Advertise on podcast: Security Intelligence Podcast

Visit Security Intelligence podcast page to get more AI content → https://www.ibm.com/think/podcasts/security-intelligence That melted ice cream might not be the freezer’s fault. On episode 56 of Security Intelligence, Claire Nunez and MJ Vaidya join host Patrick Austin to break down three cybersecurity stories and what they mean for defenders. First, attackers hijack refrigeration controllers from Danfoss, Copeland and Dixell at French supermarkets, pushing cases to 50°C. Team82 flagged the flaws and Danfoss shipped a fix, yet thousands of controllers remain exposed online. Is planned downtime the price of staying patched? Then, a Semperis survey of 1,200 IT professionals links AI to 84% of ransomware attacks. Many of those attacks abuse companies’ own AI agents and identity systems. Should your agents be part of your insider threat model? Finally, Bank of America brings on 1,000 contractors to patch vulnerabilities found by Anthropic’s Mythos and other AI security models. The panel debates whether AI can fix what it finds, and why patching can’t be a one-time push. All that and more on Security Intelligence. 00:00 – Intro 01:00 – Hackers hijack supermarket fridges 10:11 – AI linked to 84% of ransomware attacks 19:31 – Bank of America hires 1,000 patchers "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more AI content → https://www.ibm.com/think/podcasts/security-intelligence What happens when AI agents start hacking websites without permission? On episode 55 of Security Intelligence, Sophie Cunningham, Ian Molloy and Seth Glasgow join host Patrick Austin to break down three cybersecurity stories and what they mean for defenders. First, Google pauses part of its open-source bug bounty program amid a flood of automated reports. Meanwhile, its own PageBreak AI agent is finding hundreds of vulnerabilities. Could AI ultimately save the bug bounty programs its overwhelming? Then, ClingSTUN malware exploits unpatched IoT devices and hides behind legitimate network traffic. The attack highlights a persistent security challenge: finding vulnerabilities is getting faster, but patching them isn't. Finally, OpenAI agents attempt to hack Wikimedia services, potentially contributing to a partial outage. The panel debates who should be held accountable when agents cross security boundaries. All that and more on Security Intelligence. 00:00 – Intro 01:38 – Google's AI bug bounty problem 13:32 – ClingSTUN Linux malware 21:34 – OpenAI agents target Wikipedia "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more AI content → https://www.ibm.com/think/podcasts/security-intelligence That ChatGPT ad might not be from OpenAI. On episode 54 of Security Intelligence, Michelle Alvarez, Giacomo Casoni and Norman Dorsch join our new host Patrick Austin for imposter week: three stories about attackers posing as something you trust. First, attackers bought sponsored search ads that led to a fake “Plus 5.6” Custom GPT, which steered at least 40 victims toward a ClickFix page and a remote access trojan. The panel digs into why ClickFix keeps working, and whether AI companies should police their GPT marketplaces the way app stores do. Then: Rapid7 found Linux backdoors, including a new BPFDoor variant and a RAT called AVERAT, hiding on the appliances that screen companies’ email. From there, attackers can see an organization's mail traffic, and their own traffic blends right in. How do you catch an imposter that looks exactly like your security tools? Finally, suspected state-linked hackers exploit two critical flaws in Citrix NetScaler, hitting dozens of organizations across government, healthcare and critical infrastructure. Some Dutch hospitals took patient portals offline. And patching won’t evict attackers who got in first, which makes a tested playbook essential. All that and more In Security Intelligence. 00:00 – Intro 1:35 – Fake GPTs as malware lures 7:37 – Backdoors disguised as email 13:51 – Inside the NetScaler attacks "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more cybersecurity content → https://www.ibm.com/think/podcasts/security-intelligence Ask a chatbot for a customer service number, and you might get a scammer's. That's the trick behind "Dark Sourcery," a campaign that games AI answer engines into citing phishing links and fake support lines. It's SEO poisoning updated for an AEO world, and it works because so few of us verify what AI tells us before charging ahead. On episode 53 of Security Intelligence, Kimmie Farrington, Curtis Pitts and Dave McGinnis join hosts Matt Kosinski and Patrick Austin to break down three AI-enabled cyberattacks and what they mean for defenders. First, the poisoned chatbots: How does Dark Sourcery work, and how do we rethink trust in the AI era? Then, a threat actor spends months tearing through Ubiquiti, WordPress and Zyxel gear, stealing thousands of government documents. GreyNoise suspects it had an LLM helping write its tools. Finally, an AI agent swarm breaches hundreds of PaperCut servers. It goes from an empty workspace to a real victim in about four hours, and then ignores its own rules of engagement. All that and more on Security Intelligence. 