Prabh Nair

Prabh Nair

Prabh Nair is a cybersecurity podcaster covering cyber risk, ransomware, incident response, SOC operations, GRC, AI security, threat intelligence, digital forensics, ISO 27001, CISSP, CISM, and security leadership. Built for SOC analysts, auditors, cybersecurity professionals, students, and business leaders, each episode delivers simple explanations, practical lessons, and real-world examples to help you stay ahead in the fast-changing cyber world. #CyberSecurity #InformationSecurity #CyberRisk #GRC #SOC #IncidentResponse #Ransomware #ThreatIntelligence #AISecurity #DigitalForensics

  1. 1天前

    How to Crack JEE: AIR 59 Shares Study Routine, Mistakes and College Advice

    JEE preparation is not only about studying for long hours. It is about discipline, consistency, the right strategy, emotional control, mock test analysis, and making smart decisions during the final phase of preparation. In this podcast, Prabh speaks with Ishaan Singh, who achieved All India Rank 59 in JEE, about his preparation journey, study routine, coaching experience, final-week strategy, college selection, and the skills students should build beyond academics. Ishaan shares practical advice for JEE aspirants and parents who are trying to understand what really matters during preparation and after results. In this episode, we discuss:Ishaan’s JEE preparation journeyHow he built a disciplined study routineHow to manage school, coaching, self-study and personal activitiesWhy focused study blocks and regular breaks matterWhy avoiding social media helped him stay focusedHow to analyze mock tests and identify weak areasWhat to revise in the final week before JEEWhy previous year questions are importantWhy students should avoid difficult new problems just before the examWhy handwritten notes can improve learningRole of coaching in structure, testing and peer supportWhy students should not constantly compare themselves with othersHow to handle setbacks during preparationHow to choose a good engineering college beyond rankingsWhy students should speak with current students and alumni before choosing a collegeImportance of curriculum quality, peer group, internships, research exposure and campus cultureGap between college education and industry skillsWhy skills matter beyond college tagsHow students from non-CSE branches can still build careers in software and technologyHow AI tools can support learning when used correctlyOne of the strongest takeaways from this session:#JEE #JEEPreparation #Engineering #IIT #StudentLife #CareerGuidance #CollegeSelection #Education #Parents #CoffeeWithPrabh

  2. 4天前

    Privacy Ops Masterclass | Building Trust Across Product, AI and Security

    Privacy does not fail only because organizations do not have policies.Many times, privacy fails because it comes too late.After the product is designed.After the code is written.After the vendor is onboarded.After the data flow is already live.After the AI use case has already started using personal data.In this podcast/session, Prabh discusses the practical meaning of Operationalising Privacy across Product, AI and Security.This session focuses on how privacy can move from paperwork to real execution inside organizations.We discuss why privacy by design fails when privacy is reviewed only after design is complete, and why privacy must be embedded into product development, engineering workflows, AI programs, security reviews, data-flow mapping, risk scoring, and day-to-day business decisions.https://www.linkedin.com/in/devika-subbaiah-infosec/In this session, we cover:- Why privacy should not appear only at the end of product design- Why privacy by design must be embedded before code is written- What Privacy Operations really means- Difference between privacy policy and privacy operations- Why DPO oversight and Privacy Ops execution are not the same role- How product, security, legal, business and privacy teams should work together- Why data flow diagrams should be living maps, not one-time documents- How vendor changes, retention changes and subprocessors affect privacy risk- Why privacy risk should not be viewed only through a legal lens- Why privacy risk and security risk must both be assessed- How dual-axis risk scoring can help evaluate organizational risk and individual harm- How an Activity-First Data Model can reduce repeated privacy documentation- How RoPA, DPIA, TIA, LIA and consent records can be generated from a common activity record- Why privacy must scale across products, functions and AI programs- Why every privacy framework field ultimately represents a real person and a real riskThe key message is simple:Privacy that only works on the day it was checked is not privacy.Organizations need privacy systems that are operational, scalable, evidence-driven, and embedded into daily decision-making.Watch the full session and comment below:What is the biggest privacy challenge in your organization — product design, AI usage, vendor risk, data mapping, privacy operations, or DPO execution?#PrivacyOps #DataProtection #PrivacyByDesign #AIGovernance #CyberSecurity #GRC #DPDP #GDPR #ProductSecurity #PrivacyEngineering #CoffeeWithPrabh

