Podcast
Safe Mode Podcast
Hosted by Safe Mode Podcast · EN
Podcast by Safe Mode Podcast
40episodes
Episodes
Newest firstAll episodes
From Two Weeks to Three Days: The KEV Deadline Debate
6d ago00:37:29Summary readyDrawing on his experience from his time in government working directly on CISA’s Known Exploited Vulnerabilities (KEV) catalog, Todd Beardsley, VP of Security Research at runZero, explains what it actually took behind the scenes to get a vulnerability added: verifying that real exploitation occurred, confirming the incident mattered to federal interests (including state/local governments, critical infrastructure, or allied nations), and ensuring there was a concrete remediation option before publishing. He walks Greg through how those judgments tied back to Binding Operational Directive 22-01 and how deadlines were set and adjusted from the two-week baseline—context that frames the recent trend toward three-day turnaround requirements. From that insider perspective, Beardsley outlines the practical risks of compressing timelines (especially around testing and change-control realities across 100+ civilian agencies) and why ultra-short deadlines can dilute KEV’s value as an “urgency signal,” even as they may push agencies to modernize staffing, automation, and patch processes to respond faster.
SummaryCan specialized security survive Daybreak and Mythos?
2w ago00:38:07Summary readyIn this episode, we sit down with Lior Div, CEO of 7AI, at a moment when the ground is shifting under the entire security industry. With AI lowering the barrier to entry for attackers, supply chain compromises spreading at worm speed, and OpenAI and Anthropic racing to plant their flags in enterprise cyber defense, the pressure on defenders has never been more acute. We push Div on the hard stuff — whether agentic defense actually closes the asymmetry gap or just keeps pace with it, what Mini Shai-Hulud exposes about the blind spots in how we trust software, how the arrival of Daybreak and Glasswing changes the competitive landscape for pure-play security companies, and whether the industry is building toward genuine resilience or just faster reactions to inevitable breaches. Speaking in Mini Shai-Hulud, Greg talks about a whirlwind week of reporting that covered all the security incidents tied to the malware.
SummaryWhy access brokers have stubbornly remained successful
3w ago00:31:47Summary readyAnna Pham of Huntress joins Safe Mode to discuss the current landscape of initial access brokers and how their tactics continue to support ransomware operations. She explains that attackers are still finding success with drive-by downloads, Trojanized installers, fake browser updates, click-fix attacks, exposed RDP, VPN weaknesses, and vulnerable edge devices. The conversation also covers how access is monetized, what defenders can look for before ransomware deployment, and why limited endpoint visibility often leaves organizations exposed. Fam emphasizes that basic cyber hygiene still matters: close exposed ports, enforce MFA, use complex passwords, apply least privilege, patch systems, and maintain broad visibility across the environment. In our reporter chat, Greg talks with Matt Kapko about the security incident that impacted Canvas.
SummaryCan you prove which agent did what?
4w ago00:28:19Summary readyIn this week's episode, Greg Otto talks with Howard Ting, CEO of Opal Security, about the growing security challenges created by AI agents inside the enterprise, especially around identity governance, access control, and runtime authorization. As organizations adopt coding agents, workplace assistants, and other AI tools, traditional approaches to managing human access are being pushed beyond their limits by the speed, scale, and context required for agent-driven decisions. The conversation explores the risks of shadow AI, overprivileged agents, unintended data exposure, and the difficulty of enforcing least privilege when agents act on behalf of employees across sensitive systems. It also looks at what CISOs and security teams need to prioritize now, from gaining visibility into agent activity to building policy-aware controls that can make real-time access decisions and safely support AI adoption. In our reporter chat, Greg talks with Derek Johnson about a lawsuit where a dating app stole an influencer's TikTok videos to use in targeted ads to people she knew, all without her consent.
SummaryHow government and Industry can raise the cost of cybercrime
Apr 3000:43:29Summary readySophos CEO Joe Levy and Director of Government Partnerships Alex Rose join Safe Mode from Washington, D.C. to discuss what meaningful public-private cybersecurity partnership looks like right now—moving beyond “window dressing” to real operational collaboration with agencies like CISA and the FBI. They break down the shift from Secure by Design to Secure by Demand, arguing that procurement and market forces must pressure software vendors to ship safer defaults, while AI simultaneously accelerates both vulnerability discovery and attacker capability. The conversation also spotlights why small and midsize businesses are disproportionately exposed yet often underserved, and previews Sophos’s upcoming CISO Advantage concept to help close the massive cybersecurity leadership gap. Finally, they examine rising open-source software risk—including maintainers being overwhelmed by low-quality AI-generated vulnerability reports—and why addressing OSS security will require coordinated action across government and industry. In our reporter chat, Greg talks with Tim Starks about the oral arguments held at the Supreme Court in relation to a case that deals with the future of geofence warrants.
SummaryProving Identity in the age of agents
Apr 2300:27:27Summary readyAs AI makes deepfakes and voice cloning more convincing, attackers are shifting away from traditional vulnerabilities and focusing on identity as the easiest path to account takeover and fraud. In this conversation, Eran Haggiag of Glide Identity discusses what it will take to protect identity in an agentic world—how to prove a real user approved an action, how to establish accountability when software acts on someone’s behalf, and why cryptographic, hardware-rooted signals may be the clearest way out of the cat-and-mouse cycle. In our reporter chat, Greg talks with Matt Kapko about what led to the Vercel breach that dominated this week's headlines.
