The Security Table

Izar Tarandach, Matt Coles, and Chris Romeo

The Security Table is four cybersecurity industry veterans from diverse backgrounds discussing how to build secure software and all the issues that arise!

Play

Open in

22 episodes
fortnightly
Avg 43 min
English

Episodes 22

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

S4 · E19
Wednesday · 39 min
Why AI Cheats To Win
When Anthropic's Mythos 5 model believed it was working inside an isolated test environment, it built and published a real malicious Python package to PyPI while chasing a capture-the-flag goal — and the package ended up installed on real systems before anyone caught it. The squad argues about whether "the model broke out" is even the right way to describe what happened, whether reward hacking is genuinely new or just old attacker behavior with a new author, and whether you can teach an AI ethics at all when the only thing it actually understands is reward and penalty. GPG signing, the trolley problem, and Nick Bostrom's paperclip maximizer all make an appearance along the way. 🚀Join the Conversation If an AI can't remember being penalized, can it actually learn ethics — or does it just avoid low rewards? Here’s why AI agents lie and cheat to reach their goals FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E18
September 9 · 49 min
When AI Escapes the Sandbox
The squad examines how an Anthropic model escaped its test environment and published a malicious package to PyPI. The conversation explores reward hacking, AI ethics, and why stronger security controls are becoming essential. 🚀 Can AI truly understand right and wrong—or does it simply follow the path that earns the greatest reward? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E17
August 5 · 42 min
The End of Bug Bounty As We Know It
We dig into Linus Torvalds' claim that AI is now a legitimate tool for the Linux kernel, and what it means for bug bounty platforms drowning in submissions, with Bug Crowd reporting a fourfold spike in three weeks. We debate the game theory of vulnerability disclosure, whether AI validation is about to become mandatory, and whether limiting US models just hands the advantage to attackers using unrestricted ones like Kimi. We also ask if bug bounty as we know it is already dead. 🚀 If AI can find and validate vulnerabilities faster than humans, does the entire bug bounty economy need to be rebuilt from scratch? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E16
July 22 · 43 min
Make No Mistakes: Inside the First "Agentic Ransomware"
We dig into Sysdig's Jade Puffer report, the so-called first agentic ransomware, and argue about whether the evidence actually proves an LLM was driving the attack or if it's just a well-trained script wearing an agent costume. We walk through the four signals Sysdig points to, including self-narrating code, fast failure recovery, and a reused Bitcoin address, and push back on how strong that proof really is. We also talk about what this does to the threat model now that attackers don't need a human in the loop to adapt on the fly. And yes, the exploited CVE was sitting unpatched since 2025. 🚀 Does adaptive malware change who you're defending against, or just how fast they move? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E15
July 15 · 41 min
Is Spec-Driven Development Already Dead
In this episode, we take on spec-driven development, the resurgent idea that writing a detailed spec and letting AI implement it will finally give us the precision engineering promised us since the 1950s. We push back on the notion that this fixes what actually sank spec-driven approaches decades ago: specs were never the problem; following them was. Along the way, we debate whether AI-generated code is any more correct than what a room of human developers would produce, dig into the "Phoenix" analogy of regenerating disposable code from spec instead of patching it, and raise the uncomfortable question of what happens when an integration quietly regenerates itself around a security flaw baked into the system it connects to. 🚀 Join the Conversation If the AI can regenerate your code from spec whenever a bug shows up, who's actually responsible when it regenerates the same vulnerability? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E14
July 1 · 59 min
Don't Bury the Model T: Why STRIDE Still Drives in an AI World
In this episode, we dig into two things the security community loves to argue about: npm finally doing the right thing and whether STRIDE has any business being called dead. The npm v12 changes gate dangerous install script behavior by default, which is a good step forward and also about a decade overdue. Then we wade into a hot take claiming that STRIDE was built for a world that no longer exists, and we push back hard on the idea that non-deterministic AI systems need an entirely new threat-modeling religion rather than a better understanding of the one we already have. Also: wheat, Oregon Trail, and Emacs. 🚀 Join the Conversation If your threat model failed because of an AI hallucination, was that STRIDE's fault or yours? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E13
June 24 · 42 min
Mostly Dead or Mostly Back: The Zombie Resurrection of DAST in an AI World
