Safe Mode Podcast

Safe Mode Podcast
  • 4.9 (8)
  • News
  • Updated Weekly

Podcast by Safe Mode Podcast

  1. 14h ago

    The SOC wasn't built for this

    Security operations centers have run on the same playbook for decades — collect, queue, triage, investigate, escalate. But attackers now move at machine speed: one recent breach that cost a company 3,600 repos got underway in roughly 87 seconds, far outpacing even a fast 10-minute log-enrichment pipeline. This week, host Greg Otto talks with ExtraHop CEO Greg Clark about the newly announced Agentic SOC Alliance and why he believes traditional SOC architecture can't keep up. Clark breaks down the three-layer stack he says every CISO needs to understand — context (the historical and real-time data an agent needs to reason about a threat), harness (the governance layer controlling what an agent can do, how it's tested, and how it audits its actions), and model (the LLM doing the reasoning, one of nearly 100 that ExtraHop benchmarks in an internal ""arena""). The conversation digs into some pointed findings: Chinese-origin models like Qwen consistently outperform on complex breach-reasoning tasks in ExtraHop's testing, a result Clark attributes to strong adversarial training data translating into strong defensive reasoning. He also makes the case for staying model-agnostic, since a new front-runner can emerge overnight — pointing to a Microsoft release just days before this recording. Much of the discussion centers on where humans still fit in. Clark describes today's dominant pattern — agents running in parallel ""investigate mode"" while analysts watch and validate — and predicts bounded, agent-driven response will expand faster than most expect, once governance and audit trails give leaders enough confidence to hand over execution on certain incidents, while higher-stakes systems like trading floors keep a human firmly in the loop. He closes by outlining what's next for the Alliance: growing membership, pushing toward published, vendor-neutral standards, and building the benchmarking needed to prove agentic SOC tools actually work before going into production.

    The SOC wasn't built for this

  2. Jul 30

    Why Cybersecurity is at the heart of the US-China AI race

    The US-China AI competition has quietly become a cybersecurity arms race, and this week made that impossible to ignore. Booz Allen's Brad Medairy joins Safe Mode to unpack the milestones behind that shift — from China's Villager red-teaming framework to last December's frontier model jailbreak — and a report his team ran finding Chinese models like DeepSeek, Qwen, and Kimi carry policy bias and generate more vulnerable code when prompted in US government contexts. Medairy digs into the hard questions: whether banning Chinese open-weight models like Z.AI/GLM is even feasible, why CISOs are unknowingly running them under different names, and how agentic tools can compromise a network in six minutes while analysts miss it for 48. He also covers real-world breaches — an Ethiopian hacker using Claude and Codex to hit 14 US companies, and OpenAI's model escaping its boundaries to compromise Hugging Face — and closes on whether the US simply out-innovates China or finds room for guardrails when only one side is playing by them.

    Why Cybersecurity is at the heart of the US-China AI race

  3. Jul 23

    A builder's view of the AI arms race

    It's been a wild six weeks for frontier AI models — Mythos launched, got yanked offline by the Department of Commerce over export controls, and came back online with new guardrails, all while Five Eyes agencies warned that AI is months away from reshaping the threat landscape. This week on Safe Mode, Greg Otto talks with Armadin's David Slater, who is building directly on top of these frontier models, creating a platform integrating AI into cybersecurity offense and defense. The two dig into what it was actually like watching America's leading models go dark just as Chinese models — namely GLM 5.2 — closed the gap on intelligence, endurance, and something the guest calls "willingness": a model's readiness to be used for offensive cyber purposes without the safeguards baked into Western frontier labs. The conversation covers why export controls and "kill switches" on U.S. models may not actually blunt adversary capability given the availability of open-weight alternatives, why intelligence and endurance alone aren't enough without a wide enough "aperture" to see an entire attack surface, and why a small circle of well-resourced defenders working with frontier labs isn't sufficient to protect the hundreds of thousands of organizations and critical infrastructure operators left without that access. They also get into where AI is already reshaping attacker-defender asymmetry — credential stuffing, ransomware, and lateral movement — and where the next capability walls may fall, from reverse-engineering patches to longer-range vulnerability chaining. The guest closes with a pointed message for security teams: the technology is arriving faster than most organizations' ability to act on it, and the real gap isn't intelligence — it's whether your people and processes can move at "wartime" speed when a serious threat shows up.

    A builder's view of the AI arms race

  4. Jul 16

    What the Section 702 lapse means for cybersecurity

    For the first time in its operational history, FISA Section 702 has lapsed, plunging U.S. intelligence agencies and telecom providers into a highly uncertain "grey zone." In this episode of Safe Mode, host Greg Otto sits down with Glenn Gerstell, former NSA General Counsel and senior adviser at the Center for Strategic and International Studies (CSIS), to navigate the fog of this unprecedented lapse. While the government is temporarily coasting on grandfathered certifications, the operational reality is getting increasingly dicey. Gerstell explains what this lapse actually means for the future of U.S. cyber defense, how political friction is complicating long-term planning, and why temporary stopgaps are creating unnecessary hurdles for the agencies trying to keep us safe.

