Cyber Sentries: AI Insight to Cloud Security

Fighting Fire with Fire: How CyberProof Is Automating Cyber Defense with Edy Almer

Cybersecurity has spent the last decade getting better at telling teams something is wrong. The next fight is getting AI to actually do something about it. In this episode, host John Richards talks with Edy Almer, CPO and VP of Product at CyberProof, about the shift from AI-assisted detection to AI-driven response, and why the biggest obstacle to full automation isn't the technology anymore — it's convincing organizations to trust it.Racing an Attacker That Doesn't Think Like OneEdy has spent his career across nearly every layer of the security stack — from endpoint at Symantec, to network policy at AlgoSec, to SIEM at LogPoint — before landing at a service provider willing to go all-in on agentic AI. That vantage point matters: a single enterprise sees its own incidents, but a provider like CyberProof sees patterns across dozens of large customers, which is exactly the kind of volume agentic tools need to prove themselves fast.The real work, Edy explains, hasn't been proving the models are accurate — CyberProof's internal harness moved past hallucination risk early. It's building a tiered system that decides, case by case, whether a response runs fully automatically, end-to-end agentically, or agentically with a human closing the loop. That tiering is what lets CyberProof push toward near-total automation — currently around 96–97% — without asking risk-averse customers to hand over the keys all at once.The conversation also digs into how AI is changing the attacks themselves. Drawing on Anthropic's research into misuse of its own models, Edy describes a shift away from the linear, traceable kill chains security teams are trained to detect, toward noisy, parallel, autonomous attack attempts that try many paths at once. Defending against that, he argues, means CyberProof has to automate its own defenses at the same speed and scale attackers are starting to use.Questions We Answer in This EpisodeWhy is organizational trust, not AI accuracy, the real bottleneck to automating security response?How does CyberProof decide when an incident gets full automation versus a human in the loop?What makes AI-driven attacks fundamentally different from traditional, human-led ones?How close is a modern SOC to running fully autonomously?Key TakeawaysAgentic security works best as a tiered system, matching full automation, agentic-plus-human-handoff, and human-led response to each customer's risk tolerance.The technology is often ready before the organization is; getting IT, legal, and executive sign-off is now the slower step.AI-generated attacks run multiple parallel, non-linear paths instead of one traceable chain, which breaks detection built around tracking a single attacker's steps.Public benchmarks aren't enough to validate agentic tools; CyberProof tests continuously against its own live customer use cases instead.As agentic AI keeps closing the gap between detection and response, the organizations that get ahead won't just be the ones with the best models — they'll be the ones that figure out how to trust them. Edy's take offers a clear-eyed look at what that actually takes.ResourcesEdy Almer on LinkedInLearn more about CyberProof's Agentic MXDRCyberProofLearn more about Paladin CloudGot a question? Ask us here! (00:00) - Welcome to Cyber Sentries (01:13) - Meet Edy Almer (01:37) - Edy’s Cybersecurity Journey (04:20) - The Landscape (07:53) - Adjusting to Improvements (10:46) - Elements to Be Aware of (13:43) - Big Gaps (22:33) - Attack Simulations (24:00) - What’s Next (27:10) - Stories Used (31:13) - Wrap Up

The Joystick Effect: How Attackers Manipulate Your Security Data with Chris Nyhuis