In this episode, we dig into whether DAST is dead, mostly dead, or quietly making a comeback dressed in an AI trench coat. The conversation traces the origins of dynamic application security testing from nmap scans and open source hacker tools to a market now valued at nearly four billion dollars and growing. We debate where DAST ends, and AI pen testing begins, whether AI can find a vulnerability nobody has ever seen before, and what happens when you compound the false positives of rigid rule-based scanning with the hallucinations of a large language model. Also: cats meowing the Final Countdown. 🚀 Join the Conversation If AI pen testing can already find zero days in open source software, does human pen testing still have a defensible edge — or are we just not ready to admit it doesn't? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E12
June 17 · 37 min
Realists At The Table: How To See Through The Hype
In this episode, we dig into how the cybersecurity personality has shifted from the ego-driven, hoodie-up archetype to the paycheck-chasing newcomer. The conversation covers hype cycles from mainframes to AI to quantum, whether passion or profit is driving the next generation into the field, and why we think the threat modeling problem is already solved. At the same time, everyone else keeps getting in the way. The discussion takes detours through The Cuckoo's Egg, Sneakers, War Games, and NFT apes before landing on a question we couldn't quite agree on: Does AI actually have a personality, and does it belong in the security community? 🚀 Join the Conversation If you got into cybersecurity for the love of the problem or the paycheck, would you even know the difference anymore? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E11
June 3 · 40 min
The Agentic Access Problem: When AI Becomes Its Own Administrator
In this episode, we explore what happens when AI agents meet the security principle of least privilege. As agents gain the ability to request permissions, make decisions, and interact with systems on our behalf, the line between human and machine responsibility starts to blur. The discussion covers prompt fatigue, over-permissioned agents, and why "because the agent told me to" may become the next security anti-pattern—before taking a hilarious detour into EULAs, cookie notices, and Matt's unexpected habit of reading both. 🚀 Join the Conversation If your AI agent requested administrator access right now, would you know whether it actually needed it? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E10
May 8 · 42 min
The Tool Creep Problem: When More Security Means Less Security
In this episode, we break down why security budgets keep growing while organizations keep falling further behind. We explore how tool creep has quietly shifted from a nuisance into an active attack surface, and why agentic AI is becoming the insider threat no one planned for. Izar shares a firsthand account of watching an AI agent attempt increasingly creative workarounds to escape a sandbox, revealing just how much risk lives in the gap between what agents are told to do and what they are actually capable of. At the end of the day, it comes back to fundamentals: define your agents' boundaries, limit their capabilities to only what they need, and stop confusing tool accumulation with security maturity. 🚀 Join the Conversation If your AI agent were compromised today, would you even know it was the agent and not you? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E9
April 30 · 47 min
The Human In The Loop Illusion: Why AI Approvals Are Failing Security
In this episode, a debate about hacker movies turns into a deeper conversation about AI, security, and the human-in-the-loop illusion. We explore how approval fatigue and AI-generated code can create a false sense of security and why fundamentals still matter. 🚀 Join the Conversation Are we improving security, or just automating bad decisions faster? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E8
April 15 · 47 min
The Mythos Problem: When AI Finds Every Vulnerability
In this episode, we break down the “AI Vulnerability Storm” and what happens when AI can find—and exploit—vulnerabilities faster than humans can fix them. We explore how compressed OODA loops are shifting the balance toward attackers, why traditional scoring like CVSS may start to break down, and whether “just patch faster” is even realistic anymore. The team also questions the push toward AI agents everywhere—and whether fighting AI with more AI actually solves the problem. At the end of the day, it comes back to fundamentals: reduce your attack surface, simplify your systems, and focus on what actually matters. 🚀 Join the Conversation Is this a real shift in security—or just faster chaos? FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E7
April 8 · 47 min
What If AI Never Happened? The AppSec Reality Check
In this episode, we explore a simple but surprisingly deep question: what would application security look like if generative AI never existed? We break down how AppSec might still rely on deterministic, rule-based approaches, what we might gain in structure and rigor, and what we’d lose in speed, scale, and accessibility. Along the way, we debate whether AI is truly improving security or just accelerating existing problems, from “vibe coding” and false confidence in results to the growing gap between finding and fixing vulnerabilities. We also get into the tension between human-driven security practices and AI-assisted workflows, and whether the biggest challenges in AppSec are actually technical at all or still rooted in people and process. Plus, things take a turn as we let AI weigh in…and roast us a bit in the process. Per usual, it’s a mix of thoughtful discussion, strong opinions, and a little chaos. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E6
