Guest:

• Daniel Fabian, Principal Digital Arsonist, Google

Topic:

• Your RSA talk highlights lessons learned from two years of AI red teaming at Google. Could you share one or two of the most surprising or counterintuitive findings you encountered during this process?
• What are some of the key differences or unique challenges you've observed when testing AI-powered applications compared to traditional software systems?
• Can you provide an example of a specific TTP that has proven effective against AI systems and discuss the implications for security teams looking to detect it?
• What practical advice would you give to organizations that are starting to incorporate AI red teaming into their security development lifecycle?
• What are some initial steps or resources you would recommend they explore to deepen their understanding of this evolving field?

Resources:

• Video (LinkedIn, YouTube)
• Google's AI Red Team: the ethical hackers making AI safer
• EP217 Red Teaming AI: Uncovering Surprises, Facing New Threats, and the Same Old Mistakes?
• EP150 Taming the AI Beast: Threat Modeling for Modern AI Systems with Gary McGraw
• EP198 GenAI Security: Unseen Attack Surfaces & AI Pentesting Lessons
• Lessons from AI Red Teaming – And How to Apply Them Proactively [RSA 2025]

Guest:

• Alex Pinto, Associate Director of Threat Intelligence, Verizon Business, Lead the Verizon Data Breach Report

Topics:

• How would you define “a cloud breach”? Is that a real (and different) thing?
• Are cloud breaches just a result of leaked keys and creds?
• If customers are responsible for 99% of cloud security problems, is cloud breach really about a customer being breached?
• Are misconfigurations really responsible for so many cloud security breaches? How are we still failing at configuration?
• What parts of DBIR are not total “groundhog day”?
• Something about vuln exploitation vs credential abuse in today’s breaches–what’s driving the shifts we’re seeing? DBIR
• Are we at peak ransomware? Will ransomware be here in 20 years? Will we be here in 20 years talking about it?
• How is AI changing the breach report, other than putting in hilarious footnotes about how the report is for humans to read and and is written by actual humans?

Resources:

• Video (LinkedIn, YouTube)
• Verizon DBIR 2025
• EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends
• EP205 Cybersecurity Forecast 2025: Beyond the Hype and into the Reality
• EP112 Threat Horizons - How Google Does Threat Intelligence
• EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025

Guest

• Alan Braithwaite, Co-founder and CTO @ RunReveal

Topics:

• SIEM is hard, and many vendors have discovered this over the years. You need to get storage, security and integration complexity just right. You also need to be better than incumbents. How would you approach this now?
• Decoupled SIEM vs SIEM/EDR/XDR combo. These point in the opposite directions, which side do you think will win?
• In a world where data volumes are exploding, especially in cloud environments, you're building a SIEM with ClickHouse as its backend, focusing on both parsed and raw logs. What's the core advantage of this approach, and how does it address the limitations of traditional SIEMs in handling scale?
• Cribl, Bindplane and “security pipeline vendors” are all the rage. Won’t it be logical to just include this into a modern SIEM?
• You're envisioning a 'Pipeline QL' that compiles to SQL, enabling 'detection in SQL.' This sounds like a significant shift, and perhaps not to the better? (Anton is horrified, for once) How does this approach affect detection engineering?
• With Sigma HQ support out-of-the-box, and the ability to convert SPL to Sigma, you're clearly aiming for interoperability. How crucial is this approach in your vision, and how do you see it benefiting the security community?
• What is SIEM in 2025 and beyond? What’s the endgame for security telemetry data? Is this truly SIEM 3.0, 4.0 or whatever-oh?

Resources:

• EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
• EP123 The Good, the Bad, and the Epic of Threat Detection at Scale with Panther
• EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures
• “20 Years of SIEM: Celebrating My Dubious Anniversary” blog
• “RSA 2025: AI’s Promise vs. Security’s Past — A Reality Check” blog
• tl;dr security newsletter
• Introducing a RunReveal Model Context Protocol Server!
• MCP: Building Your SecOps AI Ecosystem
• AI Runbooks for Google SecOps: Security Operations with Model Context Protocol