Episodes

Every time I pull up directions on my phone, I'm using something the government built. GPS started as a Department of Defense project and was run for decades by the Air Force, the same branch I served in. The internet traces back to a Pentagon research program. A lot of the technology that made Silicon Valley rich was paid for by taxpayers long before anyone figured out how to put an app store on top of it. That history matters when the people who got rich on that foundation start talking about ...

Remember those Facebook quizzes that made the rounds during the pandemic lockdowns? They'd ask for things like the street you grew up on or the name of your first pet, and everyone treated it as a fun way to get to know each other. I spent a good chunk of that time telling my family to stop answering them, because those are the same questions banks and websites use to verify who you are. My family mostly thought I was making a big deal out of nothing, and in fairness, each of those details is pr...

I realize I am dating myself to some extent, but my first cell phone plan came with a fixed number of minutes and a small allotment of text messages, and anything beyond that was billed one at a time. You got in the habit of watching the clock on calls and thinking twice before you replied to a text. That model didn't last. Once enough people wanted to use their phones without doing arithmetic, the carriers moved to unlimited plans, and now nobody counts anything. AI is still in the counting sta...

Amihai Niederman joins me on this episode of the TechSpective Podcast to talk about what happens to identity security once AI agents start outnumbering the humans on a company's network. He's the co-founder of NewCore, a startup betting the answer isn't another tool bolted onto what companies already run. It's a rebuild. That bet is worth taking seriously. The identity stack most companies run today wasn't built for this problem. It was built for a much smaller one. Identity Grew Up As An IT Pro...

Nicole Beckwith joins me on this episode of the TechSpective Podcast to talk about a problem most of the security industry still hasn't fully reckoned with. Beckwith runs security engineering and operations at Cribl, and before that she spent years in law enforcement and digital forensics, which is the lens she uses to explain why the way we've built detection for the last couple of decades is running out of road. Matching Isn't the Same as Understanding For as long as I've covered this industry...

For most of the last year, the AI security conversation had a clear villain. Attackers were using AI to write better phishing lures, adapt malware mid-attack, and move faster than defenders could keep up with. That story was easy to tell because it fit the shape we already understood. Bad guys get a new tool, they use it against us, we build a defense. Then the defenders' own AI started breaking its own rules, and the story stopped being that simple. The Model Did What It Was Told In July, OpenA...

Think about every account you've ever created and then forgotten about. A login for a gym you canceled two years ago. A free trial you signed up for and never used again. A vendor portal from a job you left. Nobody deletes those things, and nobody circles back to check whether they still work. Now multiply that across every employee at a mid-size company, running for ten or fifteen years, and you've got a rough picture of what most identity and security teams were already dealing with before AI ...

Barak Sternberg spent a chunk of this year proving something that should worry anyone who has plugged an AI coding agent into their observability stack. His team at Tenet Security found that a single fake error report, sent to a public Sentry endpoint with no login required, was enough to get AI agents to run code they had no business running. In a controlled test, more than 100 organizations' agents acted on the injected error, including one belonging to a company worth roughly $250 billion. Te...

Most AI-driven security tools lean on retrieval-augmented generation: pull relevant precedent, drop it into the context window, let the model reason over it. It works, but it has a cost problem and a consistency problem. The more data you feed a large language model to improve its answer, the more expensive that answer gets — and the more room there is for the model to produce inconsistent results, independent of hallucination. Torq built its "SOC brain" to get around that tradeoff. On the lates...

Bruce Schneier joins me on this episode of the TechSpective Podcast to talk about hacking, power, and why so much of what gets blamed on AI might actually be something else. Schneier is one of the most well-known and respected names in cybersecurity. He has been working in and writing about cybersecurity since the term was invented, writing more than a dozen books in that time. Data and Goliath looked at surveillance. A Hacker's Mind looked at loopholes in the rules we all live by. His most rece...

Beth Simone Noveck joins me on this episode of the TechSpective Podcast to talk about her book, Reboot, AI and the Race to Save Democracy. She's a professor at Northeastern, where she leads the Burns Center for Social Change. She also founded Innovate US, a training program for public sector workers. It's grown into one of the largest AI training efforts in the country. Before that, she ran AI for the state of New Jersey and worked on tech policy for the federal government under President Obama....

Most cloud security tools have a detection problem. They find misconfigurations well enough. The issue is what happens after — a ticket gets opened, someone works the queue, the fix goes in, and three weeks later the same misconfiguration is back because a different person on the team made the same call. Ariel Litmanovich watched that cycle for years, not at some mid-market company struggling with tooling, but at the Israel Defense Forces, running cloud security for one of the more demanding env...