Why AI Needs a Deterministic Pass FirstAs security teams lean harder on AI to catch threats faster, a foundational question keeps getting skipped: is the data feeding that AI actually trustworthy? On this episode of Cyber Sentries, host John Richards sits down with Chris Nyhuis, president and CEO of Vigilant, to unpack why forensic validation — not faster algorithms — may be the missing piece in modern threat detection.Why Your Detection Stack Might Be Blind to Its Own Blind SpotsJohn and Chris dig into what Chris calls the "joystick effect" — a technique where threat actors quietly manipulate logs and EDR training data so security tools learn to miss them entirely. It's a tactic that's existed for decades, but as more teams hand decisions to AI without questioning the data underneath, it's becoming far more dangerous.Chris also walks through why packet loss on span ports and mirror ports can silently gut visibility long before AI ever gets involved, and why physical taps and chain-of-custody collection matter more than flashy detection features. The conversation moves through Vigilant's "deterministic pass, then AI" model — a method for cutting hallucinations and dramatically speeding up detection — and closes with a candid look at how marketing-driven "top vendor" lists have diluted trust across the industry.Questions We Answer in This EpisodeHow do attackers manipulate logs and EDR data without ever being detected?Why does packet loss on span ports and mirror ports undermine AI-driven security?What does a "deterministic pass, then AI" detection model actually look like?How can security teams tell if a vendor's claims are backed by real, verifiable value?Key TakeawaysValidate data at the point of collection — forensic integrity has to come before analysis.Use physical taps and chain-of-custody practices to close the packet-loss gap.Pair deterministic evidence with AI pattern-matching, then bring in humans for final judgment.Question vendor rankings and scorecards that aren't grounded in verifiable data.Chris leaves listeners with a clear challenge: build detection on evidence you can verify, not on tools you simply hope are working. As AI takes on a bigger share of security decisions, that discipline is what will separate resilient organizations from the next headline breach.ResourcesChris Nyhuis on LinkedInVigilantVigilant’s Open-Source CI/CD Security Scan FindingsLearn more about Paladin CloudGot a question? Ask us here!CyberProof (00:01) - Welcome to Cyber Sentries (01:15) - Meet Chris Nyhuis (01:25) - Chris’ Journey (05:28) - Shifts in Landscape (07:52) - Changes from AI (12:47) - Differentiating (15:48) - How It Looks on Data Side (19:08) - Getting Around It (24:55) - Forensic (27:48) - Integrating AI (31:05) - Using Vigilant (33:38) - Wrap Up

Beyond the Token: How to Secure Agent Identity Across the Full Permission Chain with Jasson Casey

People-Pleasers: Why AI Agents Go Rogue and How to Govern Them at Scale with Shreyans Mehta

Agent Gone Rogue: How to Build Behavioral Guardrails for Agentic AI in the Enterprise with Shreyans MehtaHost John Richards welcomes back Shreyans Mehta, CTO and co-founder of Cequence, for a return visit that couldn't be more timely. Two years ago, they were talking about securing AI at the application layer. Now enterprises are running thousands of autonomous agents around the clock, and the security perimeter has fundamentally changed. In this episode, John and Shreyans dig into the new class of risk that comes with agentic AI—and what it actually takes to govern it.When Your AI Agent Deletes the System to Delete the EmailShreyans opens with a concept that reframes the whole conversation: AI agents aren't just a productivity tool—they're autonomous actors with access to your most sensitive systems. The problem isn't that they'll go rogue on purpose. It's that they're people-pleasers. They will exhaust every available path to complete a task, which means broad access will get used in ways you never anticipated.He shares two stories that land hard. First, a research case study called Agents of Chaos, where an agent tasked with deleting a saved password—lacking email-delete permissions—resolved the problem by deleting the system instead. Second, a real customer scenario where a Claude Code-based agent spent an entire weekend trying to upgrade a legacy codebase and, when it couldn't fetch a file due to a missing SHA value, started guessing characters one by one—for hours.The fix isn't just identity and access management—it's a new layer Shreyans calls agent behavioral analytics. Start with a plain-English job description. Cequence translates that into deterministic rules: what the agent can access, what it can send, what it can never do. Every interaction is monitored against that job description in real time—not just logged, but enforced. When the email assistant starts forwarding sensitive data to an unknown address, it gets stopped, not flagged.Questions We Answer in This EpisodeWhy is identity management alone not enough to secure AI agents?What is the token flattening problem, and why does it matter for enterprise security?How do you translate a plain-English agent job description into deterministic access controls?What does agent behavioral analytics look like in practice—and who owns it inside an organization?Key TakeawaysAI agents are already in your environment—the only question is whether you're governing them.Every agent needs a job description that converts into deterministic rules, not just an identity token.Monitoring must be tied to behavior, not just access logs—and it has to stop bad actions, not just detect them.Agent sprawl demands a new security category built for non-human, 24/7 actors.If your organization is running agentic AI and nobody owns the behavioral layer yet, this episode is a good place to start. The enterprises getting it right aren't waiting for security teams to green-light every agent—they're using tools that translate intent into guardrails automatically. Give it a listen, then check out the resources below.ResourcesShreyans Mehta, Cequence: LinkedInCequence AI GatewayCequence on LinkedInCyberProofLearn more about Paladin CloudGot a question? Ask us here! (00:00) - Welcome to Cyber Sentries (01:08) - Shreyans Mehta (01:57) - Changes Since His First Visit (04:03) - Finding Ways to Feel More Comfortable (11:24) - Getting a Handle on It (16:11) - Access and Profiles (21:55) - Transitioning to Rules (24:24) - How Teams Use This (26:49) - Playing Out in the Real World (27:49) - Learning More (29:07) - Wrap Up

