Risky Business Features

Risky Business Media

Join reformed CTO James Wilson as he dives deep on cybersecurity topics through an enterprise lens. From solo content and interviews with CISOs and researchers to vendor and startup deep dives, James does a bit of everything.

  1. 30/06

    Mythos on your desk? Using local LLMs for code reviews

    In this podcast episode James Wilson chats with Karsten Nohl about his research into using local LLMs to replace cloud AI in security code reviews. In essence, Karsten created a hybrid code reviewing system where both cloud and local models are used to orchestrate, triage outputs, and write reports. In this system, only the local LLMs have source code access, with the cloud models used to manage the local models. In this “source-local” review technique, the source code never leaves the local endpoint, which is a requirement for some reviews. But funnily enough, Karsten was able to use this system to generate findings that were as impressive as when using frontier models directly. In a nutshell, Karsten proved it’s possible to use locally-hosted, open-weight models running on commodity hardware to produce findings comparable to those discovered by frontier cloud models. This episode is also available on YouTube. Show notes Beyond Fable: Can a Local LLM Replace Cloud AI for Security Code Reviews Mythos smythos! How to find 0day with lesser models

    1 h 11 min

  2. 23/06

    Pitching security startups to VCs in the AI era

    In this podcast Patrick Gray and James Wilson chat with Decibel Partners founder and Managing Partner Jon Sakoda to talk about pitching cybersecurity startups to VC firms in the AI age. Coding agents and large language models have made it easier than ever to create software products, but despite this, the bar for what interests an investor is still largely the same. Everyone can run the marathon, but it’s usually the same few folks who finish first. So tune in to hear Jon share with us his wisdom on when to start the conversation with investors, how to leverage the experience of the founder community, and what founders should watch out for. This episode is also available on YouTube Show notes

    35 min

  3. 19/06

    How using open weight models can blow up in your face

    In this podcast episode James Wilson and Brad Arkin talk about how to safely use open weight large language models in the enterprise. The cost of frontier models was already driving interest in freely available open weight models like DeepSeek, Kimi and Qwen. But now the US government is forcing Anthropic to pull its Fable and Mythors models from the market, the argument for having greater control over your own AI stack is stronger than ever. But as you’ll hear in this episode, the model itself is just one component of the complex tech stack you’ll need to spin up if you want local inference. There’s a lot of moving parts, each of which comes with its own supply chain risks. So whether you’re hosting these models on your own hardware or via a SaaS provider, there’s a lot to ponder! Show notes

    43 min

  4. 16/06

    The state of the art in AI model jailbreaks

    In this solo podcast episode, James Wilson breaks down the current state of AI model jailbreaks. If you’ve somehow missed the story, last week Anthropic released its Fable 5 and Mythos 5 models to the public. In the name of safety, both models were guardrailed up the wazoo, but that didn’t stop a bunch of jailbreakers from figuring out how to bypass at least some of their safety restrictions. In response to these guardrail bypasses the White House issued an export control directive on the models, citing national security concerns. But was the Trump administration right to do this? Do these jailbreaks represent a threat to the security of the USA, or was the export restriction overkill? Tune in to find out! Show notes Pliny the Elder on Fable 5 Jailbreak whoJumper's response to Pliny ConfusedPilot: Confused Deputy Risks in RAG-based LLMs

    53 min

  5. 12/06

    Why NPM v12 won’t stop supply chain attacks

    In this podcast episode, James Wilson is joined by Open Source Malware Security co-founder Paul McCarty to talk about the supply chain attack mitigations coming in NPM v12. NPM disabling (by default) auto-run install scripts and dynamic dependencies is a positive step forward… but it’ll take years for this new version to be adopted, and these changes do nothing to prevent malicious packages being imported into projects. Further, Paul thinks disabling these features by default will introduce friction that will cause them to be re-enabled. When the choice is “this builds” and “this is less prone to malware”, the former will always win. Show notes

    39 min

  6. 5/06

    Everything is getting much worse, much faster

    In this podcast Brad Arkin joins James Wilson to talk about how the fear of being left behind in the AI era means enterprises are taking risks that would have been considered insane just a couple of years ago. Fears around outages or being hacked have been trumped by fears of being labelled an AI laggard. So where are we all going? Say hello to tech debt-riddled, vibe-coded apps, crazy dependencies on AI providers, and an emerging threat landscape that can’t be mitigated by a contemporary SOC. Sounds like fun, eh? Show notes

    23 min

  7. 2/06

    Solo podcast: A deep dive on TeamPCP

    In this solo episode, James Wilson takes a detailed look at TeamPCP. It started off by launching clumsy attacks against misconfigured Kubernetes clusters in September 2025. But by February this year, TeamPCP had skilled up and was smashing global software supply chains in the highest profile attacks of 2026. TeamPCP upskilled and turned the software development ecosystem into its personal credential harvesting machine. Here’s how TeamPCP did it, and what we can learn from it. Show notes

    1 h 4 min

  8. 25/05

    How to survive supply chain attacks

    In this podcast James Wilson chats with Brad Arkin about why software supply chain attacks have gone from rare, once-in-a-while disasters to an operational problem affecting mainstream enterprises almost daily. AI has made attackers faster, and “vibe coding” means the number of environments pulling packages from the internet has gone to the moon. It also means legacy tooling that seeks out the bad packages and cleans them up isn’t enough. Package cooldown windows won’t fix this either. But all hope is not lost! Tune in to this podcast to find out how you can get a grip on the disaster de jour! Show notes

    37 min
Ver tudo (30)

Sobre

Join reformed CTO James Wilson as he dives deep on cybersecurity topics through an enterprise lens. From solo content and interviews with CISOs and researchers to vendor and startup deep dives, James does a bit of everything.

Informação

  • Autoria
    Risky Business Media
  • Anos em atividade
    2 mil
  • Episódios
    30
  • Classificação
    Para todos
  • Copyright
    © Copyright Risky Business Media 2007-2026
  • Site do programa
    Risky Business Features

Talvez também goste