Security Cocktail Hour

Joe Patti and Adam Roth

Security veterans Joe Patti and Adam Roth welcome a diverse lineup of cybersecurity and information security experts to share their insights at the virtual bar. From cutting edge topics like AI and Operational Technology (OT) to the realities of careers and mental health, you'll get the inside view of what's happening across the industry and what it's really like to work in these fields, from the people who do it every day. Reach us at feedback@securitycocktailhour.com or @SecCocktailHour on Twitter.

  1. 4h ago

    Anna Beck: Rewriting the Laws of War for Cyberspace

    Aid groups like the Red Cross work in nearly every war zone, and they hold some of the most sensitive data there is: missing persons, prisoners of war, even biometrics. Anna Beck joins co-hosts Joe Patti and Adam Roth to talk about what happens when that data, and the systems behind it, become a cyber target. The laws of war weren't written with cyberspace in mind. Anna explains why, in her reading, a cyberattack that knocks an aid group offline may not legally count as an "attack," or a war crime. Then: who actually enforces the Geneva Conventions, why the Tallinn Manual's own experts disagree, and why the Red Cross is building a digital emblem that isn't a firewall. In this episode: - 1:54 What humanitarian organizations are, and why they're exposed - 9:46 Is hacking an aid group a no-no? The Geneva Conventions - 22:10 When is a cyberattack an "attack"? - 28:01 Not an attack, not a war crime - 33:26 Who enforces the laws of war? - 40:31 Cyber doesn't even have a baseline yet - 52:34 The Red Cross Digital Emblem Project - 57:59 The emblem isn't a firewall Anna Beck is a coordinator at AOBP, the Defence and Security Industry Association of the Czech Republic, and an international relations graduate student at Prague University of Economics and Business. Her peer-reviewed chapter, "Protecting Humanitarian Organizations in Cyberspace," appears in the CyCon 2026 proceedings from the NATO CCDCOE. Recorded in two sessions in July 2026. The Security Cocktail Hour: https://securitycocktailhour.com

  2. Oct 6

    Antonia-Laura Pup: They Didn't Need to Change the Vote Count

    Election security expert Antonia-Laura Pup talks with co-hosts Joe Patti and Adam Roth about how attacks are coming not just from the cyber world, but also through influencers and social media. Romania had to annul an election in response. And the small nation of Moldova fought back with the tools Antonia believes other countries will need to deploy to defend democracy. Antonia is a Romanian security researcher focused on these issues in her home country and others. In this episode: Why Romania's presidential election was annulled and why explaining that decision mattered.What the declassified reports on the Romanian election described about coordinated TikTok accounts, influencer payments, and attacks on election systems.20:32 How the annulment deepened public distrust in Romania.26:34 How Moldova handled their own election interference issues.32:08 Moldova's pre-election disclosures, public warnings, civil-society fact-checking, and outside cyber help formed its response.43:29 The wider lesson: why Antonia sees political will, not just technical capacity, as decisive, and why she does not want the military policing people's minds.57:11 EU cyber sanctions: a potential response to cyberattacks, but too slow to be the whole answer.

  3. Sep 29

    Cyber Insurance Beyond Data Breaches | Michelle Faylo

    What does a cyber policy cover when technology risk reaches beyond stolen data? AI-related mistakes, reliance on vendors, business interruption, and physical consequences can raise different questions for different kinds of insurance. One policy cannot be assumed to answer them all. Michelle Faylo, Lockton's U.S. Cyber & Technology Leader, joins Joe Patti and Adam Roth to unpack cyber coverage and technology E&O; first- and third-party loss; physical versus nonphysical consequences; a competitive insurance market; and why war exclusions become difficult when attribution is contested. Michelle also talks about the controls insurers look for, broker conversations throughout the policy year, and what CISOs and boards need to understand before renewal. This episode is a general discussion, not insurance or legal advice. Michelle Faylo at Lockton: https://global.lockton.com/us/en/news-insights/lockton-names-michelle-faylo-u-s-cyber-and-technology-leaderSecurity Cocktail Hour: https://securitycocktailhour.com/ #CyberInsurance #TechnologyRisk #RiskManagement

  4. Aug 18

    Michael Simmons: Raw Vulnerability Scans Are Not Security

    Running a vulnerability scan is easy. Deciding what matters, what is noise, and what a business should do next is the real work. Michael Simmons, founder of Elysium Trace, joins Joe Patti and Adam Roth to discuss business-focused vulnerability reporting for MSPs, IT consultants, and smaller security teams. They cover false positives, context, risk acceptance, repeatable reporting, automation, and why human judgment still matters. Michael describes Elysium Trace and its product approach from his own experience. Learn more: https://elysiumtrace.com/