Five Seconds to Fraud: Detecting AI Deepfakes Before They Strike with Ben Colman

Inside the AI Deepfake ThreatWhat if the voice confirming your wire transfer wasn't actually your client? Ben Colman, founder and CEO of Reality Defender, joins host John Richards to unpack one of the fastest-growing attack surfaces in cybersecurity: AI-generated deepfakes. Once the exclusive domain of Hollywood studios and nation-state actors, real-time voice and video impersonation is now accessible to anyone with a laptop—and fraudsters are scaling up fast.From Specialized Hardware to Your Home ComputerBen traces the evolution from the specialized machinery required six years ago to today's world where anyone can clone a voice with less than five seconds of audio—locally, for free, using open-source models. He walks through the modern fraud landscape, from grandparent scams and bank account takeovers to an eye-opening story about fake job applicants that will make any recruiting team rethink its screening process.Reality Defender's approach is built for how organizations actually work—plugging directly into call centers, video conferencing platforms, and identity verification tools through a simple API, rather than asking teams to adopt yet another standalone product. Their probabilistic detection models scan in real time across thousands of indicators, all without storing or comparing against any biometric data.John and Ben also get into the emerging frontier of agentic AI—what happens when you need to authenticate an AI voice agent rather than a human—and how smart permission gates can define exactly what those agents are and aren't allowed to do.Questions We Answer in This EpisodeHow has the barrier to creating convincing deepfakes changed in the last six years?What are the most common deepfake fraud vectors hitting businesses and consumers right now?How does Reality Defender detect AI-generated media without storing any biometric data?What does deepfake defense look like as agentic AI becomes mainstream?Key TakeawaysVoice cloning now requires less than five seconds of audio and runs locally on consumer hardwareDeepfake fraud spans a wide range—from grandparent scams to fake job applicants to wire transfer hijackingReal-time detection can plug directly into tools organizations already use, with no new workflow requiredAgentic AI is creating a new category of identity challenge—and the defenses are already being builtThe deepfake threat isn't coming—it's already here, hitting call centers, recruiting pipelines, and financial institutions every day. Whether you're a developer looking to integrate detection into your stack or a security leader trying to get ahead of the next wave, this conversation is a essential listen.ResourcesReality DefenderBen ColmanReality Defender on LinkedInFollow Reality Defender on XCyberProofLearn more about Paladin CloudGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (00:35) - Meet Ben Colman, Reality Defender (01:23) - Ben’s Beginnings (02:36) - Changing Landscape (03:57) - What It Looks Like Today (05:07) - Differences (06:16) - Main Ways Fraud’s Committed (09:21) - Way to Tackle It (11:07) - Distinguishing the AI (13:14) - Response Time (14:09) - Recommended Next Steps (15:55) - Where It’s Heading (19:21) - How to Use as Organization (20:52) - Developer Community (22:23) - Audio and Video (23:34) - Risk Assessment (24:41) - Prevalence (26:09) - Wrap Up