SummaryThe federal government's most underrated cybersecurity tool
Apr 1600:44:32Summary readyIn this episode of Safe Mode, we sit down with Philip George, Executive Technical Strategist at Merlin Group to talk about the real challenges federal agencies face at the intersection of cybersecurity, AI adoption, and post-quantum cryptography. Philip breaks down the disconnect between cyber spending and mission outcomes, why rushing into AI without sound identity management and data integrity is a recipe for disaster, and what evolving federal cryptographic requirements and shortened certificate lifecycles mean for government IT. We dig into why visibility — simply knowing what's on your network — remains the most powerful defensive posture regardless of the threat, explore the tension between zero trust and agentic AI, and hear Philip's counterintuitive take that the answer to AI-driven security challenges might just be more AI, purpose-built and narrow in scope. Also, Greg sits down with Chris Townsend, Elastic’s Global VP of Public Sector, at the Elastic Public Sector Summit to unpack how agencies can operationalize data amid rising cyber threats. Townsend explains why open standards and cross-agency data sharing matter—and how agentic AI can help modernize SOC operations by prioritizing alerts and speeding response times. In our reporter chat, Greg Otto and Derek Johnson break down the surge of AI-in-cybersecurity developments—from Anthropic’s Project Glasswing and the “too dangerous to release” Mythos model to OpenAI’s trusted-access approach—focusing on what these tools could mean for vulnerability discovery and the balance between real risk and hype.
SummaryWhat does industry think of the White House's cybersecurity strategy?
Apr 1000:30:56Summary readyBob Ackerman (founder of Allegis Cyber and a partner at DataTribe) joins Safe Mode to talk about where the new national cybersecurity strategy is trying to push the industry—especially around more open, coordinated “active disruption” with government support (and what that does not mean, like hack-back). He shares what he’s hearing from leaders who want clearer “rules of the road,” and why it’s tough to move from reactive collaboraBob Ackerman (founder of Allegiance Cyber and a partner at DataTribe) joins Safe Mode to talk about where the new national cybersecurity strategy is trying to push the industry—especially around more open, coordinated “active disruption” with government support (and what that does not mean, like hack-back). He shares what he’s hearing from leaders who want clearer “rules of the road,” and why it’s tough to move from reactive collaboration to getting ahead of threats. The conversation then turns to AI and why the next couple of years could get “a little spicy,” with offensive tooling accelerating fast and defenders struggling with visibility, noise, and prioritization. Ackerman’s bottom line: don’t get distracted by shiny objects—double down on fundamentals and hygiene, because you can’t defend what you can’t see.tion to getting ahead of threats. The conversation then turns to AI and why the next couple of years could get “a little spicy,” with offensive tooling accelerating fast and defenders struggling with visibility, noise, and prioritization. Ackerman’s bottom line: don’t get distracted by shiny objects—double down on fundamentals and hygiene, because you can’t defend what you can’t see. In our reporter chat, Greg talks with Tim Starks about the proposed CISA budget and warnings that Iran is going after critical infrastructure in cyber domain.
SummaryWhen iPhone exploits turn into commodities
Mar 2600:35:09Summary readyA sophisticated iPhone exploit kit known as DarkSword has escaped the world of targeted espionage and landed in public view—leaked on GitHub in a form that researchers say is trivial to repurpose and deploy. With the barrier to entry collapsing to “copy, paste, host,” the immediate concern is no longer whether advanced actors can use it, but how quickly criminal groups and opportunistic attackers will operationalize it against the enormous population of out-of-date iOS devices. In this episode, Jame’s Michael Covington joins us for a practitioner-level breakdown of what the DarkSword leak changes, who’s exposed, and what defenders can do right now. We dig into the real enterprise blast radius for organizations with BYOD and partially managed fleets, what meaningful detection and response looks like on iOS when visibility is limited, and how to prioritize patch enforcement, quarantine decisions, and Lockdown Mode for high-risk users. We also zoom out to the bigger pattern: highly capable mobile exploitation frameworks (including recent reporting on Coruna) increasingly surfacing outside tightly controlled circles—reshaping the threat model for Apple devices in the enterprise. In our reporter chat, Greg talks with Matt Kapko on what they heard during their many conversations during their time at the RSAC 2026 Conference.
SummaryBehind the scenes of the Socksescort takedown
Mar 1900:34:54Summary readyIn this episode, we sit down with Chris Formosa to break down the Socksescort disruption—a proxy botnet powered by AVRecon that compromised edge devices at scale. Chris walks us through why the operation was so dangerous, how investigators tracked its command-and-control infrastructure, and what changed between the 2023 disclosure and the eventual takedown in coordination with the Department of Justice. We also dig into why edge devices remain prime targets, where most organizations still have visibility gaps, and what the next evolution of this threat could be. In our reporter chat, Greg Otto and Tim Starks break down DarkSword, a iOS exploit kit that could impact hundreds of millions of people.
Summary