Cloud Security Today

Hosted by Matthew Chiodi

TechnologyInterviews guests

Website RSS feed

Episodes

Latest episode

Jul 2026

Language

About the show

The Cloud Security Today podcast features expert commentary and personal stories on the “how” side of cybersecurity. This is not a news program but rather a podcast that focuses on cyber leadership and understanding the threats most impacting organizations today.

Listen to episodes

60 recent

August 20, 202651 min

The AI harness

AI security has a hype problem. Every week brings a new headline about agents escaping sandboxes, AI replacing security teams, or models becoming “too smart” to control. But the more useful question for CISOs is much more practical: where do the actual security controls belong? In this episode, I sit down with Diana Kelley , CISO at Noma Security and one of the clearest voices in AI security, to separate AI mythology from operational reality. Diana explains why the LLM itself is not the security boundary, why the “harness” around the model matters, and how security teams should think about contamination, consequence, and runtime control as agentic AI moves into the enterprise. This conversation is not about AI hype. It is about what CISOs, security architects, and technical leaders need to understand before AI systems start taking autonomous action at machine speed. What You’ll Learn Why AI security is different from traditional AppSec What an AI “harness” is and why it matters Why the LLM should not be treated as a security control How prompt injection relates to trust boundaries and context windows Why agentic AI increases both speed and consequence Key Takeaways The model is not the control point. The LLM is powerful, but it is not deterministic enough to serve as the primary security boundary. Security controls need to live before and after inference — in the harness, surrounding software, workflow, and runtime environment. Think in terms of contamination and consequence. Contamination is what enters the context window. Consequence is what the system does after inference. Both need controls, especially when AI agents can act repeatedly and autonomously. Agentic AI changes the scale problem. A single bad prompt is one thing. Hundreds or thousands of agents looping through tasks at machine speed is another. The risk is not just bad output. It is autonomous action without adequate guardrails.

July 1, 202647 min

Cyber and the NY Giants

Christina Morillo shares her unconventional career journey from traditional IT to cybersecurity in the NFL, highlighting the importance of building trust, understanding business risk, and addressing misconceptions in cybersecurity. Christina's book: Zero Trust Networks

May 10, 202645 min

Identity for AI agents

AI agents are moving from answering questions to taking action. That changes everything for identity and access management. In this episode, Ken Huang joins Matt to break down why traditional IAM was not built for agentic AI, where service accounts and OAuth scopes fall short, and what CISOs should do now to govern agents before they hit production at scale. Episode Links Ken's substack Ken's paper from 2011 on AI (he was way ahead!) NIST AI RMF

April 11, 202644 min

The future of CISO

In this episode, Michael Piacente shares insights on career transitions in IT and security, the evolving role of CISOs, and the impact of AI on security talent and practices. Discover how community, storytelling, and strategic hiring shape the future of cybersecurity leadership. Resources The 2026 Global CISO Leadership Report Hitch Partners NIST AI Framework

