Safe Mode Podcast

Safe Mode Podcast
  • 0.0 (0)
  • News
  • Updated weekly

Podcast by Safe Mode Podcast

  1. 1 day ago

    The world still treats bug hunters like criminals

    Kat Sommer, head of government affairs at NCC Group, joins Safe Mode to unpack the DEF CON talk she gave on how governments around the world are — and mostly aren't — protecting security researchers. Of the roughly 195 jurisdictions on the planet, Sommer found only about 15 have enacted any form of legal safe harbor for vulnerability research, and just one, Portugal, has what she'd call a proper one on the statute book. She walks Greg Otto through the patterns that emerged from that survey: the encouraging shift toward regulating conduct rather than actors, the conditions that actually make sense (don't extort the vendor, report to the national CERT), and the ones that don't (no public disclosure until a government authority signs off). The conversation also digs into the gap between being "protected" on paper and protected in practice, why prosecutors and courts still hear "hacker" and think "criminal," and the extraterritoriality problem — it's the same internet in Portugal as it is in Brazil, the UK, or the U.S., but the legal exposure changes the moment you cross a border.

    The world still treats bug hunters like criminals

  2. 6 Aug

    The SOC wasn't built for this

    Security operations centers have run on the same playbook for decades — collect, queue, triage, investigate, escalate. But attackers now move at machine speed: one recent breach that cost a company 3,600 repos got underway in roughly 87 seconds, far outpacing even a fast 10-minute log-enrichment pipeline. This week, host Greg Otto talks with ExtraHop CEO Greg Clark about the newly announced Agentic SOC Alliance and why he believes traditional SOC architecture can't keep up. Clark breaks down the three-layer stack he says every CISO needs to understand — context (the historical and real-time data an agent needs to reason about a threat), harness (the governance layer controlling what an agent can do, how it's tested, and how it audits its actions), and model (the LLM doing the reasoning, one of nearly 100 that ExtraHop benchmarks in an internal ""arena""). The conversation digs into some pointed findings: Chinese-origin models like Qwen consistently outperform on complex breach-reasoning tasks in ExtraHop's testing, a result Clark attributes to strong adversarial training data translating into strong defensive reasoning. He also makes the case for staying model-agnostic, since a new front-runner can emerge overnight — pointing to a Microsoft release just days before this recording. Much of the discussion centers on where humans still fit in. Clark describes today's dominant pattern — agents running in parallel ""investigate mode"" while analysts watch and validate — and predicts bounded, agent-driven response will expand faster than most expect, once governance and audit trails give leaders enough confidence to hand over execution on certain incidents, while higher-stakes systems like trading floors keep a human firmly in the loop. He closes by outlining what's next for the Alliance: growing membership, pushing toward published, vendor-neutral standards, and building the benchmarking needed to prove agentic SOC tools actually work before going into production.

    The SOC wasn't built for this

  3. 30 Jul

    Why Cybersecurity is at the heart of the US-China AI race

    The US-China AI competition has quietly become a cybersecurity arms race, and this week made that impossible to ignore. Booz Allen's Brad Medairy joins Safe Mode to unpack the milestones behind that shift — from China's Villager red-teaming framework to last December's frontier model jailbreak — and a report his team ran finding Chinese models like DeepSeek, Qwen, and Kimi carry policy bias and generate more vulnerable code when prompted in US government contexts. Medairy digs into the hard questions: whether banning Chinese open-weight models like Z.AI/GLM is even feasible, why CISOs are unknowingly running them under different names, and how agentic tools can compromise a network in six minutes while analysts miss it for 48. He also covers real-world breaches — an Ethiopian hacker using Claude and Codex to hit 14 US companies, and OpenAI's model escaping its boundaries to compromise Hugging Face — and closes on whether the US simply out-innovates China or finds room for guardrails when only one side is playing by them.

    Why Cybersecurity is at the heart of the US-China AI race

  4. 23 Jul

    A builder's view of the AI arms race

    It's been a wild six weeks for frontier AI models — Mythos launched, got yanked offline by the Department of Commerce over export controls, and came back online with new guardrails, all while Five Eyes agencies warned that AI is months away from reshaping the threat landscape. This week on Safe Mode, Greg Otto talks with Armadin's David Slater, who is building directly on top of these frontier models, creating a platform integrating AI into cybersecurity offense and defense. The two dig into what it was actually like watching America's leading models go dark just as Chinese models — namely GLM 5.2 — closed the gap on intelligence, endurance, and something the guest calls "willingness": a model's readiness to be used for offensive cyber purposes without the safeguards baked into Western frontier labs. The conversation covers why export controls and "kill switches" on U.S. models may not actually blunt adversary capability given the availability of open-weight alternatives, why intelligence and endurance alone aren't enough without a wide enough "aperture" to see an entire attack surface, and why a small circle of well-resourced defenders working with frontier labs isn't sufficient to protect the hundreds of thousands of organizations and critical infrastructure operators left without that access. They also get into where AI is already reshaping attacker-defender asymmetry — credential stuffing, ransomware, and lateral movement — and where the next capability walls may fall, from reverse-engineering patches to longer-range vulnerability chaining. The guest closes with a pointed message for security teams: the technology is arriving faster than most organizations' ability to act on it, and the real gap isn't intelligence — it's whether your people and processes can move at "wartime" speed when a serious threat shows up.

