Secured by Galah Cyber with Cole Cornford

Hosted by Day One®

Technology Business NewsInterviews guests

Website RSS feed

Episodes

Latest episode

May 2026

Language

About the show

Secured is the podcast for software security enthusiasts. Host Cole Cornford sits down with Australia's top software security experts to uncover their unconventional career paths and the challenges they faced along the way. Listen in as they share their insights on the diverse approaches to AppSec, company by company, and how each organisation's security needs are distinct and require personalised solutions. Gain insider access to the masterminds behind some of Australia's most successful Software security teams on Secured by Galah Cyber. This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

Listen to episodes

60 recent

May 14, 202628 min

What AI Is Actually Changing in Cyber and How to Keep Up

Episode SummaryEvery role in cybersecurity is changing fast, but most practitioners are still treating AI like a glorified search engine. In this solo episode of Secured, Cole Cornford shares his unfiltered take on three things on his mind right now: entrepreneurship in a tough market, the growing threat to SaaS product businesses from roll your own culture, and why the cyber industry needs a fundamentally different approach to AI.Cole makes the case that saying "hey Claude" is the least effective way to work with AI today, and that the real conversation has nothing to do with which model you pick. It is about how you interact with it, how you build a harness around it, and how you stop letting third party wrappers make all the decisions for you. He also shares early thinking on an AI course he is building for security professionals, covering AI fundamentals, using AI for security, and securing AI products.Along the way he tackles the rule of three as a framework for prioritising in a small business, why product moats are disappearing fast, and what qualities he is actually looking for when hiring graduates in a market where everyone is cutting them.Timestamps00:00 Trailer01:01 Chainguard ad01:28 Intro and today's three topics02:30 Entrepreneurship in a tough market04:30 The rule of three and how Cole runs his business07:00 Why SaaS product moats are disappearing10:00 Roll your own vs buying commercial security tools13:30 When rolling your own actually makes sense16:00 Cash flow warning for Australian business owners18:00 Why Cole is building an AI course for security professionals21:00 Models vs harnesses and why most people get this wrong24:00 How the cyber industry needs to change its approach to AI27:00 What Cole looks for when hiring graduates right now30:00 Systems thinking, humanities and the skills that still matter33:00 Grandma's pot and questioning everything you think you know35:00 Closing thoughts🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.Mentioned in this episode:Call for FeedbackThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

April 29, 202637 min

How Dam Secure Puts Guardrails on AI Generated Code

Episode SummaryVibe coding is here and most organisations are nowhere near ready for what it means for security. In this episode of Secured, Cole Cornford sits down with Patrick Collins and Simon Harloff, founders of Dam Secure, to unpack how AI is reshaping software development and why the old AppSec playbook is not keeping up.They cover the shift from artisanal to factory model engineering, why skills and agents.md files are less reliable than people think, and why the SaaSpocalypse narrative is mostly a distraction from the work that actually matters. Patrick and Simon also walk through how Dam Secure enforces organisational security rules at plan time, before a single line of AI generated code gets written.Timestamps00:00 Trailer01:01 Chainguard ad01:28 Meet Patrick Collins and Simon Harloff from Dam Secure03:00 Why existing AppSec tooling never worked for developers05:30 The artisanal vs factory model of software development08:30 Hacker News, polarisation and the AI sentiment shift11:00 Agile, standups and processes that no longer make sense14:00 Bigger PRs, higher velocity and workflows without an IDE17:00 Skills, agents.md and the limits of deterministic guardrails20:00 The AppSec to developer ratio problem23:00 The SaaSpocalypse and why rebuilding tools is a side quest27:00 React, digital certificates and security through business incentives30:00 How Dam Secure works: secure spec and plan time enforcement34:00 Vibe coders, Lovable and the risk beyond professional developers36:00 Where to find Dam Secure and closing remarks🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

April 16, 202637 min

(Replay Episode) Breaking Barriers: How Sam Fariborz Navigated the Aussie Cybersecurity Landscape

