Cloud Security Podcast by Google

エピソード

• 
  EP291 Ruthless Prioritization: How CISOs Can Execute a Minimum Viable Security Program 18.08.2026 35分

  Guest: Mike Armistead,  CEO, Pulse Security AI Dan Lamorena, Chief Go-To-Market Officer,  Pulse Security AI Topics:  You've described Pulse as an 'operational management platform for cybersecurity leaders.' What does a security management platform look like in practice?  How does Pulse bridge this 'translation layer' gap? How do you help a CISO transition from presenting patch rates and MTTD to discussing liability exposure and business capital allocation? What actually gets better when someone works with Pulse? Other than, of course, your ARR numbers for your next funding round? What is the single most surprising or alarming disconnect you've identified in your CISO and Board Engagement Survey?  You've introduced the concept of the 'Minimum Viable Security Program (MV(S)P)' and emphasized that 'focus is power.' In an era of non-stop vendor noise, compliance updates, and emerging AI threats, how does Pulse help a CISO ruthlessly prioritize and execute their MV(S)P without getting distracted by the noise? Your company is officially 'Pulse Security AI,' so AI is central to your brand. To put on our healthy skeptic hats: how does Pulse pragmatically leverage AI to solve the CISO's actual day-to-day program management problems, rather than just adding to the marketing noise? Resources: Video EP114 Minimal Viable Secure Product (MVSP) - Is That a Thing? EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators "The Bomber Mafia: A Dream, a Temptation, and the Longest Night of the Second World War" by Malcolm Gladwell 
• 
  EP290 Project Atlas: Wiz's AI Vulnerability Research 10.08.2026 30分

  ZeroDay Cloud: How a hacking competition exposed the reality of AI-augmented offensive security. The Power of Multi-Agent AI: Why a single model is not enough, and how specialized agents (Threat Modeling, Hunting, Triage, and Adversarial Debate) collaborate like a human team. GitHub RCE & CosmosDB Cross Tenant Access: A breakdown of the record-breaking bounty for the GitHub RCE report and the Azure CosmosDB master key vulnerability discovered by Atlas. Humans vs. AI: Whether vulnerability researchers are becoming "buggy whip manufacturers" or if human insight, instinct, and the smell of danger remain irreplaceable.   https://www.wiz.io/blog/atlas-ai-vulnerability-researcher
• 
  EP289 Software Engineering vs. Software Craft: How Google Scalably Eliminates Classes of Vulnerabilities 03.08.2026 33分

  How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? In this episode, hosts Timothy Peacock and Anton Chuvakin sit down with Christoph Kern, Principal Security Engineer at Google, to look under the hood of "secure-by-design." They trace Google's 15-year engineering journey to fundamentally eliminate entire classes of vulnerabilities rather than just playing whack-a-mole with bugs after they are written. 🛠️ Software Engineering vs. Software Craft: Why Google ditched "be careful" programming checklists in favor of hard compiler and framework-level invariants that make security defects physically impossible to build. 📦 Hiding the Risky Abstractions: How replacing high-risk programming constructs (like raw pointers in C++ or raw injection sinks in browser code) with safe, compiler-enforced abstractions secures codebases at a scale humans can no longer manually audit. 📢 "Marketing Didn't Write It": Christoph and the hosts unpack why the concept of "eliminating a class of vulnerabilities" is a rigorous, mathematical reality at Google rather than just public relations hype. 🤝 Empathy vs. Opinionated Platforms: The secret feedback loop Google uses to build highly opinionated developer platforms (like Boq or browser-native safe types) that protect systems without turning developers into frustrated "software artists" fighting the compiler. 📈 The Android Productivity Proof: The real-world metrics from Google's Android team proving that shifting to memory-safe languages (like Rust) dramatically drops vulnerabilities while actually boosting developer velocity and lowering rollback rates
• 
  EP288 CISO Tested, Board Approved: Cloud Resilience with General Mills CISO Noah Korba 27.07.2026 25分

  How do you make sure your favorite cereal is always on the shelves when a cyber disaster strikes? In this episode, hosts Tim Peacock and Alicja Cade sit down with Noah Korba, VP of Digital Core, Cybersecurity, and Enterprise Architecture at General Mills, to look under the hood of "Mills Collaborative Recovery"—their intensive, annual two-week drill that actually recovers 90% of their Google Cloud estate to test real-world cyber resilience. ⌨️ "Clicking and Clacking" vs. Talking: Why General Mills ditched traditional tabletop discussions to actually run hands-on, keyboard-driven recoveries of their entire cloud infrastructure. 🥣 Protecting the Cinnamon Toast Crunch: How the team mapped out their "Minimum Viable Business" to keep critical supply chain and manufacturing operations moving. 🔑 The IT vs. OT Reality: The unique challenge of recovering factory equipment, where software updates won't work without a physical key turned on the warehouse floor. 💼 To Board or Not to Board: Noah's take on whether involving the board of directors in active cyber exercises is a valuable use of their time.
• 
  EP287: Creating Trust at Global Scale with Local AI: Reken-ing with Shuman Ghosemajumder 20.07.2026 38分