September 21, 2023Episode 950 min

SBOMs: Good but less than a silver bullet

Send a text Episode Summary On today’s episode, Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency, Allan Friedman, joins Matt to discuss SBOMs. As Senior Advisor and Strategist at CISA, Allan coordinates the global cross-sector community efforts around software bill of materials (SBOM). He was previously the Director of Cybersecurity Initiatives at NTIA, leading pioneering work on vulnerability disclosure, SBOM, and other security topics. Before joining the Federal government, Friedman spent over a decade as a noted information security and technology policy scholar at Harvard’s Computer Science Department, the Brookings Institution, and George Washington University’s Engineering School. He is the co-author of the popular text Cybersecurity and Cyberwar: What Everyone Needs to Know , has a C.S. degree from Swarthmore College, and a Ph.D. from Harvard University. Today, Allan talks about SBOMs and their adoption in non-security industries, Secure by design and secure by default tactics, and how to make software security second nature. What, exactly, is the SBOM? Hear about how SBOMs could’ve helped against significant attacks, the concept of antifragility, and why vulnerability disclosure programs are so important. Timestamp Segments · [02:27] Allan’s career path. · [05:10] Allan’s day-to-day. · [06:15] What has been most rewarding? · [08:00] SBOMs in non-security startups. · [10:50] Real-world examples of Secure by Design tactics. · [17:30] Will software security ever seem obvious to us? · [19:30] What is the SBOM, and will it solve all our problems? · [23:41] Could an SBOM have helped against the SolarWinds attack? · [27:52] Memory-safe programming languages. · [30:16] Misconceptions around Secure by Design, Secure by Default. · [32:00] The importance of vulnerability disclosure programs. · [35:37] Antifragility in cybersecurity. · [41:47] VEX. · [44:29] How to get involved with CISA. · [48:00] How does Allan stay sharp? Notable Quotes · “Sometimes, organizations need a good excuse to do the right thing.” · “It is bananas that software that we use, and pay for, still delivers with it not just the occasional vulnerability, but very real risks that require massive investments from customers.” · “When tech vendors make important logging information available for free, everyone wins.” · “The SB in SBOM doesn’t stand for Silver Bullet.” Relevant Links Email: sbom@cisa.dhs.gov Website: www.cisa.gov LinkedIn: Allan Friedman Resources: Open Source Security Podcast Risky Business Podcast The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

February 14, 2022Episode 234 min

Fed Clouds

Send a text In a world where cyber-attacks are ever-changing, cybersecurity has to adapt accordingly. Joining us today to delve into the world of cloud security for federal agencies is Sandeep Shilawat, Vice President of Cloud and Edge Computing at ManTech. Sandeep has extensive experience in both Commercial and Federal technology markets. We’ll get to hear his predictions on where the cloud world is heading, as well as what the Federal Authority to Operate (ATO) process will look like in the future. We learn the benefits of cloud compliance standards, as well as how FedRAMP is leveling the playing field in federal cloud computing. We also touch on the role of 5G in cloud computing, and why its presence will disrupt going forward. Join us as we pick Sandeep’s brain for some insights into the present and future of federal cybersecurity. Tweetables “Visibility has become [the] single biggest challenge and nobody's dealing with cloud management in a multi-cloud perspective from cradle to grave.” — @Shilawat [0:09:03] “I think that having a managed cloud service is probably the first approach that should be considered by an agency head. I do think that that's where the market is heading. Sooner or later, it will probably become a de facto way of doing cloud security.” — @Shilawat [0:19:43] The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

January 21, 2023Episode 147 min

SEC-retly Telling All: The New Cyber-Disclosure Rules

Send a text Episode Summary On this episode, Matt speaks with Senior Executive, Board Director, and leader in Cybersecurity, risk management, and regulatory compliance, Chris Hetner about cybersecurity and the newly-proposed SEC cybersecurity rules. With over 25 years of experience in the cybersecurity space, Chris has served in roles including as Senior Cybersecurity Advisor to the Chairman at the SEC, Managing Director of Information Security Operations at GE Capital, and SVP Information Security at Citi. Today, Chris talks about understanding the proposed cybersecurity rules, defining materiality, and the importance of focusing on cyber-resilience. Where does the Cloud come into it? Hear about the cost of cyberattacks, the core risk exposures, and Chris’s formula to personal growth. Timestamp Segments · [02:47] Chris’s proudest moments. · [10:00] The new proposed rules. · [14:26] Defining materiality. · [23:56] Bridging the language gap. · [32:14] Focusing on cyber-resilience. · [35:36] Cybersecurity expertise on the board. · [41:27] The cloud. · [45:32] The formula to personal growth. Notable Quotes · “Ransomware extortion is relatively insignificant relative to the overall cost of the event.” · “You can’t outsource the risk.” · “Realize that you’re not always the smartest person in the room.” · “We don’t know it all, and we never will.” The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