Built Fast, Broken Faster: MCP & AI App Security—with GitGuardian’s Gaetan Ferry

When “Ship Fast” Meets “Secure by Design” in AI AppsAI-driven development is moving at breakneck speed—and attackers are taking advantage of the shortcuts. In this episode of Cyber Sentries: AI Insights for Cloud Security, host John Richards sits down with Gaetan Ferry, security researcher at GitGuardian, to unpack how modern AI tooling, MCP servers, and cloud platforms are reshaping the security landscape. The core problem: the same agentic workflows that boost productivity can also multiply identities, credentials, and blast radius if something goes wrong.After John and Gaetan set the stage, Gaetan walks through a real-world-style vulnerability chain involving smithery.ai, an MCP server registry/hosting platform. It’s a practical look at how “classic” web issues can still show up in brand-new AI ecosystems—and how one small weakness can cascade into bigger supply chain risk. Along the way, they explore why secret sprawl is accelerating, what attackers are hunting for, and why observability is becoming as essential for identities and tokens as it is for infrastructure.Why MCP Servers, OAuth, and Secret Sprawl Are CollidingA big theme is the tension between usability and security: teams want agents that can “do everything,” which often means broad permissions and long-lived credentials. Gaetan explains why adopting OAuth is directionally better than static API keys, but still not a silver bullet in a world where agents need delegated access and tokens inevitably “live somewhere.” John pushes on what builders can do now—especially when new frameworks (and new hype cycles) keep resetting hard-won security practices.The conversation lands on pragmatic guidance: reduce blast radius where you can, inventory identities and secrets, and invest in observability so you can respond fast when—not if—credentials leak. Note: This episode discusses breach scenarios and exploitation chains—be thoughtful about sharing internal security details and incident response specifics.Questions We Answer in This EpisodeHow can a simple web flaw turn into an AI supply chain attack through MCP server hosting?Why doesn’t OAuth automatically “solve” agent security and credential risk?What does “limiting blast radius” look like when agents need broad permissions to be useful?How can observability help you detect and respond to secrets sprawl across AI tools?Key TakeawaysTreat MCP servers and agent integrations like critical supply chain dependencies—because they are.Prefer short-lived, scoped credentials (OAuth when possible), but plan for token theft scenarios anyway.Reduce blast radius with least privilege, separation of duties, and segmented agent access.Build identity and secret observability so you can triage and remediate leaks quickly.The Bottom Line for AI Security Teams in 2026If you’re experimenting with MCP servers or rolling out agentic workflows, this episode is a timely reminder that fundamentals still win. John and Gaetan make the case that “moving fast” doesn’t have to mean accepting unlimited credential risk—you can ship quickly while still tightening scopes, tracking identities, and watching where secrets spread. Tune in for the real-world examples and the practical mindset shift that helps teams stay productive without becoming the next supply chain headline.Links & NotesGitGuardianConnect with Gaetan on LinkedInState of Secrets Sprawl Report 2025State of Secrets Sprawl Report 2026 (coming later in March!)CyberProofLearn more about Paladin CloudGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (01:07) - Meet Gaetan Ferry (02:19) - Attacks (03:17) - Vulnerabilities (07:38) - One-Off or Widespread? (10:20) - Recommendations to Avoid (14:19) - Exploiting (16:50) - Resolving (23:13) - Path Forward (30:53) - Impact (34:48) - Year of Supply Chain Attacks (35:51) - Wrap Up

Identity in the AI Era: Managing Enterprise Risk in the Age of AI with Jasson Casey