  3. 8月31日

    Threat Modeling for Agentic AI: Stop Treating Agents Like APIs

    Agentic AI is changing the way applications are designed, tested, deployed, and secured.Traditional application security focuses on APIs, authentication, authorization, databases, code, sessions, and technical attack surfaces.But Agentic AI introduces a different challenge.A user may not need technical knowledge to influence the system.A simple natural language prompt can make an AI agent classify intent, call a tool, retrieve data, generate a response, trigger a workflow, or influence a business decision.In this podcast episode, Prabh speaks with Akansha about Threat Modeling for Agentic AI Systems, using a practical customer support chatbot architecture as the case study.The architecture discussed includes:Classifier agentResponder agentQA reviewer agentHuman approval processRetrieval databaseTool integrationsLogging and monitoringRefund workflowThird-party integrationsThe session explains how a customer request flows through different agents, how intent is classified, how responses are generated, how refund requests are reviewed, and why human approval is important for high-risk financial actions.Content Reference https://github.com/smartdevil09/AI-Security-Professional-Roadmap/blob/main/AI%20security%20concepts/Threat%20Modelling%20Agentic%20Architecture.pdfLinkedin Profilehttps://www.linkedin.com/in/akesharwani/In this episode, we discuss:How Agentic AI differs from traditional application securityWhy prompts and natural language interactions create new risksWhy threat modeling should happen before production deploymentWhy stakeholder engagement is criticalHow to understand the business problem before identifying threatsHow to create an asset inventory for AI systemsHow to identify business assets and AI assetsHow to prepare data flow diagrams for multi-agent systemsHow to define trust boundaries between users, agents, tools, databases, and third partiesWhy refund workflows need stronger approval controlsWhy human approval is required for critical financial transactionsWhy logging and monitoring must be carefully designedHow to avoid logging sensitive PII dataHow attackers may exploit AI agents using prompt injectionHow AI agents may be manipulated into unauthorized actionsHow traditional AppSec controls still matter in Agentic AI systemsHow third-party Agentic AI systems should be assessedWhat documentation should be requested from vendorsHow to use STRIDE, MITRE ATLAS, OWASP LLM Top 10, CVE, and CWE for threat enumerationHow to evaluate likelihood, impact, business risk, and compliance riskWhy threat modeling must be continuously updated as architecture and threats changeAkansha also explains that threat modeling Agentic AI is not a simple automated checklist activity.It requires business context, stakeholder interviews, architecture understanding, asset inventory, data flow mapping, trust boundary analysis, risk assessment, guardrail design, logging, monitoring, validation, and continuous review.#AgenticAI #AISecurity #ThreatModeling #AppSec #AIGovernance #OWASP #MITREATLAS #CyberSecurity #GRC #CoffeeWithPrabh

  4. 8月27日

    The New Frontline: Why Hospitals Are The Biggest Cyber Targets

    Healthcare cybersecurity is not only about protecting networks, servers, applications, or medical devices. Shantanu https://www.linkedin.com/in/shantanushastrish/In this podcast episode, Prabh speaks with Shantanu about healthcare cybersecurity, connected medical devices, hospital security, medical device threat modeling, security by design, cyber resilience, and AI in healthcare.Modern hospitals are now highly interconnected technology ecosystems. Patient monitors, scanners, ultrasound devices, laboratory systems, hospital applications, cloud platforms, networks, and AI-enabled tools exchange information to support faster diagnosis and better treatment decisions.But this connectivity also increases the cybersecurity risk.In healthcare, downtime is not only a business issue.Learn how healthcare cybersecurity protects connected medical devices from threats. Understand the core security measures hospitals use today.Healthcare cybersecurity is becoming a critical priority as hospitals integrate more digital infrastructure. In this discussion, Lead Cybersecurity Engineer Shantanu and CISO Prabh Nair break down the complexities of maintaining medical device security within modern hospital networks. They examine the specific technological advancements currently shaping the industry and the inherent risks that come with them.This conversation is essential for IT professionals and healthcare administrators looking to secure connected medical devices against evolving vulnerabilities. You will gain a clear perspective on the strategies required to implement robust hospital network security, ensuring patient safety remains the top priority. By analyzing these real-world security measures, you will be better equipped to identify potential gaps in your own organizational protocols.Subscribe for weekly cybersecurity breakdowns, and comment below on which healthcare security topic you want us to cover next.