  5. Jul 22

    Gaurav Keerthi: Why Most Companies Can’t Afford Cybersecurity

    Cybersecurity was built for enterprises. Gaurav Keerthi explains what that leaves behind for the companies without a cyber team, and why their exposure becomes everyone else’s problem. Gaurav, CEO of StrongKeep and a cybersecurity leader in the public and private sectors, joins Joe Patti and Adam Roth to break down why smaller organizations are still expected to buy, operate, and manage enterprise-style security. They discuss supply-chain risk, the “hopes and prayers” gap, cybersecurity’s IKEA problem, and what a usable baseline could look like for ordinary companies. Episode Takeaways: Most organizations do not have a dedicated cybersecurity professional.Enterprise security programs cannot fully protect an organization when exposed suppliers remain unprotected.Security products need to be simpler, more bundled, and more realistic for companies without specialist teams.Doing something proportionate is better than doing nothing while waiting for a perfect plan. Guest: - Gaurav Keerthi, CEO, StrongKeep - LinkedIn: https://sg.linkedin.com/in/gaurav-keerthi - StrongKeep: https://www.strongkeep.com/ Resources: - CyCon: https://cycon.org/ - NATO Cooperative Cyber Defence Centre of Excellence: https://ccdcoe.org/ Security Cocktail Hour Podcast: - https://securitycocktailhour.com

  6. Jul 8

    Eva Galperin: Stalkerware, Surveillance, and Real-World Harm

    Eva Galperin explains how stalkerware, ordinary phone access, coercion, and weak privacy defaults can let someone close create devastating real-world harm. In this episode, we cover: What stalkerware is and why hiding from the user mattersWhy intimate-partner abuse changes the cybersecurity threat modelPrivacy as consent and control, not isolationWhy end-to-end encryption is not magic if the endpoint is compromisedPassword managers, VPN myths, patching, and backupsWhat security teams miss when they only focus on exotic adversariesGuest: Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation and co-founder of the Coalition Against Stalkerware. Resources: EFF Surveillance Self-Defense: https://ssd.eff.org/Coalition Against Stalkerware: https://stopstalkerware.org/

  7. Jun 30

    Full Interview: Chad Butler on Drones, AI, and Autonomous Failure

    This is the full interview version of our conversation with Chad Butler. Chad previously worked in product security at Amazon and was involved with Prime Air, Amazon's drone delivery program. He joins Joe Patti and Adam Roth to talk about drone delivery, FAA rules, GPS spoofing, detect-and-avoid, ADS-B, autonomous vehicles, AI agents, and the engineering culture needed when software failures can become physical-world safety failures. Topics include: Prime Air and product securitycommercial drone delivery riskPart 107 and Part 108beyond visual line of sight operationsGPS spoofing and drone capturedetect-and-avoid vs right of wayADS-B tradeoffswhy pilots may not reliably see dronesautonomous vehicles and AI agentsadversarial inputs and edge casespublic trust after catastrophic failuresChallenger, Feynman, and ignored engineering warnings

  8. Jun 26

    Autonomous Systems Have a Security Problem with Chad Butler

    Autonomous systems are already moving into the physical world. Drones can fly themselves, robot taxis are carrying passengers, and AI systems are taking more action without direct human control. Chad Butler joins the Security Cocktail Hour to explain why that changes the risk model. The issue is what happens when autonomous systems make real-world decisions from sensor data, routing logic, and AI-driven judgment that may be wrong, spoofed, or manipulated. In this feature version, Chad talks with Joe Patti and Adam Roth about: GPS spoofing and drone capturebeyond visual line of sight drone operationstrusted and untrusted sensor dataAI agents and autonomous vehicleswhy optimal-environment testing is not enoughwhy "nobody will do that" is not a defensehow cyber failures can become safety failureswhat Challenger and Feynman still teach us about launch pressure and ignored warningsThis is a feature cut of the conversation. Th full interview will be released soon.

See All (89)

4.8
out of 5
5 Ratings

About

Security veterans Joe Patti and Adam Roth welcome a diverse lineup of cybersecurity and information security experts to share their insights at the virtual bar. From cutting edge topics like AI and Operational Technology (OT) to the realities of careers and mental health, you'll get the inside view of what's happening across the industry and what it's really like to work in these fields, from the people who do it every day. Reach us at feedback@securitycocktailhour.com or @SecCocktailHour on Twitter.

Information

  • Creator
    Joe Patti and Adam Roth
  • Years Active
    2023 - 2026
  • Episodes
    89
  • Rating
    Explicit
  • Copyright
    © Joe Patti and Adam Roth
  • Show Website
    Security Cocktail Hour