  Cloud Security Podcast Episode 285: Defending Against the AI DDoS Is internet trust fundamentally broken? On this episode, former Google "Click Fraud Czar" and Reken CEO Shuman Ghosemajumder joins hosts Tim Peacock and Nolan Karpinski to trace the evolution of automated fraud—from Gmail's early invite days to the origin of "credential stuffing." Discover why today's threat landscape feels like an AI DDoS, how cybercriminals exploit the "Smart Cow" resource model, and why running security models on-device is our best shot at defending against scaled AI slop without sacrificing data privacy. What you'll learn: 🧠 The "Smart Cow" Problem: How advanced exploit tools are built by the few and commoditized for the masses. 💻 On-Device Defense: Why local, lightweight AI models are the future of communications security. 🛡️ The Paranoia Protocol: Tim and Shuman's practical advice on validating identities in the age of deepfakes. 👉 Subscribe for your weekly dose of cloud security insights, piping hot every Monday! Watch the full episode on YouTube at youtube.com/@CloudSecPodcast.
• 
  EP286 Building an AI-pilled, solo vibe-coded, Clickhouse-based SIEM with Dan Lussier 13.07.2026 27分

  Can you build a fully functional, high-scale SIEM in just two weeks for under $7,000? In this episode of the Cloud Security Podcast, hosts Tim Peacock and Kyle Champlin sit down with long-time collaborator Dan Lucier, Founder of Nano, to unpack how he "vibe-coded" an entire SIEM from scratch during his end-of-year holiday break. Dan shares his journey of leveraging bleeding-edge AI code assistants to go from a Postgres prototype to a blazing-fast, production-ready SIEM built on Rust and ClickHouse. In this episode, we cover: 🛠️ The $7,000 Stack: How Dan utilized Claude Code and Kubernetes to build a lean platform running on 2 vCPUs and 4GB RAM while ingesting 10–20 GB of data daily. ⚡ Why ClickHouse? The database architectural decisions behind maintaining sub-second search speeds at massive scale. 🤖 AI-Pilled but Cautious: Why Dan takes a surprisingly conservative approach to AI case closure and triage (and how it compares to Google's Triage and Investigation Agent). 💻 Detection as Code: How MCP (Model Context Protocol) servers and AI are leveling the playing field for smaller security teams. Whether you're an AI enthusiast, a data nerd, or a security leader looking at the "fourth wave" of SIEM, this episode is a masterclass in modern, rapid-fire software engineering. 👉 Subscribe, leave a review, and join the debate on our LinkedIn page!
• 
  EP285 Scaling Lessons from Leading the NSA to Defending the World with Morgan Adamski 06.07.2026 20分
• 
  EP284 Closest Alligator to the Canoe: How Transforming SOC Became P0 for Lloyds Bank 29.06.2026 25分

  https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-cisos-can-pursue-technical-and-cultural-resilience-q-a?e=48754805
• 
  EP283: How Google Cloud CISO Chris Betz Uses LLMs to Defend Billions of Users from Vulnerablities 22.06.2026 28分
• 
  EP282: Debating Coupled or Decoupled SIEM with Alex Hurtado and Christopher Witter 15.06.2026 48分
• 
  EP281: Deceiving Adversaries at Scale with Kevin Conley 08.06.2026 27分
• 
  EP280 Hyperscaling Cloud Security: Wiz Joins the Cloud Security Podcast by Google 01.06.2026 29分
• 
  EP279 Native Cloud Security: Is 'Good Enough' Actually Winning? 25.05.2026 29分

  Guests: Gal Ordo, Co-founder & CPO @ Native  Topics:  In Episode 186, we debated 'Native vs. Third-Party' as a binary choice. Native seems to be a third-party vendor whose entire existence depends on the belief that cloud-native controls are superior. Does your platform validate the 'Cloud Provider' side of the debate (that their controls are enough), or does the fact that you exist prove the 'Third-Party' side (that native interfaces aren't enough)? A key argument against native controls is an AWS WAF and a Google Cloud Armor don't behave the same way. If your tool manages native controls across multi-cloud, how do you handle the 'lowest common denominator' problem? Do you dumb down the policy to fit all clouds, or do you expose the unique complexity of each one? GuardDuty and SCC produce similar but meaningfully different results. How do you abstract across that so an analyst or IR team isn't having to dig into the exact meaning of the different JSON fields in their output? We often say native tools are 'good enough' for 80% of use cases but lack the depth of specialized third-party vendors (like a dedicated CNAPP or DLP). By betting your company on orchestrating native controls, are you effectively betting that 'good enough' is the future of the market? What happens when a customer needs a feature that the CSP hasn't built yet? What fraction of your users are taking this from a "I'm 80% this one cloud, I need great coverage there and good enough elsewhere" vs "I'm truly multi-cloud" or even scarier "I have a workload that is active spanning clouds"?  Do your customers push you towards helping with the kinds of SaaS platforms that SSPM vendors cover? If AWS and Google Cloud suddenly decided to make their native security UIs perfect and unified tomorrow, would your company cease to exist? Or is the complexity of the cloud strictly increasing, guaranteeing you job security forever? Related: Video version EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again! The Great Cloud Security Debate: CSP vs. Third-Party Security Tools native.security blog
• 
  EP278 The Agentic SOC: Are We Measuring Time Saved or Risk Reduced? 18.05.2026 27分

