Hidden in Plaintext

Front Lines Studios

Stories from the people reducing risk in security's blind spots. Hidden in Plaintext is a podcast about the parts of a security program nobody is looking at yet. Hosted by Eric Fourrier, Co-Founder and CEO of GitGuardian, each episode is a conversation with the person who owns that blind spot: AppSec leaders, CISOs, security engineers, and the identity and platform teams now pulled into the same fight. They talk about the program they built, the breach that rewired how they think about risk, and what they found when they actually went looking. The thread underneath every episode is simple.

Episodes

  1. Sep 29

    Gen's Curtis Koenig on treating AI agents like human users to prevent security failures

    Curtis Koenig, Head of Application Security at Gen, built Sage, an agent on top of developer AI tools that intercepts dangerous actions before they execute. When AI can chain low-severity vulnerabilities into a critical exploit, ignoring the backlog of lows and mediums no longer holds. Curtis tells Eric his triad for citizen developers: education, guardrails, and data awareness. He breaks down the EU Cyber Resilience Act's 24-hour reporting window and argues treating AI agents like human users is the single most important step to get ahead of AI risk. Topics Discussed Deploying AI to cut false positive rates in security tooling Managing citizen developers with a triad security framework Sage, an agent-on-agent governance model for AI tools Chaining low-severity vulnerabilities into critical exploits Risk assessment at machine speed for vulnerability prioritization EU Cyber Resilience Act's 24-hour incident reporting window Treating AI agents as human users for identity management Open source supply chain attacks and reverse engineering with MCP Listen to more episodes:  Apple  Spotify  YouTube

    Gen's Curtis Koenig on treating AI agents like human users to prevent security failures

  2. Sep 15

    Decibel Partners' Dan Nguyen-Huu on AI agents gaining user admin rights

    Dan Nguyen-Huu, Partner at Decibel Partners, calls the Hugging Face incident "the COVID moment for cybersecurity," where AI agents autonomously organized, escalated privileges, and exploited systems as an unintended consequence of model training. For Dan, this signals a permanent shift away from deterministic security playbooks. Dan breaks down for Carol how the attack surface is migrating from private repos to developer endpoints, why agentic attackers are collapsing dwell times using tokens instead of human hours, and why the next 18 months will reshape the cybersecurity landscape. Topics discussed: The Hugging Face incident as cybersecurity's inflection pointWhy developer endpoints are the new secrets battlegroundAgentic attackers collapsing dwell time and remediation windowsOverlaying deterministic policies on probabilistic AI systemsOpen source vulnerability remediation at scale with AIFrontier model adoption gaps in enterprise securityTechnical CISOs raising the bar for vendor selectionThreat intelligence operationalization through AI customization

    Decibel Partners' Dan Nguyen-Huu on AI agents gaining user admin rights

  3. Sep 1

    Pax8's Arthur Loris on calculating quantitative risk after assuming breach

    Arthur Loris, Director, Platform Security at Pax8, replaced CVSS score lists with loss exceedance curves to map application risk in financial terms. The result: leadership gets a dollar-value map of where threats actually cost the business, not just a list of highs, mediums, and lows. Arthur tells Eric why the agentic era demands a return to first principles. Borrowing from chess strategy, he argues teams should stop obsessing over the opening and focus on the king: identify crown jewels, enforce least privilege at every layer, and assume breach. Topics discussed: Building loss exceedance curves to replace CVSS score lists Mapping cybersecurity risk directly to financial impact for leadership Applying the chess endgame principle to prioritize crown jewels Enforcing least privilege boundaries around agentic AI systems Sandboxing AI agent runtime to restrict network and code execution Securing the developer endpoint as the origin point of credential exposure Compressing triage and finding verification from weeks to minutes Treating developers as customers to reduce security team friction

    Pax8's Arthur Loris on calculating quantitative risk after assuming breach
  • 3 Episodes

About

Stories from the people reducing risk in security's blind spots. Hidden in Plaintext is a podcast about the parts of a security program nobody is looking at yet. Hosted by Eric Fourrier, Co-Founder and CEO of GitGuardian, each episode is a conversation with the person who owns that blind spot: AppSec leaders, CISOs, security engineers, and the identity and platform teams now pulled into the same fight. They talk about the program they built, the breach that rewired how they think about risk, and what they found when they actually went looking. The thread underneath every episode is simple.

Information

  • Creator
    Front Lines Studios
  • Years Active
    2026
  • Episodes
    3
  • Rating
    Explicit
  • Copyright
    © Front Lines Studios
  • Show Website
    Hidden in Plaintext