00:00 - Intro 1:23 - Dark Sourcery 13:00 - LLM-assisted hacking spree 21:46 - Agent swarm attack "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more cybersecurity content → https://www.ibm.com/think/podcasts/security-intelligence People like to say “cybersecurity is a team sport.” But how often do we actually live up to that ideal? In this bonus episode of Security Intelligence, host Matt Kosinski talks to Joe Xatruch about the Cyber Cluster, a public-private-academic alliance that’s turning Costa Rica into a global hub for cybersecurity talent and services. Joe shares what inspired the cluster, the obstacles they had to tackle to get it off the ground and the benefits it’s brought to people and organizations across the country. Plus—why the model is spreading, and why that’s great news. This is what a collaborative approach to cybersecurity really looks like. And it turns out it’s even better than the hype. All that and more on Security Intelligence. "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more security content → https://www.ibm.com/think/podcasts/security-intelligence Last week, some of the biggest names in AI coalesced around the need to pace development and strengthen security measures. Problem is, many of the biggest names in cybersecurity feel like they haven’t been invited to that conversation. On episode 52 of Security Intelligence, Jeff Crume, Nikki Robinson and Omari Jones join hosts Matt Kosinski and Patrick Austin to talk about the rising tensions between frontier labs and cybersecurity pros. The former seem to be approaching AI safety as primarily an issue of alignment, while the latter thinks a few good old-fashioned security controls could go a long, long way. Then: Just as the frontier labs are locking their models down, their open-weight counterparts are letting people pull off sophisticated hacks—like hijacking TikTok users’ cameras—with relative ease. Should open models play a bigger role in our security conversations? Finally, CISA and the FBI are sick and tired of all the spin, and their latest advisory calls on breach victims to be much more transparent about incidents. We explore what good crisis communications look like and how we get more organizations on board. All that and more on Security Intelligence 00:00 - Intro 1:30 - The AI cybersecurity shutout 13:53 - Open models hack TikTok 25:45 - CISA’s crisis comms advisory "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more cybersecurity content → https://www.ibm.com/think/podcasts/security-intelligence Depending on who you ask, the AI-driven vulnpocalypse is either the end of cybersecurity as we know it or a lot of hot air. This week on Security Intelligence, host Patrick Austin sits down with Giacomo Casoni, Brad Lair and Norman Dorsch to dig into a new report suggesting the AI vulnerability surge might be more manageable than feared—as long as organizations shift their focus from patching to validation. Then: Researchers caught AI agents secretly turning public wikis into makeshift message boards, apparently coordinating with each other to get around their own restrictions. How can we trust them with critical cybersecurity workflows? Plus, the ShinyHunters gang proves that old-school vishing can still beat multifactor authentication, no AI required. Finally, Shweta Jain, Head of Promontory at IBM Consulting, joins the show to talk about her new piece with Stephen Coraggio on why quantum computing and AI-powered threats are forcing banks to rethink cyber resilience. Read the article: https://www.ibm.com/think/insights/next-cyber-crisis-is-already-taking-shape All that and more, on Security Intelligence. 00:00 - Intro 1:36 - Rethinking the vulnpocalypse 6:20 - AI agents’ secret message boards 13:28 - ShinyHunters go vishing 19:31 - What is cyber resilience, really? "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Visit Security Intelligence podcast page to get more cybersecurity content → https://www.ibm.com/think/podcasts/security-intelligence Why bother giving your AI agents rules if they’re just gonna reason around them? On episode 50 of Security Intelligence, Dustin “EvilMog” Heywood, Seth Glasgow and Nick Bradley join host Matt Kosinski to discuss why AI agents go off-script and whether we can stop them. Drawing on the HuggingFace hack and an op-ed from Dark Reading, we explore what ethics looks like for a piece of software that has no concept of right and wrong. Is there a way to balance the utility of probabilistic AI with the security of deterministic controls? Then: The OWASP Top 10 for agentic skills is here, and the list is full of some very basic security hygiene failures. We ask: Why are agentic skills hubs so bad at cybersecurity? Plus: As AI makes it easier than ever to find vulnerabilities and generate bug reports, bug bounty programs are struggling to keep up. Will AI slop spell the end of independent bug research? Finally, Itzhak Chimino stops by to show off ThreatXtension, a tool he helped create to detect malicious browser extensions. All that and more on Security Intelligence. Segments: 00:00 - Intro 1:26 - Can we really control AI agents? 11:49 - OWASP’s Top 10 for agentic skills 20:37 - AI breaks bug bounties 28:47 - ThreatXtension "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