  Guest: Matt Gregson, Principal - PwC Cyber Security Topics: What is the state of the art of "agentic SOC" in 2026? Can you describe the most agentic SOC you've seen so far? In your experience, what are the main measurable benefits of AI agents in a SOC and IR? Imagine a 2030 SOC, what do humans do? Tell us more about how you judge if a client SOC is ready for AI and agents? What is the "Ouch" moment where most organizations realize their data isn't ready for that level of autonomy? Should we be more afraid of "AI hallucinations" or "Human fatigue" in the SOC?  If a team has an agentic teammate making its own decisions based on emergent reasoning, how do you audit its "thought process"? Everyone loves to talk about "Time Saved," but in an agentic SOC, we care about "Decision Quality." What is the one metric PwC uses to prove that a SOC agent  deployment is actually reducing risk? We often hear about "human-agent teaming." Are they still looking at alerts, or are they just approving "Action Plans" generated by the AI? Resources: Video version EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI EP252 The Agentic SOC Reality: Governing AI Agents, Data Fidelity, and Measuring Success EP264 Measuring Your (Agentic) SOC: Two Security Leaders Walk into a Podcast All SOC and SIEM episodes
• 
  EP277: CISO as CFO, From Citi to Celery, It's All about the Cabbage 13.05.2026 25分

  Guest: Arvin Bansal, CISO, C&S Wholesale Grocers Topics: Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Can you produce the receipts for why this isn't a story of dry goods but rather a very meaty topic with beefy adversaries?  How are you as the CISO enabling C&S's journey into AI and LLM driven work? Securing AI is a bit harder than securing classic analytics tools, right? In addition to securely rolling out AI, how is your defense team using AI to secure C&S? Are you into the era of agentic triage and response?  What metrics for AI is your D&R lead surfacing up to you? You have AI in the business process that - if failed - will leave people hungry. How do you approach AI resilience?  How do you approach resilience in general? Is cloud part of your resilience strategy? You worked at Citigroup for a long time. What's it like having grocery margin budgets for security instead? How does your thinking change? Does this shift your build/buy/outsource for security?  If your IoT stack falls over, you've got literal ice cream melting in a warehouse. How do you balance your investments in cyber risk with physical operational risk? Should I be scared of forklifts? Resources: EP275 Google Cloud Next 2026: The AI Earthquake, "SOC-home" Syndrome, and the Ragged Edge of Reality EP247 The Evolving CISO: From Security Cop to Cloud & AI Champion EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP212 Securing the Cloud at Scale: Modern Bank CISO on Metrics, Challenges, and SecOps
• 
  EP276 AI Governance vs. The Hyper-Velocity Agentic Future: A Lawyer's Take 11.05.2026 36分

  Episode co-host: Marina Kaganovich, Enterprise Trust Lead, Office of the CISO, Google Cloud  Guest: James Sherer, Partner at BakerHostetler  Topics Is AI just an emerging technology or something bigger, deeper and different?  Is this another emerging technology or a fundamental shift? How to effectively govern something that is rapidly changing at unprecedented velocity?  We navigated the governance of the Internet and SaaS. What makes AI governance fundamentally different from the "Classic IT" or Data Governance models of the past? As we move toward Agentic AI, the line between tool and teammate blurs. Should we be governing AI agents through the lens of Technical Controls or Human Resources and behavioral contracts?  What if we hand even more responsibility to AI? Where are the tipping points as we shift from assistance to autonomy? How to avoid unintended, negative consequences when setting policy, contrasting risk-based vs. rights-based regulation and regulatory expectations Give us some practical takeaways for a defensible AI program - if an organization had to defend its AI program to a regulator or a judge tomorrow?  Related episodes: Video version EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP237 Making Security Personal at the Speed and Scale of TikTok
• 
  EP275 Google Cloud Next 2026: The AI Earthquake, "SOC-home" Syndrome, and the Ragged Edge of Reality 04.05.2026 20分

