because each one compensates for what the others struggle to catch alone. His advice for organisations still finding their footing is to start small rather than wait for a polished strategy: inventory the AI agents and automated processes already running, note what kind of credentials they rely on, and begin shifting static API keys towards short-lived, standardised grants. Above all, he argues, AI identities deserve their own category tied to an accountable human or team, but never simply reused from existing human or service accounts. If you would like to find out more about this, visit FusionAuth or connect with Moore on LinkedIn. TakeawaysThe changing role of identity in security.Challenges of AI-powered applications and autonomous agents.Adaptive authentication and risk-based security.Building trust through identity validation, audit, and policy enforcement.Practical steps for organisations to enhance security in AI environments. Chapters00:00 Introduction 01:28 Guest background and role at Fusion Auth 03:07 The security-usability tension in identity management 04:13 Impact of AI and autonomous agents on security 05:56 Balancing security controls with user experience 09:02 The shift to adaptive, context-aware authentication 11:48 Real-world example of security and usability balance 14:04 AI identities versus human identities 17:53 Building trust in AI systems with layered security 23:34 Practical steps for organisations to prepare for AI security 27:30 Closing remarks and resources

    Why Identity Is Becoming Security's New Front Line

  8. 8月11日

    Defensible Prioritisation: A Story CISOs Can Stand Behind

    Prioritisation is the way to tackle enterprise data challenges. It may seem like a simple solution, and it might be too. If you’re an enterprise overwhelmed by vulnerabilities in data, especially with the evolution of AI and automation, this conversation is for you. In the recent episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360Tech, sat down with James Walta, Vice President of Product Management at Brinqa. The agenda for this episode was to break down why enterprises are overwhelmed by vulnerability data. Additionally, Walta lays out a strategic plan of action to help enterprises prioritise vulnerabilities proactively rather than reactively. The discussion builds on the previous episode, where Brinqa CSO Brad Hibbert and host Richard Stiennon, Chief Research Analyst at IT-Harvest, talked about how AI is helping attackers with faster scanning, smarter exploit chaining, and machine-speed intrusions. Walta continues this conversation with EM360Tech’s Dua, focusing on prioritisation in exposure management strategies. He puts up a case noting AI will not rescue security teams from unorganisation unless the underlying data is ‘good’ and reliable. TakeawaysContext is crucial for effective cybersecurity management.The chaos in cybersecurity is amplified by AI-driven vulnerabilities.Data quality is foundational for prioritisation and remediation.Patching faster is not always the best approach; understanding risk is key.Operational clarity can be achieved by unifying asset visibility.Prioritisation must be based on business context and asset sensitivity.AI can help but may also amplify confusion if data is poor.CISOs should focus on outcome metrics rather than activity metrics.Effective vulnerability management requires a clear understanding of ownership.The conversation around cybersecurity must evolve to address real risk reduction. Chapters00:00 Navigating Cybersecurity Chaos02:52 The Importance of Context in Cybersecurity06:07 Bridging the Gap: From Vulnerability Detection to Remediation09:09 Understanding Risk Over Speed11:46 Enhancing Data Quality for Better Decision Making14:57 Operational Clarity: Transforming Overload into Insight18:05 Measuring Success Beyond Vulnerability Counts Visit brinqa.com for more information on how enterprises should prioritise vulnerabilities proactively. Vulnerability Management, Exposure Management, Cybersecurity Strategy, AI in Security, Risk Prioritisation, Brinqa, EM360Tech, The Security Strategist, Cyber Risk, Data Quality, CISO, Threat Exposure Management, Asset Visibility, IT Security, Risk Reduction, James Walta

    Defensible Prioritisation: A Story CISOs Can Stand Behind
すべて見る（246）

番組について

With cyber attacks more common than ever before and each attack becoming increasingly sophisticated, security teams need to be one step ahead of cybercrime at all times. “The Security Strategist” podcast delves into the depths of the cybercriminal underworld, revealing practical strategies to keep you one step ahead. We dissect the latest trends and threats in cybersecurity, providing insights and expect-backed solutions to protect your organisation effectively. Tune into this cybersecurity podcast as we dissect major threats, explore emerging trends, and share proven prevention strategies to fortify your defences.

情報

  • クリエイター
    EM360Tech
  • 配信期間
    25年 - 26年
  • エピソード
    246
  • 制限指定
    不適切な内容を含まない
  • Copyright
    © Copyright 2026 EM360Tech
  • 番組のWebサイト
    The Security Strategist