The Evolution of Identity Security in the Age of AIIn this episode of Cyber Sentries, John Richards sits down with Jasson Casey, CEO and co-founder of Beyond Identity, to explore the intersection of identity security, AI, and enterprise risk management. As organizations rapidly adopt AI tools and agents, the fundamental challenges of identity security are evolving—requiring both new approaches and a return to core principles.Identity: The Foundation of Modern SecurityJasson explains how identity has become the root cause of most security incidents, with identity-based failures accounting for 80% of security tickets. The conversation explores how AI is transforming every role in modern organizations, while highlighting the security implications of this rapid adoption.Key Takeaways:Identity security is fundamental to managing AI risk in enterprisesTraditional security concepts still apply but require new implementation approachesOrganizations need to track data flow and permissions across AI systemsLooking AheadAs AI adoption accelerates, organizations must balance innovation with security. Through proper identity management and understanding of data flow, enterprises can prevent most security incidents while embracing the transformative potential of AI technologies.Links & NotesBeyond IdentityAI SolutionsConnect with Jasson Casey on LinkedInConnect with Jasson Casey on XCyberProofLearn more about Paladin CloudGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (01:02) - Meet Jasson Casey (02:51) - Regrets? (08:19) - Friction Point (10:28) - Identity (17:08) - Adoption (22:17) - The Hallmark of Network Security (28:10) - Paint Analogy (31:17) - Threats (34:08) - Visualization Tool (35:13) - Their Work in This Space (37:05) - Learning More (37:36) - Wrap Up

Security Data Pipelines: How to Cut SIEM Costs and Noise with Dina Kamal

SIEM Speed Without the Sprawl—DataBahn’s Take on Security Data PipelinesIn this Cyber Sentries: AI Insights for Cloud Security episode, host John Richards sits down with Dina Kamal, Chief Revenue Officer at DataBahn, to tackle a familiar cloud security problem: teams can’t get the right data into the SIEM fast enough, and when they do, costs and noise spike. After the introductions, John and Dina dig into why data integration and parsing often consume most of the timeline in SIEM projects—and how a security data pipeline layer can compress onboarding from months to weeks.They also explore what “doing more with less” looks like in a modern SOC: filtering and routing data based on detection value, preserving what’s needed for compliance, and keeping flexibility for SIEM migrations. Dina’s bigger point is that AI only becomes truly useful when it’s paired with domain expertise and real operational context—otherwise it’s easy to end up with impressive-looking outputs that don’t hold up under investigation pressure.Questions We Answer in This EpisodeWhy do SIEM projects stall on data onboarding, and what speeds it up?How can you cut SIEM ingestion costs without weakening detections?What does owning your security data change during SIEM migrations?Where does AI help most in SOC workflows, and where do guardrails matter?Key TakeawaysData pipelines remove SIEM “plumbing” bottlenecks by automating collection, parsing, and transformation.Cost reduction works best when you filter by security value, not just by volume.Decoupling data collection from the SIEM reduces lock-in and simplifies vendor changes.AI is strongest when guided by security context and experienced practitioners.The throughline is practical: better detections and faster investigations start upstream with intentional data handling. By treating the SIEM as a high-value analytics destination instead of a dumping ground, teams can regain capacity, reduce noise, and keep options open as tools and vendors change. And when AI is applied to the right parts of the workflow—with clear constraints and real-world context—it can accelerate outcomes without compromising trust.Links & NotesDataBahnConnect with Dina Kamal on LinkedInLearn more about CyberproofGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (01:02) - Meet Dina Kamal (03:14) - Data Pipeline Management (05:55) - The Target (07:32) - Changing Vendors (08:34) - No Storage (09:31) - Why People Need It (13:09) - Ahead of the Curve (19:54) - Capturing the Data (23:02) - Useful Data (26:02) - More with Less (27:03) - Visibility (29:40) - When to Start (31:04) - Wrap Up

Securing AI Agents: How to Stop Credential Leaks and Protect Non‑Human Identities with Idan Gour