Episode SummaryWhen Sam Fariborz moved to Australia from Iran, she had been working as an IT manager. While she had plenty of experience and strong technical skills, the move to Australia was challenging, and in this episode Sam discusses some of the barriers to entry she faced. By attending cybersecurity events and reaching out to people on LinkedIn, Sam found mentors and peers who helped progress her career, and today Sam is Cybersecurity Services & Program Manager for Kmart group which employs nearly 50,000 people across Australia and New Zealand. Sam chats with Cole Cornford about how to network effectively, the growth of cybersecurity as a profession in the last couple of decades, the need for greater diversity within the industry, and plenty more.🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.Mentioned in this episode:Download your free CVE Reduction AssessmentChainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk.December 2025 - ChainguardThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

April 1, 202633 min

What the ISM AI Update Actually Means for Cyber Teams

Episode SummaryThe ISM has been updated again, and this time AI is front and centre. In this episode of Secured, Cole Cornford is joined by returning guest Toby Amodio, Practice Lead at Fujitsu Cybersecurity Services, for another instalment of Policy Wonks and Gronks, cutting through the vendor noise to talk about what the March 2026 update actually means in practice.They explore where AI is genuinely delivering value for cyber professionals, from automating compliance mapping and vendor assessments to streamlining pen test reporting and SOC triage. But they are equally candid about the risks: the erosion of foundational skills as junior roles get outsourced to AI, the creeping fatigue of reviewing outputs at scale, and the danger of skipping straight to full automation without the expertise to validate what the machine is doing.The conversation also tackles bigger picture concerns unique to Australia, sovereign AI capability, the risk of a brain drain to the US, and whether a small country can afford to decentralise its AI infrastructure. Toby closes with a sharp reminder for government CISOs: AI is just another system, and how people use it matters far more than the certifications attached to it.Timestamps00:00 Episode Trailer01:01 Chainguard ad01:28 Intro and the March 2026 ISM update03:00 AI hype vs real world utility05:00 Governance and compliance use cases08:00 Vendor assessments and knowledge base automation11:00 Skill erosion and the junior roles question14:00 AI in pen testing: reporting, scoping and customer experience17:30 The maturity model for AI adoption21:00 Vibe coding, slop assurance and fatigue at scale25:00 Agents watching agents and the bot vs bot future28:30 Australian AI sovereignty and the brain drain risk32:00 Top tip for government CISOs on AI risk35:00 Shadow AI and DNS log visibility37:00 Closing remarks🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

March 25, 202635 min

(Replay Ep) Leading Change in Cybersecurity: Tara Whitehead’s Approach to Security Engagement

Episode SummaryTara Whitehead is Security Engagement Manager at MYOB. Prior to becoming a cybersecurity specialist, Tara had an eclectic career, including working in advertising and international relations. In this episode Tara chats with Cole about how her non-technical background has in many ways been an asset working in security, leading change management in large enterprises, the importance of great communication skills, and plenty more.Timestamps7:15 - Tara's first days in AppSec10:00 - How to influence people12:30 - Why we should dial back on the doomsday conversation14:10 - Find your change champions21:30 - Is a non-technical background help or hindrance?23:30 - Communication and influencing key skills26:00 - Communicating with execs28:20 - Rapid fire questions🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.Mentioned in this episode:Download your free CVE Reduction AssessmentChainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk.December 2025 - ChainguardThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

March 4, 202618 min

AI in AppSec: Hype, Layoffs and What's Actually Real

Episode SummaryArtificial intelligence is dominating headlines in cybersecurity, but how much of it holds up under scrutiny? In this solo episode of Secured, Cole Cornford, founder and CEO of Galah Cyber, shares his unfiltered take on three of the biggest AI narratives making waves in the AppSec space right now.Cole breaks down the Claude Code security announcement and why the market reaction dramatically overstated its real-world impact, arguing that the most meaningful security vulnerabilities have never been the ones static analysis tools can easily catch. He then examines Aikido's continuous penetration testing proposition, raising serious questions around noise, cost, resilience, and whether most organisations are even architected to support it.Finally, Cole tackles the AI job displacement narrative head-on, making the case that most high-profile tech layoffs are less about AI capability and more about mismanaged businesses using automation as convenient cover for decisions driven by poor performance and investor pressure.Timestamps00:00 – Intro & Cole's hot take on AI hype01:30 – Claude Code Security: what it is and why markets overreacted03:30 – Why meaningful vulnerabilities need context, not static analysis05:30 – Autofix, token waste, and who's actually using Claude Code08:00 – Aikido Infinite: the continuous pen testing promise10:00 – Cost, resilience, and noise concerns with Aikido12:49 – The AI jobs narrative: Cole's verdict14:30 – WiseTech, Block, and the smokescreen theory16:00 – Jobs shift, not job loss17:03 – Closing thoughts and solo format feedback🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardSecured is part of Day One.Day One helps founders and startup operators make better business decisions more often. To learn more, join our newsletter to be notified of new First Cheque episodes and upcoming shows.Mentioned in this episode:Call for FeedbackThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