December 20, 2023Episode 1252 min

30 years in cybersecurity

Send a text Episode Summary On this episode, InfoSec veteran, Aaron Turner, joins the show to talk about everything from Cloud to AI. Over the past three decades, Aaron has served as Security Strategist at Microsoft, Co-Founder and CEO of RFinity, Co-Founder and CEO of Terreo, VP of Security Products R&D at Verizon, Founder and CEO of Hotshot Technologies, Founder and CEO of Siriux, Faculty Member of IANS, Board Member at HighSide, President and Board Member of IntegriCell, and most recently as CISO at a large infrastructure player. Today, Aaron talks about the critical decisions that led to his success, the findings in his IANS research, and the importance of physical vs logical separation in home networks. What are the things that are lacking in current AI services? Hear about the security applications of behavioral AI, Aaron’s approach as he gets back into industry, and what it takes for Aaron to remain sharp. Timestamp Segments · [02:49] Getting started. · [10:53] Aaron’s keys to success. · [16:40] Aaron’s IANS research. · [20:42] Physical vs logical separation. · [24:19] Top mistakes that customers make. · [26:56] Real-world AI applications. · [32:13] Thinking about AI and risk. · [36:15] What’s missing in the current AI services? · [40:46] Getting back into the industry. · [45:22] How does Aaron stay sharp? Notable Quotes · “Get deep in something.” · “Make sure you put yourself in situations where people expect you to be sharp.” Relevant Links LinkedIn: Aaron Turner . Resources: www.iansresearch.com The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

August 20, 2024Episode 1054 min

Microsoft 365 incident response

Send a text Purav Desai is a Microsoft 365 incident responder at a large financial institution (name withheld to protect the innocent). He shares his journey and expertise in the field. He explains how his early exposure to Microsoft security solutions and their constant innovation led him to specialize in 365 security and incident response. He discusses the importance of mentors and influential figures in his career, highlighting the lessons he learned from them. He then dives into his popular project, Deciphering UAL (Unified Audit Logs), which aims to make sense of the complex logs in Microsoft 365. Purav shares an incident response scenario involving a banking Trojan and how he used telemetry and logging to investigate and remediate the issue. He concludes by discussing effective threat detection methods in Microsoft 365, including threat hunting with KQL and leveraging Zero-Hour Auto-Purge (ZAP) to prevent the spread of attacks. In our conversation, we dive into: How specializing in Microsoft 365 security and incident response can be a wise choice due to the constant innovation and market demand for Microsoft solutions. How having mentors and influential figures in your career can provide valuable guidance and inspire you to push yourself and try new things. His personal project, Deciphering UAL (Unified Audit Logs), aims to make sense of the complex logs in Microsoft 365, providing insights for digital forensics and incident response. How proper licensing and logging configuration are crucial for effective incident response. How native tools like Purview Audit and eDiscovery provide valuable insights for forensic analysis. The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

March 21, 2023Episode 343 min

Book review: CISO Evolution

Send a text On this episode, the Founder of CISO Evolution LLC, Matthew Sharp, joins Matt to talk about his book, CISO Evolution. Prior to founding CISO Evolution LLC, Matt served as a strategic advisor to CISOs of Fortune 500 and global institutions. He holds a Bachelor of Science (BS) in Electrical and Computer Engineering from the University of Colorado and a Master of Business Administration (MBA) from Colorado State University. Matt is a co-author of "The CISO Evolution: Business Knowledge for Cybersecurity Executives." Today, Matthew talks about his 2012 sabbatical, walking the Camino de Santiago, and the CISO Evolution book. Why does process matter more than analysis? Hear about value creation, business negotiations, and Matthew’s formula for personal growth. Timestamp Segments · [02:06] A bit about Matthew. · [04:30] Matthew’s sabbatical & the Camino de Santiago. · [09:21] What prompted the book? · [12:23] Why does process matter more than analysis? · [19:08] Did Matthew’s MBA lead him down this path? · [24:22] Value creation. · [27:40] Standard metrics. · [31:23] Why is it important for a CISO to know terms? · [33:32] Negotiations and decision-making. · [37:19] What’s Matthew’s formula for personal growth? · [41:12] Matthew’s words of wisdom. Notable Quotes · “If you want to be in the room where it happens, then you have to be equipped to participate in the conversation.” · “Ask the questions that go unasked.” · “Don’t be afraid to go and look like an idiot in front of another business stakeholder.” The future of cloud security. Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI. Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.