Before COVID forced everyone out of the office, hiring for most companies was a pretty localized exercise. You posted the job, you interviewed whoever could physically show up, and you picked someone. If you were based in a mid-sized city, you hired from a mid-sized city talent pool. Remote work changed that. Suddenly a company in Topeka, Kansas could interview candidates in Portland, Maine — or anywhere else. This meant more competition for good candidates. However, it also meant a dramatically...

Most organizations believe they have a solid handle on their AI risk. According to a new report, that confidence may be misplaced. ArmorCode partnered with the Purplebook community to survey more than 650 cybersecurity leaders to produce the State of AI Risk Management 2026 report. The results reveal a disconnect that's hard to explain away. Nearly 90% of respondents said they had complete visibility into AI usage across their organizations. However, more than 60% of those same respondents said ...

Every few years, something comes along that reshapes the threat landscape and sends the industry scrambling for new tools, new frameworks, and new buzzwords. The perimeter died. Then it came back. Endpoints became the priority. Now they're not the whole story. Identity is the new battleground. AI is changing everything. And yet, the more I talk to people who've spent decades in the trenches, the more I keep hearing the same thing: the fundamentals still work. We just stopped trusting them. I had...

There's a pattern that shows up in incident response work that nobody talks about in the vendor briefings. You bring in forensics after something goes wrong, and somewhere in that process, you find a tool — already deployed, already licensed, sometimes running for years — that had the data to catch what happened. Nobody was looking at it. In some cases, it wasn't even turned on the right way. Max Henderson runs global digital forensics and incident response at Kroll. He's seen this enough that i...

I keep having versions of the same conversation. The names and logos change, but the underlying tension doesn't: organizations are deploying AI agents fast, they're deploying them into production, and a lot of them weren't ready when they did it. Monte Carlo's co-founder and CTO Lior Gavish joined me on the TechSpective Podcast recently, and we got into why that's happening and what it actually means. Monte Carlo published the Agents in Production report, and the numbers are worth paying attenti...

There's a moment in my conversation with Bob Bobel where he mentions that customers are having a harder time finding people who actually know Active Directory. Not cloud identity — the old on-premise stuff that most large organizations still run. Even if they've also got Entra ID and Office 365 sitting on top of it, they maintain those older systems. That expertise is retiring. Moreover, it's not being replaced fast enough. Bob is the CEO of Cayosoft, which builds management, auditing, and recov...

Every conversation I’ve had for the past couple of years has followed the same arc. First, it was generative AI. Then agentic AI. Now the question everyone is circling is how you actually secure agentic AI — and it turns out that’s a harder problem than most people expected. I sat down with Naor Paz, CEO and co-founder of Capsule Security, to talk through it. Naor spent years as a security practitioner and incident responder, moved into product leadership at F5, and is now focused on what he see...

Fresh off RSAC 2026, I sat down with Ramin Farassat, Chief Product Officer at Menlo Security, to work through what agentic AI is actually doing to the enterprise attack surface. Menlo has spent 13 years focused specifically on browser security. The idea is that the browser, not the endpoint, not the network perimeter, is where most enterprise work happens and most exposure lives. That was already a hard enough problem. Then you add AI agents into the mix. The Next Billion "Users" The framing Ram...

Ransomware has been a persistent headline topic for years now. As a result, a lot of people have probably gotten numb to it. I know I had. It starts to feel like background noise — another attack, another breach, another company paying out. So when I sat down with Derek Manky, Chief Security Strategist and Global VP of Threat Intelligence at Fortinet, he started walking through the numbers from Fortinet's latest Global Threat Landscape Report. That got my attention again. The data isn't backgrou...

Everyone is talking about agentic AI. And that's part of the problem. Over the last couple of years, the term has gone the way of every other buzzword in tech — slapped onto products and platforms regardless of whether it actually applies. Marketing departments are busy. As Adi Kuruganti, Chief AI and Development Officer at Automation Anywhere, put it, we sat down to record the latest TechSpective podcast episode. When marketing departments get busy, clarity tends to suffer. Automation Anywhere ...

Cloud was supposed to make everything easier. In some ways, it absolutely has. You can spin up infrastructure in minutes, scale on demand, and deploy globally without ever touching a piece of hardware. That’s a massive shift from the days when a “deployment” meant racking servers and hoping you sized things correctly six months in advance. But if you’ve actually been in the trenches—even recently—you know the reality is a little messier. That’s where this episode of the TechSpective Podcast star...

Everybody's got an AI strategy. Every platform claims to be AI-powered. Every vendor deck has a slide about how their product uses machine learning to deliver transformative outcomes. Most of it is still theater. I had a conversation with David DeSanto, CEO at Anaconda, recently for the TechSpective Podcast, and what struck me most was how honest he was about where enterprise AI actually stands. Not where vendors want it to be. Not where the headlines say it is. Where it actually is. A lot of or...