  Guests: No guests  Topics: So what have we seen at Google Cloud Next 2026? Any closing loops for our 2023-2025 Cloud Next observations? We are seeing that AI security is not an island ... what does that tell us about the difference between cloud and AI adoption? What does  "ragged edge of AI adoption" mean for security? Why do people want agents in their SOC? Do they know what gets better? What are the most notable and fun announcements? With patching speed, are we looking at something which can be overcome by engineering and courage? Or are we looking at something that is truly an impossibility?  Resources: Video version EP221 Special - Semi-Live from Google Cloud Next 2025: AI, Agents, Security ... Cloud? Next '26: Redefining security for the AI era with Google Cloud and Wiz Breaking the Patch Sound Barrier: Your Vulnerability Remediation Will Not Keep Up With AI Exploit Speed. So? EP169 Google Cloud Next 2024 Recap: Is Cloud an Island, So Much AI, Bots in SecOps Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever EP137 Next 2023 Special: Conference Recap - AI, Cloud, Security, Magical Hallway Conversations 260 things we announced at Google Cloud Next '26 – a recap
• 
  EP274 AI, Zero Trust and Secure by Design Walk into a Bar... 27.04.2026 29分

  Guest: Grant Dasher, ex-CISA, ex-Google, Distinguished Engineer, Google (again) Topics: Why is the  "Secure-by-Design" movement gaining so much momentum now, and is it a response to the failure of "bolted-on" security, or just a natural evolution of cloud maturity? In a future Secure-by-Design world, is identity the only perimeter that actually matters anymore? Or is this a cliche? As we move toward a world of autonomous agents, how does our approach to machine identity need to change? Are we just talking about more complex Service Accounts, or do we need a fundamental shift in how we authorize "intent" What is your  advice  to people who want to move fast and cannot wait for Secure by Design / Default  AI to be decided by consensus or IETF, NIST or OASIS committee? We love the argument that modern AI agents are effectively repeating the mistakes of 1960s payphones - mixing the data plane and the control plane. What is your rebuttal? How do we build "Agentic Security" that doesn't fall for 60-year-old traps? Customers are torn between their Zero Trust implementations and their AI adoption. Is Zero Trust now "legacy," or is it the prerequisite for everything we're trying to do with AI agents?   Is there Zero Trust for AI? Is this a fake buzzword or technical reality? Resources: Video version EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance EP133 The Shared Problem of Alerting: More SRE Lessons for Security EP85 Deploy Security Capabilities at Scale: SRE Explains How Google SRE books "Atomic Accidents" book (yes, really)
• 
  EP273 From CISA to Cloud: AI Assurance, Concentration Risk, and the New Regulatory Frontier 20.04.2026 29分

  Guest: Jeanette Manfra, VP, Head of Risk and Compliance, Google Cloud Topics: How does "outsourcing" security to the cloud change the intensity of the security vs. privacy struggle for a CISO? Does the centralization of cloud make it a bigger target for regulators, or is there a dimension we're missing? Does the Shared Responsibility Model actually survive contact with regulators, and how does AI complicate that boundary? Can AI actually automate the translation of fragmented rules into evidence, or are we just dreaming? How do we navigate the collision between transparency (logging everything) and privacy (recording nothing)? What is your one piece of practical advice for leaders helping their teams adopt AI? Resources: Video version EP14 Making Compliance Cloud-native EP161 Cloud Compliance: A Lawyer - Turned Technologist! - Perspective on Navigating the Cloud EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment?
• 
  EP272 More Than Just Packets: Is NDR a "First-Class" Cloud Security Control? 13.04.2026 34分

  Guest: Raja Mukerji, Co-Founder & Chief Scientist, Extrahop Rafal Los, VP of Client Relations and Strategic Initiatives, Extrahop Topics: Is Network Detection and Response (NDR) coming back after being shoved to the side by EDR a bit? Is this for real? What's the value proposition of NDR in 2026, because some people still don't understand it? How does NDR apply to the world of WFH, cloud/SaaS, encryption, high bandwidth, etc? Is the value of NDR the same, or different, when it comes to public (or private) cloud? How does NDR fill visibility gaps that identity and agent-based solutions cannot? What does NDR offer that built-in cloud security tooling (as of right now) does not? Would you call NDR a key cloud security control? Does NDR help with shadow AI? NDR elephant in the room is sometimes cost. How does cost change the value prop when compared to on-premise or physical infrastructure? Resources: Video version EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty EP113 Love it or Hate it, Network Security is Coming to the Cloud EP154 Mike Schiffman: from Blueboxing to LLMs via Network Security at Google EP115 How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer? EP263 SOC Refurbishing: Why New Tools Won't Fix Broken Processes (Even With AI) "The GC+CISO Connection Book" book