Coffee, Chaos and ProdSec

Cameron Walters and Kurt Hendle

Coffee, Chaos & ProdSec is where cybersecurity meets caffeine-fueled chaos. Hosts Kurt (security architect and chaos tamer) and Cameron (ProdSec wrangler and DevSecOps junkie) dive into hacking, AppSec, supply chain failures, AI surprises, and the everyday madness of defending modern systems. With humor, sharp insight, real breach breakdowns, bad password confessions, and a few questionable impressions, they explore the messy reality of security and how teams survive it. New episodes Every Wednesday at 5 AM Eastern.

  1. há 6 dias

    Ep 42 - Identity Sprawl, VulnOps, and Nine Domains Later - Part 2

    🎙️ Coffee, Chaos and ProdSec, Ep 42 Five domains. One episode. No recaps for people who skipped Part 1. Cameron and Kurt close out the greenfield ProdSec build with Identity Security, Vulnerability Management, GRC, Product Security Incident Response, and AI Security. NHIs are outnumbering humans 40 to 1 and 78% of organizations have no formal policy for creating or removing AI identities. That is not a roadmap problem. That is a credential sprawl problem nobody has named yet. Kurt wants VulnOps to replace the four-team hot potato game everyone is currently playing with CVEs. Cameron wants a PSIR team before the first researcher email lands. Both of them find GRC boring and are not pretending otherwise. AI Security gets its own domain because embedding it anywhere else just means two domains without coverage. If you work in Product Security, DevSecOps, or Application Security and you have ever gotten a 516-page compliance document you definitely did not read, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h

  2. 10 de jun.

    Ep 41 - No Budget, No Blueprint, No Lies - Building ProdSec From Scratch - Part 1

    🎙️ Coffee, Chaos and ProdSec, Ep 41 DevSecOps is dead. Cameron said it. Kurt didn't fully disagree. And that's just the first five minutes. This week Cameron and Kurt kick off a two-part series on building a ProdSec program from scratch, no inherited tool sprawl, no political debt, just a greenfield mandate and nine domains to figure out. But before the org chart gets drawn, they set the stage with the agentic SDLC, because any program being built today is being built into a development environment that already broke the assumptions traditional AppSec was designed for. Part 1 covers four domains: AppSec and DevSecOps as a merged practitioner reality, Security Architecture as the upstream design function most teams only add after something goes wrong, and Cloud Security as the infrastructure layer nobody fully owns and everyone argues about, including a full WAF debate nobody asked for but everyone needed. If you work in Product Security, Application Security, or DevSecOps and you've ever been handed a blank org chart and told to figure it out, this one is the episode you didn't know you were waiting for. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 8min

  3. 3 de jun.

    Ep 40 - GitHub Breach, Open Source Malware, Dev Machine Gold Mines ft. Paul McCarty and Jenn Gile

    🎙️ Coffee, Chaos and ProdSec, Ep 40 Less than 5% of CVEs are actually exploitable. One hundred percent of malicious packages are bad by design. So why is your entire AppSec budget chasing the first problem? This week Cameron and Kurt bring on Paul McCarty and Jenn Gile, co-founders of OpenSourceMalware, to break down why the open source malware problem is structurally different from vulnerability management, why your EDR and SCA tooling weren't built for it, and why 78% of what OSM tracks has zero attribution because most threat actors aren't TeamPCP screaming for clout. They're quiet, they're patient, and they're already on your developer machines. From AI slop squatting and four to five net new info stealers per day, to credential-stuffed dev machines, non-deterministic agents bypassing guardrails, and DPRK making $2 billion while everyone watches TeamPCP, this one covers the threat class that most programs still don't have a budget line for. If you work in AppSec, DevSecOps, or Product Security and your malware response plan is "covered by SCA," this episode is going to be uncomfortable. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 5min

  4. 27 de mai.

    Ep 39 - Governing AI Agents and NHIs - Identity Is the Control Plane Full Stop

    🎙️ Coffee, Chaos and ProdSec, Ep 39 AI agents are in production. They have access. They're taking actions. And almost none of them have an owner. This week Cameron and Kurt come off a multi-day identity summit with a take they're both confident in: the industry is reaching for gateways, firewalls, and legacy IGA platforms to solve an AI security problem that is fundamentally an identity problem. None of those tools were built for agents and slapping an AI badge on them does not change that. From the three identity types debate that nobody has settled, to why access certification is a group therapy session waiting to happen, to why AI gateways are just firewalls with better marketing, this episode covers what identity governance for AI actually looks like when you strip out the vendor noise. If you work in Cybersecurity, Product Security, Application Security, or DevSecOps and you have ever nodded along when someone said guardrails without knowing what they meant, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 1min

  5. 20 de mai.

