Topic
14 facts from 1 episode, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
Undated
Sridhar Boddula says that in more than twenty years in technology he has seen security shift from perimeter security to cloud and from individual hackers to organized ransomware.
“So in more than twenty years in technology, especially in cybersecurity, I've seen major transitions, you know, from perimeter security to cloud, from individual hackers to organized ransomware.”
Undated
Boddula says attackers' goals of money, data and access are unchanged, but the expertise and cost needed to pursue them have fallen significantly.
“Attackers still want, you know, money, uh, they want data, and they want to gain access, but the expertise and cost required to pursue those goals have fallen significantly.”
Undated
Boddula says AI tools allow a low-skilled actor to create a convincing phishing campaign, clone an executive's voice and generate exploit code.
“So, a low-skilled actor can create a convincing phishing campaign, you know, clone an executive voice, and generate expiry code.”
Undated
Boddula says a single attacker can now test the same technique against hundreds of organizations at almost no extra cost.
“One actor can now test the same technique against hundreds of organizations at almost no additional cost.”
Undated
Boddula lists cloud-native protection, software supply chain security and identity controls for AI agents that hold credentials as areas where tooling matters.
“especially as teams evolved and they evaluate, evaluate cloud native protection, the software supply chain security and identity controls for A A I agents that can hold credentials and act on production systems.”
Undated
Boddula says annual or semi-annual penetration testing made sense when threats evolved more slowly but is now inadequate.
“annual or semi annual pen testing or their exercises made sense when threats evolved more slowly.”
Undated
Boddula gives as an example scenario a synthetic voice used to influence a help desk, followed by compromise of a dormant service account and escalation through an identity provider.
“For example, like, you know, synthetic voice used to influence a help desk, followed by compromise of a dormant service account and escalation through an identity provider.”
Undated
Boddula says security engineers should work inside DevOps or DevSecOps pipelines, expressing policy as code and building automated guardrails.
“security engineers working, you know, alongside or inside the DevOps or DevSecOps pipelines, you know, expressing policy as code and building automated guardrails”
Undated
Boddula argues that adding analysts when attackers automate does not help because the analysts still work manually and mostly generate more alerts.
“When attackers automate, adding, you know, additional analysts, it's not gonna help, you know, because those people, they will still do the manual process and all they do is just, they just simply generate more alerts.”
Undated
Boddula says an e-commerce company should treat systems involved in point of sale or e-commerce as its most critical assets when ranking vulnerabilities.
“Let's say, you know, if you're a e commerce site, any systems that involved in your, uh, point of sales or e commerce, those systems are critical.”
Undated
Boddula lists dormant service accounts, over-permissioned roles, unmanaged API keys, standing admin access and third-party integrations as common hidden identity risks.
“dormant service accounts, you know, over permissioned roles, unmanaged A P I keys, you know, having a, you know, the long long lasting or standing admin access and third party integrations and the contract access.”
Undated
Boddula states that a basic cybersecurity principle is that you cannot protect assets you do not know you have, so organizations need a full inventory.
“one of the basic principle in the cybersecurity is if you don't know what you have, you cannot protect.”
Undated
Boddula recommends that leaders choose one system holding their most sensitive or regulated data and run a focused test on it immediately.
“choose at least, you know, one system that holds your most sensitive or regulated data and run a focused test on that one and see what are those findings.”
Undated
Boddula says boards are unlikely to approve a $10 million request for AI-era security, so teams must work within limited budgets by empowering staff with automation.
“You are bored, they're not gonna approve, like, you know, 10 million to you.”
Episodes