  5. 8月24日

    AAISM Practice Questions Masterclass | Think Like an AI Security Manager

    AAISM exam preparation is not only about memorizing AI terms.It is about learning how to think like an AI security manager.In this session, I explains AAISM-style practice questions using a practical, manager-focused approach. The focus is on understanding how to choose the best answer when multiple options look correct. The session starts with an AI loan approval case study and connects it with AI governance, AI risk management, AI technologies and controls, enterprise monitoring, and continuous improvement.The key message is simple:AAISM is about governance, risk, controls, evidence, and accountability.In this session, we cover:- How to approach AAISM questions- How to think like an AI security manager- Why governance comes before AI deployment- Why business risk comes before technology- Why AI inventory is required before risk categorization- How AI risk appetite and risk tolerance differ- How to choose controls based on risk- Why data governance is the foundation of AI security- How to handle bias, fairness, transparency, and explainability questions- Why human oversight matters for high-impact AI decisions- How to evaluate vendor AI risk- Why independent assurance matters for third-party AI platforms- How to identify AI exam traps- How to eliminate close distractors- How to connect AI risks with controls, owners, and evidence- How to answer questions on prompt injection, data poisoning, model inversion, model drift, hallucination, and deepfake risk- How to approach AI incident response automation questions- How to understand supervised, unsupervised, and reinforcement learning basics for the examThe most important exam mindset:AAISM Playlisthttps://www.youtube.com/playlist?list=PL0hT6hgexlYwHFcnBpXG2zuM7inotM0z3AAISM Domain 1https://www.youtube.com/watch?v=jb6tQppDPoE&t=2369sAAISM Domain 2https://www.youtube.com/watch?v=hyfIoSQH0vAAAISM Domain 3 https://www.youtube.com/watch?v=260RFZGgwCY&t=1423sDo not choose the most technical answer immediately.Choose the answer that best reduces risk, supports governance, creates accountability, provides evidence, and protects trustworthy AI outcomes.#AAISM #AISecurity #AIGovernance #CyberSecurity #GRC #RiskManagement #AICompliance #PrabhNair

  6. 8月20日

    Enterprise Risk Management Explained | Building a Risk Program from Scratch

    In this podcast episode, Prabh speaks with David, a cybersecurity risk governance leader, about Enterprise Risk Management, GRC, risk appetite, risk tolerance, executive reporting, AI risk, and how to build a risk management program from scratch.David shares his first experience of building a risk management program in 2004 at a major Australian bank using ISO 17799, and explains why risk professionals must understand business objectives before applying any framework.Many organizations struggle with risk management because different teams use different definitions, different scoring methods, different language, and different assumptions.That is why David emphasizes the importance of building:Common risk languageAgreed definitionsClear governance levelsDecision-making authorityRisk ownershipBusiness-aligned impact and likelihood matricesOne-page executive risk summariesLinkedin Profilehttps://www.linkedin.com/in/vohradsky/In this episode, we discuss:How to build a risk management program from scratchWhy risk management must start with business objectivesWhy common language and agreed definitions matterHow risk appetite and risk tolerance should be explained to business teamsWhy scoping is critical before risk assessmentHow to understand business processes before identifying risksHow to collect relevant data about assets, processes, systems, and peopleHow to design impact and likelihood matrices for different organizational levelsWhy risk assessment should support decision-making, not only documentationHow to present risk to executives in language they understandWhy CFOs care about financial exposureWhy CEOs and boards care about strategic impactHow one-page summaries help executives take clear decisionsWhy accountability and decision points must be visibleWhat first artifacts can help when starting a risk programWhy a charter, risk taxonomy, and control profile are usefulHow AI risk management is changing GRC thinkingWhy cultural adoption is one of the hardest parts of risk managementWhat young GRC professionals should focus on to grow in this fieldDavid also shares an important career lesson for young GRC professionals:Do not remain limited to templates and control checklists.Understand one business process deeply.Work closely with business teams.Learn how they think, how they make decisions, and what uncertainty means for them.The key takeaway from this session is simple:Risk management is not only about documenting risk. It is about helping the business make better decisions in uncertainty.This episode is useful for:AAISM Playlisthttps://www.youtube.com/playlist?list=PL0hT6hgexlYwHFcnBpXG2zuM7inotM0z3GRC Interview Playlisthttps://www.youtube.com/playlist?list=PL0hT6hgexlYxM5P9v7aEYBTJl7iJyK2uKAI Practicalhttps://www.youtube.com/playlist?list=PL0hT6hgexlYwHLdZR_oHvEKN_8IiAMBcUISO 27001 Playlisthttps://www.youtube.com/watch?v=tvd1MUf3aHE&list=PL0hT6hgexlYys_9UWhal1kr9Gkz0ms0sM&pp=sAgC#EnterpriseRiskManagement #GRC #RiskManagement #CyberRisk #CISO #CyberSecurity #Governance #Compliance #AI Governance #CoffeeWithPrabh

  7. 8月17日

    IT Application Controls Explained with Payroll Case Study | Practical IT Audit Masterclass

