Cloud Security Podcast by Google

• Sivanesh Ashok, bug bounty hunter
• Sreeram KL, bug bounty hunter

Topics:

• We hear from the Cloud VRP team that you write excellent bugbounty reports - is there any advice you'd give to other researchers when they write reports?
• You are one of Cloud VRP's top researchers and won the MVH (most valuable hacker) award at their event in June - what do you think makes you so successful at finding issues?
• What is a Bugswat?
• What do you find most enjoyable and least enjoyable about the VRP?
• What is the single best piece of advice you'd give an aspiring cloud bug hunter today?

Resources:

• EP220 Big Rewards for Cloud Security: Exploring the Google VRP
• Cloud Vulnerability Reward Program Rules
• Insights from BugSWAT
• Google Cloud's Vulnerability Reward Program
• Critical Thinking Podcast

• Alexander Pabst, Deputy Group CISO, Allianz
• Lars Koenig, Global Head of D&R, Allianz

Topics:

• Moving from traditional SIEM to an agentic SOC model, especially in a heavily regulated insurer, is a massive undertaking. What did the collaboration model with your vendor look like?
• Agentic AI introduces a new layer of risk - that of unconstrained or unintended autonomous action. In the context of Allianz, how did you establish the governance framework for the SOC alert triage agents?
• Where did you draw the line between fully automated action and the mandatory "human-in-the-loop" for investigation or response?
• Agentic triage is only as good as the data it analyzes. From your perspective, what were the biggest challenges - and wins - in ensuring the data fidelity, freshness, and completeness in your SIEM to fuel reliable agent decisions?
• We've been talking about SOC automation for years, but this agentic wave feels different. As a deputy CISO, what was your primary, non-negotiable goal for the agent? Was it purely Mean Time to Respond (MTTR) reduction, or was the bigger strategic prize to fundamentally re-skill and uplevel your Tier 2/3 analysts by removing the low-value alert noise?
• As you built this out, were there any surprises along the way that left you shaking your head or laughing at the unexpected AI behaviors?
• We felt a major lack of proof - Anton kept asking for pudding - that any of the agentic SOC vendors we saw at RSA had actually achieved anything beyond hype! When it comes to your org, how are you measuring agent success? What are the key metrics you are using right now?

Resources:

• EP238 Google Lessons for Using AI Agents for Securing Our Enterprise
• EP242 The AI SOC: Is This The Automation We've Been Waiting For?
• EP249 Data First: What Really Makes Your SOC 'AI Ready'?
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• "Simple to Ask: Is Your SOC AI Ready? Not Simple to Answer!" blog
• "How Google Does It: Building AI agents for cybersecurity and defense" blog
• Company annual report to look for risk
• "How to Win Friends and Influence People" by Dale Carnegie
• "Will It Make the Boat Go Faster?" book

• Ari Herbert-Voss, CEO at RunSybil

Topics:

• The market already has Breach and Attack Simulation (BAS), for testing known TTPs. You're calling this 'AI-powered' red teaming. Is this just a fancy LLM stringing together known attacks, or is there a genuine agent here that can discover a truly novel attack path that a human hasn't scripted for it?
• Let's talk about the 'so what?' problem. Pentest reports are famous for becoming shelf-ware. How do you turn a complex AI finding into an actionable ticket for a developer, and more importantly, how do you help a CISO decide which of the thousand 'criticals' to actually fix first?
• You're asking customers to unleash a 'hacker AI' in their production environment. That's terrifying. What are the 'do no harm' guardrails? How do you guarantee your AI won't accidentally rm -rf a critical server or cause a denial of service while it's 'exploring'?
• You mentioned the AI is particularly good at finding authentication bugs. Why that specific category? What's the secret sauce there, and what's the reaction from customers when you show them those types of flaws?
• Is this AI meant to replace a human red teamer, or make them better? Does it automate the boring stuff so experts can focus on creative business logic attacks, or is the ultimate goal to automate the entire red team function away?
• So, is this just about finding holes, or are you closing the loop for the blue team? Can the attack paths your AI finds be automatically translated into high-fidelity detection rules? Is the end goal a continuous purple team engine that's constantly training our defenses?
• Also, what about fixing? What makes your findings more fixable?
• What will happen to red team testing in 2-3 years if this technology gets better?

Resource:

• Kim Zetter Zero Day blog
• EP230 AI Red Teaming: Surprises, Strategies, and Lessons from Google
• EP217 Red Teaming AI: Uncovering Surprises, Facing New Threats, and the Same Old Mistakes?
• EP68 How We Attack AI? Learn More at Our RSA Panel!
• EP71 Attacking Google to Defend Google: How Google Does Red Team

• Balazs Scheidler, CEO at Axoflow, original founder of syslog-ng

Topics:

• Are we really coming to "access to security data" and away from "centralizing the data"?
• How to detect without the same storage for all logs?
• Is data pipeline a part of SIEM or is it standalone? Will this just collapse into SIEM soon?
• Tell us about the issues with log pipelines in the past?
• What about enrichment? Why do it in a pipeline, and not in a SIEM?
• We are unable to share enough practices between security teams. How are we fixing it? Is pipelines part of the answer?
• Do you have a piece of advice for people who want to do more than save on their SIEM costs?

Resources:

• EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
• EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures
• EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines
• Axoflow podcast and Anton on it
• "Decoupled SIEM: Where I Think We Are Now?" blog
• "Decoupled SIEM: Brilliant or Stupid?" blog
• "Output-driven SIEM — 13 years later" blog

• Monzy Merza, co-founder and CEO at Crogl

Topics:

• We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from achieving it today?
• You've also raised a metaphor of AI in the SOC as a "Dr. Jekyll and Mr. Hyde" situation. Could you walk us through what you see as the "Jekyll"—the noble, beneficial promise of AI—and what are the factors that can turn it into the dangerous "Mr. Hyde"?
• Let's drill down into the heart of the "Mr. Hyde" problem: the data. Many believe that AI can fix a team's messy data, but you've noted that "it's all about the data, duh." What's the story?
• "AI ready SOC" - What is the foundational work a SOC needs to do to ensure their data is AI-ready, and what happens when they skip this step?
• And is there anything we can do to use AI to help with this foundational problem?
• How do we measure progress towards AI SOC? What gets better at what time? How would we know?
• What SOC metrics will show improvement? Will anything get worse?

Resources:

• EP242 The AI SOC: Is This The Automation We've Been Waiting For?
• EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC
• EP227 AI-Native MDR: Betting on the Future of Security Operations?
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP238 Google Lessons for Using AI Agents for Securing Our Enterprise
• "Simple to Ask: Is Your SOC AI Ready? Not Simple to Answer!" blog
• Nassim Taleb "Antifragile" book
• "AI Superpowers" book
• "Attention Is All You Need" paper