IBM, OpenAI and 100 other organizations released an open letter calling for collective action on cyber defense. On episode 49 of Security Intelligence, Michelle Alvarez, Nick Bradley and J.R. Rao join host Matt Kosinski to explore what a “global cyber defense surge” could—and should—look like. And speaking of collective action on cyber defense: The SANS Institute named the winners of its Find Evil! hackathon last week. The five autonomous incident response agents are now available on the SIFT Workstation. We discuss the results and what the hackathon’s success means for the future of autonomous agents in cybersecurity. Finally: Flare unmasked a couple of the alleged leaders of the notorious hacking gang TeamPCP. We look at how they did it, and what the rest of us can learn from it. 00:00 - INTRO 1:19 - OpenAI’s open letter 12:22 - Find Evil! winners 22:03 - TeamPCP takedown All that and more on Security Intelligence. "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

You all know the famous Crocodile Dundee scene, right? “That’s not a knife—this is a knife!” According to Dimple Ahluwalia, IBM Consulting’s Global Offering Lead for CyberDefend, that’s basically the cybersecurity situation today. Except we’re the guys with the switchblades getting clowned on. On this bonus episode of Security Intelligence, Dimple helps me understand one of the most concerning bits to surface in IBM’s 2026 Cost of a Data Breach Report: AI-generated attacks are up 56%, while 64% of organizations report limited or no use of AI tools in security. We discuss why the gap exists, how attackers use AI as both a tool and a target and why the key to bringing more AI into security is to stop thinking about AI. Read the Cost of a Data Breach report: https://www.ibm.com/reports/data-breach Watch the webinar: https://ibm.webcasts.com/starthere.jsp?ei=1769682&tp_key=2abad1a7b6&sti=web "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