February 18, 202642 min

How AI Pen Testing Actually Works (and Where It Breaks)

Episode SummaryAI is starting to change penetration testing, but most people are asking the wrong question. In this episode of Secured, Cole Cornford sits down with Brendan Dolan-Gavitt, AI researcher at XBOW and former NYU professor, to unpack what autonomous pen testing really is, what it can reliably do today, and what still needs humans.They explore why AI agents are great at scaling the boring parts of testing, like authenticated workflows and broad vulnerability coverage across huge attack surfaces, and why that does not automatically translate to deep, context-aware exploitation. The conversation also gets into the messy parts: AI systems overclaiming “serious” findings, business logic flaws that are hard to verify, audit expectations, and why scope control needs real guardrails, not vibes. From agent traces and validation models to cost curves and creative exfiltration tricks, this episode is a grounded look at where AI helps AppSec and where it can still cause damage if you trust it too much.Timestamps00:00 – Intro03:10 – From academia to building autonomous security tools05:00 – Human pen testers vs AI agents: what is actually different06:40 – Where AI helps most: boring tasks and low hanging fruit08:30 – Scale: a thousand targets vs hiring a thousand testers10:20 – Accessibility, economics, and Jevons paradox12:30 – Accountability: audit evidence, traces, and “who signs off”14:40 – Scope control: avoiding prod and preventing out-of-scope actions16:20 – Safety checkers, overseer agents, and persuasion resistance18:40 – The cost question: VC money, inference pricing, and efficiency21:20 – When AI wastes money and why prioritisation matters23:50 – Failure mode: overclaiming business “vulnerabilities”26:10 – Validation agents and adversarial peer review28:40 – The scary clever stuff: exfiltrating files as images31:00 – What AI finds well: XSS, SQLi, file traversal, hard proof bugs33:10 – What AI struggles with: business logic and contextual judgement35:20 – Hype vs skepticism and why nobody has a crystal ball🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

February 4, 202634 min

AI, Hiring, and Trust: Why Shortcuts Break Interviews

Episode SummaryHiring is still a human process, no matter how much AI gets injected into it. In this episode of Secured, Cole Cornford sits down with Kim Acosta, Managing Director at UCentric and former Amazon talent acquisition leader, to unpack how AI is actually changing recruitment and where it is quietly breaking trust.They explore how candidates are using AI in applications and technical assessments, why misuse often damages long term employability more than failing an interview, and why recruiters and hiring managers are responding with stricter controls, in person assessments, and AI detection. Kim shares what she is seeing across data, analytics, and AI roles, where demand is growing, and why human judgment, rapport, and credibility still matter far more than perfect answers.The conversation also covers embedded recruitment and RPO models, why soft skills matter more as teams get smaller, and what the next hiring cycle is likely to look like as big tech contracts while smaller companies continue to grow. For candidates, hiring managers, and founders alike, this episode is a grounded look at why shortcuts rarely pay off and why trust is still the real signal.Timestamps00:00 – Intro01:24 – Meet Kim Acosta and UCentric02:06 – From Amazon to starting a recruitment consultancy04:19 – Data engineering demand vs AI hype05:31 – What data engineering roles actually look like07:27 – Adapting business models to real market needs10:04 – Where AI genuinely helps recruiters11:09 – Custom GPTs and interview preparation13:43 – One way interviews and candidate slop15:09 – Technical assessments and AI misuse17:19 – Trust, failure, and reapplying the right way18:29 – Spotting AI generated answers in interviews20:19 – Rapport, eye contact, and human signals22:19 – Hiring for values and team fit23:52 – Agency vs internal vs embedded recruiters27:59 – RPO models and cost tradeoffs28:47 – Layoffs, market shifts, and salary reality30:57 – Where hiring is still strong33:10 – Why hiring and podcasts still need humans🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