    What the Section 702 lapse means for cybersecurity

  5. Jul 9

    What the post-quantum executive order means for CISOs

    In this week’s episode, Greg speaks with Ellen Boehm, SVP of Strategy and AI Operations at Keyfactor, about what the administration’s post-quantum cryptography executive order means for CISOs and enterprise leaders. Boehm argues that preparing for post-quantum cryptography is not just a technical cryptography challenge, but a leadership and business-risk problem. The conversation covers why compliance deadlines are pushing organizations to act, how CISOs should frame quantum risk for boards and executives, and why cryptographic inventories are a critical first step for any serious migration plan. The discussion also explores how organizations can build cross-functional teams across security, IT, legal, procurement, engineering and product groups; why visibility into cryptographic assets remains so difficult; and how AI, machine identities and crypto agility are converging with the post-quantum transition. Boehm also lays out the key questions enterprises should be asking now as they prepare for deadlines that are quickly moving from future concern to present-day planning reality.

    What the post-quantum executive order means for CISOs

  6. Jul 2

    How security investigators can get the right info out of AI security tools

    This week on Safe Mode, Greg sits down with Dov Yoran, CEO and co-founder of Command Zero, to talk about one of the most persistent problems in enterprise security: the investigation gap. Alert volumes keep climbing, SOC teams are drowning in triage, and the tools meant to help are aggregating data without actually reasoning through it. Dov breaks down how the real bottleneck in security operations comes down to expertise — knowing what questions to ask, where to find the data, and how to build a narrative around it. He explains how Command Zero has codified years of SecOps and incident handling experience into a knowledge base shared by both human analysts and AI agents, creating a structured and fully auditable approach to autonomous investigation, one where every question asked and every conclusion drawn is visible and replayable. The conversation gets into how AI is fundamentally changing the shape of the SOC. The tiered escalation model is giving way to something new, where agents handle the repetitive work of collection, timelining, and report writing and analysts operate more like coordinators than ticket processors. Whether that shift is gradual or sudden, and exactly where the human stays in the loop, is a question Dov and Greg wrestle with. In our reporter chat, Greg talks with Tim Starks about the Supreme Court's decision in Chatrie v. The United States

    How security investigators can get the right info out of AI security tools

  7. Jun 25

    Inside Operation Disruption Week: Taking Down Southeast Asia's Scam Machine

    What does it actually take to dismantle an industrial-scale scam operation running bulletproof hosting, distributed ASNs, and crypto laundering across multiple countries? Mike Sweeney of Silent Push was in the room during Operation Disruption Week and tells us exactly how it went down — the intelligence, the coordination, and why this public-private model could be a blueprint for future cyber disruption efforts. Plus, reporter Tim Starks on the open source supply chain crisis: the volunteer maintainers holding up the internet, the threat groups coming after them, and the policy vacuum left behind after the Biden administration's momentum stalled.

    Inside Operation Disruption Week: Taking Down Southeast Asia's Scam Machine

  8. Jun 18

    Zero days, zero order: The chaos reshaping vulnerability disclosure

    The rules of responsible disclosure were written for a different era — one where humans found bugs, humans reported them, and 90 days felt like plenty of time to patch. That era is over. In this episode, Greg sits down with Gal Elbaz, co-founder and CTO of Oligo Security, to unpack how AI-assisted vulnerability research is breaking the frameworks the security industry has relied on for decades. From MITRE admitting it can no longer keep up with the volume of CVE reports, to Linus Torvalds saying the same about the Linux kernel, the cracks in the system are impossible to ignore. Gal draws on his years as a hands-on researcher at Check Point — and his current work leading Oligo's research team — to offer perspective from both sides of the disclosure table. He and Greg dig into the Microsoft controversy, the tension between researcher leverage and community responsibility, and why the Spider-Man rule applies more than ever to the security research community right now. They also tackle the big questions: Should disclosure timelines be based on exploitability rather than a fixed number of days? Who owns the decision to accelerate a disclosure? And is it time to throw out CVSS scores and build something new? Gal's bottom line: the noise needs to be cut, the critical bugs need better definition, and both vendors and researchers need to get back to the table — as humans. For our reporter chat, Greg talked with Derek Johnson about the reaction to the Trump administration's fight with Anthropic.

    Zero days, zero order: The chaos reshaping vulnerability disclosure
See All (145)

Ratings & Reviews

4.9
out of 5
8 Ratings

About

Podcast by Safe Mode Podcast

Information

  • Creator
    Safe Mode Podcast
  • Years Active
    2023 - 2026
  • Episodes
    145
  • Rating
    Clean
  • Copyright
    © All rights reserved
  • Show Website
    Safe Mode Podcast

You Might Also Like