    Ep 38 - Governance Without Enforcement Is Theater and Shadow AI Knows It

    🎙️ Coffee, Chaos and ProdSec, Ep 38 Your org told everyone to use AI. The budget ran out. Someone found a better free tool. Boom, shadow AI just happened. This week Cameron and Kurt record on four hours of sleep fresh off two days in Austin talking AI and identity with practitioners, and somehow that makes this episode better. They get into where shadow AI actually lives across the corporate surface and the SDLC, what you can detect today with EDR, SIEM, SASE, and a GitHub search bar, and where current detection completely falls apart. From AISPM getting called out as a category that overpromises, to live threat modeling on how a developer could run a local model cluster at home and stay invisible to every control your team has, to why governance without enforcement is just theater with better fonts, this one is honest about what security teams can and cannot see right now. If you work in AppSec, DevSecOps, or Security Architecture and have ever written an AI acceptable use policy without knowing what AI your org actually uses, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 1min

  6. 13 de mai.

    Ep 37 - Scattered Spider Called Your Help Desk and Your TPRM Annual Review Missed It

    🎙️ Coffee, Chaos and ProdSec, Ep 37 Your vendor filled out the questionnaire. They have a SOC 2. And they just got you popped. This week Cameron and Kurt get into the third-party risk management conversation that the industry keeps avoiding. Not the checkbox version, the one where Scattered Spider is social engineering your managed service provider's help desk and you're finding out about it from a news alert. They cover why SOC 2 is a report and not a certification, why vendor management and TPRM are two completely different functions that most companies let collapse into one spreadsheet, why open source dependencies are third-party risk that nobody owns, and what continuous monitoring actually looks like when you stop pretending an annual audit is a security control. Plus the Delve incident, goblins in AI training data, and Kurt reading the scope statement while Cameron does the actual research. If you work in Product Security, Application Security, DevSecOps, or GRC and you have ever accepted a SOC 2 Type 1 as proof that someone takes security seriously, this one is for you. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    57 min

  7. 6 de mai.

    Ep 36 - Stop Blaming Mythos - The Defender Playbook Was Already Overdue

    🎙️ Coffee, Chaos and ProdSec, Ep 36 Your risk model is lying to you. Not maliciously. Just quietly, using assumptions that stopped being accurate before Mythos ever made the news. This week Cameron and Kurt get into the part nobody wants to say out loud: the AI threat acceleration has been building for over a year and most Application Security and Product Security programs are still running the old playbook. Pipelines shipping code faster than anyone's reviewing it, agents deployed like they're Slack bots, CVE feeds that can't keep pace with what AI is finding, and security teams absorbing a workload that was never designed for this environment. From VulnOps as a permanent function to the 10 questions that tell you whether your program can actually execute, to burnout as a real operational risk and not an HR checkbox, this one is built for the practitioner who needs actions not another threat briefing. If you're in DevSecOps, Cybersecurity, or Security Architecture and your Monday morning plan is still "check the queue," this episode is the intervention. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h 2min

  8. 29 de abr.

    Ep 35 - Mythos, the AI Exploit Printer, and Whether Security Is Actually Cooked ft. Caroline Wong

    🎙️ Coffee, Chaos and ProdSec, Ep 35 Anthropic dropped Mythos. 250 CISOs argued in a live document over a weekend. A crisis paper shipped Monday morning. And everyone's board started calling. This week Cameron, Kurt, and Caroline Wong get into what Mythos actually did differently from every model before it, whether Project Glasswing is coordinated disclosure or the most expensive press release in security history, and why the tsunami of vulnerabilities coming out of it is going to expose every program that's been doing vulnerability management wrong for a decade. They also get into the third identity class nobody is governing yet, whether risk prioritization even makes sense when AI can chain your deprioritized findings into a critical, and what the curl project quietly proved about where AI security capability actually is right now. If you work in Cybersecurity, Application Security, Product Security, or DevSecOps and the Mythos noise has made it hard to figure out what's real, this one cuts through it. ☕ New episodes every Wednesday. Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.

    1h
Ver tudo (43)

Trailer

Classificações e avaliações

4,3
de 5
6 avaliações

Sobre

Coffee, Chaos & ProdSec is where cybersecurity meets caffeine-fueled chaos. Hosts Kurt (security architect and chaos tamer) and Cameron (ProdSec wrangler and DevSecOps junkie) dive into hacking, AppSec, supply chain failures, AI surprises, and the everyday madness of defending modern systems. With humor, sharp insight, real breach breakdowns, bad password confessions, and a few questionable impressions, they explore the messy reality of security and how teams survive it. New episodes Every Wednesday at 5 AM Eastern.

Informações

  • Criado por
    Cameron Walters and Kurt Hendle
  • Anos de atividade
    2025 - 2026
  • Episódios
    43
  • Classificação
    Livre
  • Copyright
    © Cameron Walters and Kurt Hendle
  • Site do podcast
    Coffee, Chaos and ProdSec

Você também pode gostar de