Bridging the AI Security Gap—Inside the Rise of Non‑Human IdentitiesIn this episode of Cyber Sentries from CyberProof, host John Richards sits down with Idan Gour, co-founder and president of Astrix Security, to unpack one of today’s fastest-emerging challenges: securing AI agents and non-human identities (NHIs) in the modern enterprise. As companies rush to adopt generative-AI tools and deploy Model Context Protocol (MCP) servers, they’re unlocking incredible automation—and a brand-new attack surface. Together, John and Idan explore how credential leakage, hard-coded secrets, and rapid “shadow-AI” experimentation are exposing organizations to unseen risks, and what leaders can do to stay ahead.From Non‑Human Chaos to Secure‑by‑Design AIIdan shares the origin story of Astrix Security—built to close the identity-security gap left behind by traditional IAM tools. He explains how enterprises can safely navigate their AI journey using the Discover → Secure → Deploy framework for managing non-human access. The conversation moves from early automation risk to today’s complex landscape of MCP deployments, secret-management pitfalls, and just-in-time credentialing. John and Idan also discuss Astrix’s open-source MCP wrapper, designed to prevent hard‑coded credentials from leaking during model integration—a practical step organizations can adopt immediately.Questions We Answer in This EpisodeHow can companies prevent AI‑agent credentials from leaking across cloud and development environments?What’s driving the explosion of non‑human identities—and how can security teams regain control?When should organizations begin securing AI agents in their adoption cycle?What frameworks or first principles best guide safe AI‑agent deployment?Key TakeawaysStart securing AI agents early—waiting until “maturity” means you’re already behind.Visibility is everything: you can’t protect what you don’t know exists.Automate secret management and avoid static credentials through just‑in‑time access.Treat AI agents and NHIs as first‑class citizens in your identity‑security program.As AI adoption accelerates within every department—from R&D to customer operations—Idan emphasizes that non‑human identity management is the new frontier of cybersecurity. Getting that balance right means enterprises can innovate fearlessly while maintaining the integrity of their data, systems, and brand.Links & NotesLearn more about Paladin CloudLearn more about Astrix SecurityOpen Source MCP Secret WrapperIdan Gour on LinkedInGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (01:21) - Meet Idan Gour (03:36) - As the Vertical Started to Grow (06:37) - The Journey (09:24) - Struggling (13:18) - Risk (16:15) - Targeting (17:54) - Framework (20:18) - Implementing Early (21:52) - Back End Risks (24:04) - Bridging the Gap (26:13) - When to Engage Astrix (29:54) - Wrap Up

AI Compliance Security: How Modular Systems Transform Enterprise Risk Management with Richa Kaul

AI-Powered Compliance: Transforming Enterprise SecurityIn this episode of Cyber Sentries, John Richards speaks with Richa Kaul, CEO and founder of Complyance. Richa shares insights on using modular AI systems for enterprise security compliance and discusses the critical balance between automation and human oversight in cybersecurity.Why Enterprise Security Compliance Matters NowThe conversation explores how enterprises struggle with increasing cyber threats and complex third-party vendor networks. Richa explains how moving from reactive to proactive compliance monitoring can transform security posture, sharing real examples from Fortune 100 companies and major sports organizations.AI Implementation That Prioritizes SecurityRicha details their approach to implementing AI in compliance, emphasizing their commitment to data privacy and security. The company uses a modular AI infrastructure with opt-in features and minimal data access principles, demonstrating how AI can enhance security without compromising privacy.Questions We Answer:How can enterprises shift from reactive to proactive compliance monitoring?What are the key considerations for implementing AI in security compliance?How should companies manage third-party vendor risks in the AI era?What role does employee education play in maintaining security compliance?Key Takeaways:Continuous monitoring beats point-in-time compliance checksModular AI systems offer better security control than all-in-one solutionsThird-party vendor risk requires automated, continuous assessmentHuman elements like training and culture can't be fully automatedLooking Ahead: Security ChallengesThe discussion concludes with insights into future challenges, including quantum computing's impact on security and the growing complexity of AI-related risks. Richa emphasizes the importance of building nimble, configurable systems to address emerging threats.Links & NotesMore About Richa KaulComplyance on LinkedIn and the WebLearn more about Paladin CloudLearn more about CyberproofGot a question? Ask us here! (00:04) - Welcome to Cyber Sentries (01:13) - Meet Richa Kaul from Complyance (02:32) - Areas Needing Security (04:19) - Reactive vs. Proactive (06:17) - Integrating AI (07:59) - AI Compliance Challenges (10:48) - Training Their Models (12:16) - Evaluating Third Parties (15:49) - The Team (19:04) - Looking to the Future (20:44) - How Others Are Implementing AI (24:04) - Creating Capacity (25:44) - Companies Doing It Well (27:25) - When They Don’t Have the Resources (28:50) - Wrap Up