April 1 · 49 min
The Evolution Problem: After 100 Episodes, What’s Changed… and What Hasn’t?
We made it to 100 episodes, so naturally, we decided to look back and see how wrong we’ve been. In this episode, we revisit some of our past topics, predictions, and hot takes to figure out what still holds up and what didn’t quite land. From “we don’t know what we don’t know” to the evolution of security tools, we reflect on what’s changed, what hasn’t, and why some problems never seem to go away. Along the way, we compare where we were then to where things stand now, calling out a few wins, a few misses, and everything in between. After all this time, are we actually any smarter, or just better at explaining the same problems? This episode is part reflection, part reality check, and a look at what 100 episodes have really taught us. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E5
March 25 · 48 min
The Agent Access Problem: When AI Has the Keys, Who’s Really in Control?
In this episode, we dive into the messy reality of AI agents acting inside your systems and what that means for modern security. We explore the idea of agents as actors with real access—credentials, APIs, and permissions—and why this isn’t as new as it sounds (hint: it’s just applications all over again). We unpack where things actually get risky, from over-permissioned agents to unpredictable behavior driven by prompts, and why “it won’t go rogue” might be missing the point entirely. We also question the growing hype around AI governance, whether security teams are actually gaining control or just making more lists, and what happens when agents start talking to each other… and running up your bill. Per usual, the conversation is filled with sarcasm, skepticism, and a healthy dose of “maybe just add parental controls.” FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E4
March 20 · 36 min
The Invisible Code Problem: When You Can’t See the Attack, Can You Stop It?
In this episode, we dive into the strange world of invisible Unicode attacks and what they could mean for modern software security. We explore how hidden characters can be used to conceal malicious code within packages, why this isn’t entirely a new problem, and whether current tools, such as linters and SAST, are equipped to detect it. We also question the role of LLMs in both enabling and detecting these attacks, and whether this is a real emerging threat or just another overhyped security scare. Per usual, the conversation is filled with sarcasm, skepticism, and a healthy dose of “just don’t do it. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E3
February 6 · 41 min
The Moltbook Dilemma: What Happens When AI Agents Start Networking
In this episode, we discuss the implications of AI technologies like OpenClaw and Moltbot, exploring the potential threats and societal changes that may arise from their integration into daily life. We talk about the nature of AI communication, the concept of agentic AI, and the philosophical questions surrounding the future of human and machine interaction. Per usual our conversation is laced with humor and skepticism about the rapid advancements in AI and their impact on society. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E2
January 28 · 40 min
The Walking Dead of Security: When AI Resurrects the Build vs. Buy Debate
Are cybersecurity technologies really dead, or are reports of their demise greatly exaggerated? Today’s episode is a discussion on how AI is reshaping the classic build vs. buy debate, empowering non-engineers to create working prototypes and potentially reviving the DIY coding culture of pre-open-source days. We also talk about how developers trained on open source are now leveraging AI built from that same foundation, raising questions about innovation and originality in modern programming. Build vs Buy is Dead - AI Just Killed It Traditional Code Review is Dead FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S4 · E1
January 14 · 40 min
Crystal Penguins and AI Chaos: What Could Go Wrong in 2026?
We’re predicting what 2026 has in store for AI and cybersecurity. We explore the wild possibilities of AI integration gone wrong, from people accidentally connecting their AI to sensitive file systems to blaming their AI agents for losing critical data. The conversation takes a thoughtful turn as they debate which jobs might fall to AI automation and if the human touch is still irreplaceable? Examining real examples like the "Y'allbot" weather monitoring system and photorealistic AI actress Tilly Norwood to illustrate how rapidly AI is transforming industries.Tune in and learn how to navigate the AI-powered future responsibly. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!
S3 · E21
Dec 3, 2025 · 30 min
The Cost of Knowing: How Cybersecurity Professionals View Innovation Differently
We’re pulling back the curtain on the technology industry to reveal what life looks like when you're constantly aware of what can go wrong. From the loss of childlike wonder when encountering new tech to the ethical dilemmas posed by autonomous vehicles, we discuss the unique burden of seeing technology's darker possibilities. We’re examining how years of witnessing security breaches and system failures shape a professional outlook that balances innovation with caution. FOLLOW OUR SOCIAL MEDIA: ➜ X: @SecTablePodcast ➜ LinkedIn: The Security Table Podcast ➜ YouTube: The Security Table YouTube Channel Thanks for Listening!

Showing 1–20 of 22 episodes