    A builder's view of the AI arms race

  5. 16 Jul

    What the Section 702 lapse means for cybersecurity

    For the first time in its operational history, FISA Section 702 has lapsed, plunging U.S. intelligence agencies and telecom providers into a highly uncertain "grey zone." In this episode of Safe Mode, host Greg Otto sits down with Glenn Gerstell, former NSA General Counsel and senior adviser at the Center for Strategic and International Studies (CSIS), to navigate the fog of this unprecedented lapse. While the government is temporarily coasting on grandfathered certifications, the operational reality is getting increasingly dicey. Gerstell explains what this lapse actually means for the future of U.S. cyber defense, how political friction is complicating long-term planning, and why temporary stopgaps are creating unnecessary hurdles for the agencies trying to keep us safe.

    What the Section 702 lapse means for cybersecurity

  6. 9 Jul

    What the post-quantum executive order means for CISOs

    In this week’s episode, Greg speaks with Ellen Boehm, SVP of Strategy and AI Operations at Keyfactor, about what the administration’s post-quantum cryptography executive order means for CISOs and enterprise leaders. Boehm argues that preparing for post-quantum cryptography is not just a technical cryptography challenge, but a leadership and business-risk problem. The conversation covers why compliance deadlines are pushing organizations to act, how CISOs should frame quantum risk for boards and executives, and why cryptographic inventories are a critical first step for any serious migration plan. The discussion also explores how organizations can build cross-functional teams across security, IT, legal, procurement, engineering and product groups; why visibility into cryptographic assets remains so difficult; and how AI, machine identities and crypto agility are converging with the post-quantum transition. Boehm also lays out the key questions enterprises should be asking now as they prepare for deadlines that are quickly moving from future concern to present-day planning reality.

    What the post-quantum executive order means for CISOs

  7. 2 Jul

    How security investigators can get the right info out of AI security tools

    This week on Safe Mode, Greg sits down with Dov Yoran, CEO and co-founder of Command Zero, to talk about one of the most persistent problems in enterprise security: the investigation gap. Alert volumes keep climbing, SOC teams are drowning in triage, and the tools meant to help are aggregating data without actually reasoning through it. Dov breaks down how the real bottleneck in security operations comes down to expertise — knowing what questions to ask, where to find the data, and how to build a narrative around it. He explains how Command Zero has codified years of SecOps and incident handling experience into a knowledge base shared by both human analysts and AI agents, creating a structured and fully auditable approach to autonomous investigation, one where every question asked and every conclusion drawn is visible and replayable. The conversation gets into how AI is fundamentally changing the shape of the SOC. The tiered escalation model is giving way to something new, where agents handle the repetitive work of collection, timelining, and report writing and analysts operate more like coordinators than ticket processors. Whether that shift is gradual or sudden, and exactly where the human stays in the loop, is a question Dov and Greg wrestle with. In our reporter chat, Greg talks with Tim Starks about the Supreme Court's decision in Chatrie v. The United States

    How security investigators can get the right info out of AI security tools

  8. 25 Jun

    Inside Operation Disruption Week: Taking Down Southeast Asia's Scam Machine

    What does it actually take to dismantle an industrial-scale scam operation running bulletproof hosting, distributed ASNs, and crypto laundering across multiple countries? Mike Sweeney of Silent Push was in the room during Operation Disruption Week and tells us exactly how it went down — the intelligence, the coordination, and why this public-private model could be a blueprint for future cyber disruption efforts. Plus, reporter Tim Starks on the open source supply chain crisis: the volunteer maintainers holding up the internet, the threat groups coming after them, and the policy vacuum left behind after the Biden administration's momentum stalled.

    Inside Operation Disruption Week: Taking Down Southeast Asia's Scam Machine
See All (146)

About

Podcast by Safe Mode Podcast

Information

  • Creator
    Safe Mode Podcast
  • Years Active
    2023 - 2026
  • Episodes
    146
  • Rating
    Clean
  • Copyright
    © All rights reserved
  • Show Website
    Safe Mode Podcast

You Might Also Like