Cloud Security Podcast by Google

Anton Chuvakin

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We're going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject's benefit or just for organizational benefit. We hope you'll join us if you're interested in where technology overlaps with process and bumps up against organizational design. We're hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can't keep as the world moves from on-premises computing to cloud computing.

  1. 9 HR AGO

    EP276 AI Governance vs. The Hyper-Velocity Agentic Future: A Lawyer's Take

    Episode co-host: Marina Kaganovich, Enterprise Trust Lead, Office of the CISO, Google Cloud  Guest: James Sherer, Partner at BakerHostetler  Topics Is AI just an emerging technology or something bigger, deeper and different?  Is this another emerging technology or a fundamental shift? How to effectively govern something that is rapidly changing at unprecedented velocity?  We navigated the governance of the Internet and SaaS. What makes AI governance fundamentally different from the "Classic IT" or Data Governance models of the past? As we move toward Agentic AI, the line between tool and teammate blurs. Should we be governing AI agents through the lens of Technical Controls or Human Resources and behavioral contracts?  What if we hand even more responsibility to AI? Where are the tipping points as we shift from assistance to autonomy? How to avoid unintended, negative consequences when setting policy, contrasting risk-based vs. rights-based regulation and regulatory expectations Give us some practical takeaways for a defensible AI program - if an organization had to defend its AI program to a regulator or a judge tomorrow?  Related episodes: Video version EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP237 Making Security Personal at the Speed and Scale of TikTok

    36 min

  2. 4 MAY

    EP275 Google Cloud Next 2026: The AI Earthquake, "SOC-home" Syndrome, and the Ragged Edge of Reality

    Guests: No guests  Topics: So what have we seen at Google Cloud Next 2026? Any closing loops for our 2023-2025 Cloud Next observations? We are seeing that AI security is not an island ... what does that tell us about the difference between cloud and AI adoption? What does  "ragged edge of AI adoption" mean for security? Why do people want agents in their SOC? Do they know what gets better? What are the most notable and fun announcements? With patching speed, are we looking at something which can be overcome by engineering and courage? Or are we looking at something that is truly an impossibility?  Resources: Video version EP221 Special - Semi-Live from Google Cloud Next 2025: AI, Agents, Security ... Cloud? Next '26: Redefining security for the AI era with Google Cloud and Wiz Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So? EP169 Google Cloud Next 2024 Recap: Is Cloud an Island, So Much AI, Bots in SecOps Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever EP137 Next 2023 Special: Conference Recap - AI, Cloud, Security, Magical Hallway Conversations 260 things we announced at Google Cloud Next '26 – a recap

    20 min

  3. 27 APR

    EP274 AI, Zero Trust and Secure by Design Walk into a Bar...

    Guest: Grant Dasher, ex-CISA, ex-Google, Distinguished Engineer, Google (again) Topics: Why is the  "Secure-by-Design" movement gaining so much momentum now, and is it a response to the failure of "bolted-on" security, or just a natural evolution of cloud maturity? In a future Secure-by-Design world, is identity the only perimeter that actually matters anymore? Or is this a cliche? As we move toward a world of autonomous agents, how does our approach to machine identity need to change? Are we just talking about more complex Service Accounts, or do we need a fundamental shift in how we authorize "intent" What is your  advice  to people who want to move fast and cannot wait for Secure by Design / Default  AI to be decided by consensus or IETF, NIST or OASIS committee? We love the argument that modern AI agents are effectively repeating the mistakes of 1960s payphones - mixing the data plane and the control plane. What is your rebuttal? How do we build "Agentic Security" that doesn't fall for 60-year-old traps? Customers are torn between their Zero Trust implementations and their AI adoption. Is Zero Trust now "legacy," or is it the prerequisite for everything we're trying to do with AI agents?   Is there Zero Trust for AI? Is this a fake buzzword or technical reality? Resources: Video version EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance EP133 The Shared Problem of Alerting: More SRE Lessons for Security EP85 Deploy Security Capabilities at Scale: SRE Explains How Google SRE books "Atomic Accidents" book (yes, really)

    30 min

  4. 20 APR

    EP273 From CISA to Cloud: AI Assurance, Concentration Risk, and the New Regulatory Frontier

    Guest: Jeanette Manfra, VP, Head of Risk and Compliance, Google Cloud Topics: How does "outsourcing" security to the cloud change the intensity of the security vs. privacy struggle for a CISO? Does the centralization of cloud make it a bigger target for regulators, or is there a dimension we're missing? Does the Shared Responsibility Model actually survive contact with regulators, and how does AI complicate that boundary? Can AI actually automate the translation of fragmented rules into evidence, or are we just dreaming? How do we navigate the collision between transparency (logging everything) and privacy (recording nothing)? What is your one piece of practical advice for leaders helping their teams adopt AI? Resources: Video version EP14 Making Compliance Cloud-native EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment?

    29 min

  5. 13 APR

    EP272 More Than Just Packets: Is NDR a "First-Class" Cloud Security Control?