January 21, 202633 min

PSPF Changes Explained for Security Leaders

Episode SummaryThe Protective Security Policy Framework is meant to guide how government manages security risk, but constant updates make it harder to implement than to understand. In this episode of Secured, Cole Cornford is joined by Toby Amodio, Practice Lead at Fujitsu Cybersecurity Services and former senior cybersecurity leader across Australian government, to break down what actually changed in the latest PSPF update and why it matters in practice.They examine the growing focus on personnel security and foreign interference risk, the inclusion of AI guidance that adds little beyond basic risk assessment, and the long overdue recognition of Secure Service Edge and SASE as compliant gateways. The conversation also explores why deny lists and centralised risk sharing sound sensible on paper but are far harder to enforce in reality, and why most security failures still come down to behaviour, accountability, and how technology is actually used rather than what policy says.Timestamps00:00 – Intro01:18 – What the PSPF is and why it exists02:49 – Annual updates, directives, and policy advisories04:19 – What actually changed in the 2025 PSPF update05:36 – AI in the PSPF and why it adds little value08:14 – Tool hype vs implementation risk10:32 – The AI policy advisory and trusted vendors14:25 – Directive 3 and clearance disclosure risks17:21 – Personnel security and enforcement reality19:41 – Secure Service Edge and SASE recognition23:39 – Commonwealth Technology Management directive25:28 – Deny lists, transparency, and security through obscurity28:05 – Centralised risk sharing and assessment overload29:52 – Policy wonk or policy gronk31:12 – Final takeaways and closing🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardMentioned in this episode:Download your free CVE Reduction AssessmentChainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk.December 2025 - ChainguardCall for FeedbackThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

January 7, 202634 min

The Architect’s Dilemma: Why Security Design Keeps Failing (and How to Fix It)

Episode SummaryMost security architects are not actually doing architecture. They are doing assurance work, following checklists, and hoping standards will save them. But as systems get more complex and attackers get faster, that approach is no longer good enough.In this episode of Secured, Cole sits down with Ken Fitzpatrick, founder of Patterned Security and creator of securitypatterns.io, a resource built during the lockdown years that has since grown into one of the clearest frameworks for designing meaningful, context-aware security architecture.Ken shares why so many architects fall into the trap of compliance thinking, how security design becomes a tick box exercise, and why threat modeling without understanding context is pointless. They unpack the four foundational steps every architect should follow, why traceability matters more than ever, and how modern teams can stop copying best practice and start solving the real problems in front of them.The conversation also digs into secure by design in different industries, why the term has lost its meaning, and how modern defensible architecture is resetting expectations for what good looks like. Cole and Ken also dive into AI and its impact on the architecture function, separating hype from reality and exploring which roles are at risk as AI improves.If you work in engineering, architecture, AppSec, risk, or are building a product and want a practical way to think about secure design, this is an episode you should not miss.Timestamps00:00 – Intro00:48 – Chainguard Ad01:20 – Meet Ken Fitzpatrick and Patterned Security02:19 – How a cancelled Canada trip sparked securitypatterns.io04:08 – Why architecture needs practical guidance, not more frameworks05:18 – The four step method for real security architecture07:23 – Moving beyond box ticking and why engineering experience matters09:39 – Teaching architecture fundamentals and selecting the right controls11:37 – Traceability and making defensible design decisions13:14 – Architecture vs assurance and who securitypatterns.io is for16:31 – Embedding secure by design into PMO processes and scale up use cases19:58 – What secure by design means across different industries23:05 – Inconsistent definitions in security and the need for clarity23:50 – Modern defensible architecture and Zero Trust guidance24:44 – AI’s role in architecture and which tasks get replaced28:25 – AI in AppSec and reducing false positives with context30:24 – AI sales bots, hype cycles, and the loss of human reciprocity33:28 – Ken’s call for collaboration on repeatable architecture patterns34:28 – Closing and how to connect with Galah Cyber🐙 Secured is grateful to be sponsored and supported by Chainguard.Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Assessment at https://dayone.fm/chainguardMentioned in this episode:Chainguard is the trusted source for open source.Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Report now!December 2025 - ChainguardThis podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrpSpotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

Is this your show?

Claim this listing to keep it up to date, reach guests who want to pitch you, and manage bookings with Guestify.

Claim this listing

More Technology podcasts

SowGrow Marketing Council

sgmc

BusinessMarketing

Toldjya Finance Podcast

Zac Huish, Cameron Cooke, and Paul Lamb

BusinessInvesting