    In this podcast, Prabh speaks with Chinmay, who has tested more than 100 automated controls, to explain IT Application Controls using a practical payroll process case study. https://www.linkedin.com/in/chinmaykulkarni22/https://chinmaykulkarni22.substack.com/Chinmay explains that application controls are automated actions within systems that help prevent or detect errors without manual intervention. Unlike IT General Controls, which are more standardized across applications, IT Application Controls are specific to a business process, system logic, workflow, configuration, and transaction flow.The biggest lesson from this session is simple:Do not start with a checklist. Start with the business risk.In this episode, we discuss:What IT Application Controls areDifference between ITGC and IT Application ControlsWhy application controls are specific to business processesHow payroll risks translate into application controlsInput validation controlsCalculation and processing controlsInterface controlsOutput controlsAuthorization workflow controlsData validation controlsITGC dependency for application controlsHow SOC reports support third-party control relianceHow to test automated controlsWhy production screenshots and configuration evidence matterWhen one sample may be enough for fully automated controlsHow to prepare a lead sheet for application control testingWhy auditors must understand risk before testing controlsPlaylisthttps://www.youtube.com/watch?v=gaClcfhfWFM&list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWv&pp=sAgChttps://www.youtube.com/watch?v=mq_vSLHm4r0&list=PL0hT6hgexlYztA41j1bceTfVagP9mtq28&pp=sAgCChinmay also walks through a practical lead sheet structure covering risk statements, walkthrough details, automated control descriptions, trigger types, reference data, attributes, configuration inspection, and testing scenarios.#ITAudit #ITGC #ApplicationControls #GRC #SOX #Audit #CyberSecurity #Big4 #CoffeeWithPrabh

  8. 8月13日

    Auditing AI Systems in Critical Sectors

    AI is moving from simple human-to-system interaction to agentic AI, where machines interact with other machines, take actions, exchange data, and influence business decisions.This creates a major challenge for cybersecurity, GRC, audit, compliance, and assurance professionals: Priyank Sonihttps://www.linkedin.com/in/priyank-soni-iima/How do you audit an AI system when you cannot fully see the model, logic, architecture, or internal decision-making process?In this podcast, Prabh speaks with Priyank Soni, a cybersecurity, AI/ML, digital trust, governance, and assurance leader, about auditing AI systems in critical sectors.Priyank explains why traditional audit approaches are not enough when AI systems become black boxes, especially in sectors where trust, safety, compliance, and accountability matter.In this episode, we discuss:Why AI audit is becoming important in critical sectorsHow AI is moving toward agentic and machine-to-machine interactionsWhy zero-trust architecture must evolve for AI agentsWhy AI systems require stronger documentation and evidenceHow ISO/IEC 42001 is shaping AI governance and audit expectationsWhy auditors must understand data flow, model behavior, and system boundariesHow to audit black box AI systemsWhy AI audits should start with inventory and classificationWhy data mapping is critical for AI assuranceHow to assess AI vendor and supply chain riskWhy SBOM and ABOM may become important for AI system auditsHow to handle trade secret challenges when vendors do not share model detailsWhy auditor, vendor, and internal team collaboration is requiredWhat performance metrics auditors should reviewHow to test bias, fairness, and reliabilityWhy adversarial input testing mattersWhy human oversight must be validated, not just mentioned in policyWhy AI systems need continuous monitoring after deploymentWhy AI audits may need to happen more frequently than traditional IT auditsPriyank also explains that AI auditing is still in an early maturity phase. Many organizations, vendors, and auditors are learning together. That makes documentation, risk assessment, monitoring, and evidence collection even more important.#AIAudit #AIGovernance #ISO42001 #AISecurity #CyberSecurity #GRC #DigitalTrust #ResponsibleAI #CriticalInfrastructure #VendorRiskManagement #CoffeeWithPrabh

查看全部 155 集

评分及评论

5
共 5 分
3 个评分

关于

Prabh Nair is a cybersecurity podcaster covering cyber risk, ransomware, incident response, SOC operations, GRC, AI security, threat intelligence, digital forensics, ISO 27001, CISSP, CISM, and security leadership. Built for SOC analysts, auditors, cybersecurity professionals, students, and business leaders, each episode delivers simple explanations, practical lessons, and real-world examples to help you stay ahead in the fast-changing cyber world. #CyberSecurity #InformationSecurity #CyberRisk #GRC #SOC #IncidentResponse #Ransomware #ThreatIntelligence #AISecurity #DigitalForensics

信息

  • 创作者
    Prabh Nair
  • 活跃年份
    2021年 - 2026年
  • 单集
    155
  • 分级
    儿童适宜
  • 版权
    © Prabh Nair
  • 节目网站
    Prabh Nair