    Guest: Raja Mukerji, Co-Founder & Chief Scientist, Extrahop Rafal Los, VP of Client Relations and Strategic Initiatives, Extrahop Topics: Is Network Detection and Response (NDR) coming back after being shoved to the side by EDR a bit? Is this for real? What's the value proposition of NDR in 2026, because some people still don't understand it? How does NDR apply to the world of WFH, cloud/SaaS, encryption, high bandwidth, etc? Is the value of NDR the same, or different, when it comes to public (or private) cloud? How does NDR fill visibility gaps that identity and agent-based solutions cannot? What does NDR offer that built-in cloud security tooling (as of right now) does not? Would you call NDR a key cloud security control? Does NDR help with shadow AI? NDR elephant in the room is sometimes cost. How does cost change the value prop when compared to on-premise or physical infrastructure? Resources: Video version EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty EP113 Love it or Hate it, Network Security is Coming to the Cloud EP154 Mike Schiffman: from Blueboxing to LLMs via Network Security at Google EP115 How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer? EP263 SOC Refurbishing: Why New Tools Won't Fix Broken Processes (Even With AI) "The GC+CISO Connection Book" book

    34 min

  6. 9 APR

    EP271 Can AI-Native MDR Actually Fix Your Broken SOC Workflows or Just Automate the Mess?

    Guests: Eric Foster, CEO, Tenex.AI Bashar Abouseido, President,  Tenex.AI Topics: "10X SOC" sounds great.  But for an organization stuck in "SIEM 1.0" with poor data quality and manual workflows, is "AI-native MDR" a "leapfrog" opportunity or a recipe for disaster? We've seen the rise of "Decoupled SIEM" and security data lakes. Does a "Modern SIEM" even need to exist if an MDR platform has an agentic layer doing the heavy lifting?  You've argued for AI-native over AI-bolted-on. For an end user, what are the tangible differences of using "AI inside a legacy SIEM" versus using an "AI-native separate product"? What is the one task you thought AI would handle by now that still requires a senior human analyst to step in? If a CISO is using an AI MDR, "Mean Time to Detect" (MTTD) starts to look like a vanity metric because the machine is instant. What is the new golden metric for an AI-powered SOC? Is it "Time to Context," "Reduction in Human Toil," or something else? How do you help a skeptical SOC Manager—who has been burned by false positives for a decade—trust an autonomous agent to perform a "containment" action at 3:00 AM?   Resources: EP227 AI-Native MDR: Betting on the Future of Security Operations? EP10 SIEM Modernization? Is That a Thing? The original "10X" paper "Autonomic Security Operations: 10X Transformation of the Security Operations Center"

    27 min

  7. 6 APR

    EP270 The Convenience Tax: Why We Keep Failing at Supply Chain Security

    Guest: Dan Lorenc, Founder / CEO, Chainguard Topics: We just saw a security tool (Trivy) get used to pop an AI infrastructure tool (LiteLLM) to eventually pop end users. Have we reached the point where our security tooling is actually our largest unmanaged attack surface?  Why now? Software supply chain security had the perennial vibe of "not top concern" for most organizations, right? TeamPCP pushed malicious code to existing GitHub tags. We've been screaming about pinning versions to SHAs for years, but clearly, nobody is listening. Is it time to admit that 'convenience' is the primary enemy of supply chain security? The Axios incident showed a victim compromised in under two minutes. In a world of auto-updating dependencies, is the concept of a human-in-the-loop for software updates officially dead, or do we need to look very hard at version pinning and such? With XZ Utils case, we saw a long-game social engineering attack. Beyond just 'watching npm closely,' what are the realistic architectural safeguards for an org that knows they can't audit every line of an update? We've spent the last three years talking about SBOMs (Software Bill of Materials) like they were a pill for supply chain health. But if the scanner producing the SBOM is the one that's compromised, isn't the SBOM just a signed receipt for your own house being on fire?  What is the one practical thing they can do to ensure their CI/CD isn't a credential-exfiltration-as-a-service platform? Resources: Video version North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack EP100 2022 Accelerate State of DevOps Report and Software Supply Chain Security EP116 SBOMs: A Step Towards a More Secure Software Supply Chain EP226 AI Supply Chain Security: Old Lessons, New Poisons, and Agentic Dreams EP24 Linking Up The Pieces: Software Supply Chain Security at Google and Beyond Matt Levine blog

    27 min

  8. 30 MAR

    EP269 Reflections on RSA 2026 - Beyond AI AI AI AI AI AI AI

    Guests: No guests! Just Tim and Anton Topics: Hard to believe we've been doing these since 2022, is that right? What did we see this year at RSA, apart from AI? And more AI? And more AI? What framework can we use to understand the approaches vendors take to AI and security? Just saying "AI washing" is not enough! How to tell "AI washer" from "AI tourist"?  I sense that "securing AI" (and agents) is finally growing as fast as "using AI for security", do you agree? Is the AI vulnerability apocalypse coming? Soon? Have we seen any signs of AI backlash? Resource: Video version EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025 RSA 2025: AI's Promise vs. Security's Past — A Reality Check blog EP172 RSA 2024: Separating AI Signal from Noise, SecOps Evolves, XDR Declines? EP119 RSA 2023 - What We Saw, What We Learned, and What We're Excited About EP70 Special - RSA 2022 Reflections - Securing the Past vs Securing the Future EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance

    33 min
See All (277)

Trailer

About

Cloud Security Podcast by Google focuses on security in the cloud, delivering security from the cloud, and all things at the intersection of security and cloud. Of course, we will also cover what we are doing in Google Cloud to help keep our users' data safe and workloads secure. We're going to do our best to avoid security theater, and cut to the heart of real security questions and issues. Expect us to question threat models and ask if something is done for the data subject's benefit or just for organizational benefit. We hope you'll join us if you're interested in where technology overlaps with process and bumps up against organizational design. We're hoping to attract listeners who are happy to hear conventional wisdom questioned, and who are curious about what lessons we can and can't keep as the world moves from on-premises computing to cloud computing.

Information

You Might Also Like