GLM-5.3 is, by some measures, better than GPT Sol and Anthropic’s Mythos at vulnerability discovery and validation. On episode 48 of Security Intelligence, Erblind Morina, Kimmie Farrington and Patrick Fussell join host Matt Kosinski to debate whether this is really cool or really scary, or maybe a little of both. Then: Tracebit researchers have developed a way to use prompt injections as a defensive measure. Called “context bombing,” the technique plants malicious prompts alongside the very assets that attacking AI agents are likely to target. Finally, Huntress reports on a rash of social engineering attacks on Black Hat conference attendees. They’re not terribly sophisticated, but any concentrated offensive against the cybersecurity community is worth paying attention to. You never know who might be on the other side of those phishing emails. Segments: 00:00 - Intro 1:14 - GLM-5.3 11:46 - Context bombing 19:12 - Black Hat conference attacks "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Cybersecurity leaders are flush with cash—earmarked for AI, mind you—and eager to spend it. What they don’t have is a plan for how. This week on Security Intelligence, Claire Nuñez, Curtis Pitts and Dave Bales join host Matt Kosinski to talk about why so many security teams are experience AI decision fatigue—and what to do about it. Then, we discuss Tenet Security’s DEFCON presentation on ghostjacking, a new method for sneaking malicious prompts into some of our most trusted data sources (logs, alerts, error reports). Because regular prompt injections are just too vanilla. Oh, and speaking of how to deploy AI in cybersecurity: Research from 1Password shows LLMs are a lot better at exploiting vulnerabilities than patching them. What does that mean for defenders? Find out all this—and more—on Security Intelligence. 00:00 - Introduction 1:04 - Cybersecurity’s AI paralysis 10:45 - Ghostjacking 20:53 - Is AI bad at patching? Agentic AI identity management with IBM: https://www.ibm.com/solutions/agentic-ai-identity-management "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

What’s the biggest, baddest, most unruly problem in AI security? Turns out that depends on whether you’re asking practitioners or looking at incident data. In this episode of IBM Security Intelligence, we break down the OWASP LLM Top 10 for 2026, which took the unusual step of using both community votes and incident databases to inform its rankings. There are some interesting gaps—the data says misinformation is a bigger deal than the pros think, while prompt injections happen less than the headlines might have you believe. But it’s not as simple as “numbers don’t lie and the experts are wrong.” Then, CISA's 2026 SBOM guidance asks for even more data, but does that actually mean less risk? And our panelists share highlights from Black Hat, including new details on how attackers can use misinformation to hijack agentic browsers. All that and more on Security Intelligence. 00:00 - Intro 1:26 - OWASP LLM Top 10 12:55 - CISA’s SBOM guidance 20:05 - Black Hat 2026 highlights "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

Last week, OpenAI’s models broke out of their sandboxes to cause chaos. This week, it’s Anthropic’s turn. On this episode of Security Intelligence, Diego Matos Martins, Kimmie Farrington and Jeff Crume join host Matt Kosinski to discuss the results of Anthropic’s internal review of testing procedures following the Hugging Face incident last month. Anthropic uncovered three instances of Claude models escaping containment and hacking real companies during what were supposed to be simulations. Granted, that’s three incidents out of 141,000 reviewed tests, which raises the question: Just how big a deal is this really? Then, we talk about research from Zenity into PleaseFix, a class of vulnerabilities that affects every agentic browser on the market. Zenity’s take: In the rush toward agentic functionality, these tools stripped away decades’ worth of browser security fundamentals. Finally, a so-called “security researcher” has a public GitHub repo of 200+ zero-day exploits. They say it’s to encourage more interest in cybersecurity. Yeah. Okay. Sure. All that and more on Security Intelligence. 00:00 - Intro 1:12 - Claude breaks containment 13:13 - Agentic browsers: security nightmares 21:56 - The Exploitarium Listen to the latest bonus episode: Your data breach plan is missing something major: people. https://www.ibm.com/think/podcasts/security-intelligence/data-breach-plan-people "The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

When a cyberattack hits, your security team knows exactly what to do. What about everyone else? In this episode of Security Intelligence, Limor Kessem, X-Force Cyber Crisis Management Global Lead, explores the side of breach response that most organizations forget: the human side. From employees posting ransom notes on Facebook to well-meaning staffers accidentally paying ransoms to sanctioned entities, the biggest threats to your crisis response often come from inside the building. Kessem makes the case for expansive, cross-functional incident response playbooks that arm everyone from HR to the C-suite with exactly what they need to do, hour by hour, when things go sideways. She also digs into crisis leadership, emotional management and the overlooked logistics—like who feeds your team during a 48-hour response sprint—that can make the difference between succumbing to the crisis or coming out on top. The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. Follow the Security Intelligence podcast on your preferred platform: https://www.ibm.com/think/podcasts/security-intelligence