Cloud Security Podcast by Google

Guest:
Raja Mukerji, Co-Founder & Chief Scientist, Extrahop
Rafal Los, VP of Client Relations and Strategic Initiatives, Extrahop
Topics:
Is Network Detection and Response (NDR) coming back after being shoved to the side by EDR a bit? Is this for real?
What's the value proposition of NDR in 2026, because some people still don't understand it? How does NDR apply to the world of WFH, cloud/SaaS, encryption, high bandwidth, etc?
Is the value of NDR the same, or different, when it comes to public (or private) cloud?
How does NDR fill visibility gaps that identity and agent-based solutions cannot?
What does NDR offer that built-in cloud security tooling (as of right now) does not? Would you call NDR a key cloud security control?
Does NDR help with shadow AI?
NDR elephant in the room is sometimes cost. How does cost change the value prop when compared to on-premise or physical infrastructure?
Resources:
Video version
EP267 AI SOC or AI in a SOC? Cutting Through Hype, Pricing Models, and SIEM Detection Efficacy with Raffy Marty
EP113 Love it or Hate it, Network Security is Coming to the Cloud
EP154 Mike Schiffman: from Blueboxing to LLMs via Network Security at Google
EP115 How to Approach Cloud in a Cloudy Way, not As Somebody Else's Computer?
EP263 SOC Refurbishing: Why New Tools Won't Fix Broken Processes (Even With AI)
"The GC+CISO Connection Book" book

Guests:
Eric Foster, CEO, Tenex.AI
Bashar Abouseido, President,  Tenex.AI
Topics:
"10X SOC" sounds great.  But for an organization stuck in "SIEM 1.0" with poor data quality and manual workflows, is "AI-native MDR" a "leapfrog" opportunity or a recipe for disaster?
We've seen the rise of "Decoupled SIEM" and security data lakes. Does a "Modern SIEM" even need to exist if an MDR platform has an agentic layer doing the heavy lifting? 
You've argued for AI-native over AI-bolted-on. For an end user, what are the tangible differences of using "AI inside a legacy SIEM" versus using an "AI-native separate product"?
What is the one task you thought AI would handle by now that still requires a senior human analyst to step in?
If a CISO is using an AI MDR, "Mean Time to Detect" (MTTD) starts to look like a vanity metric because the machine is instant. What is the new golden metric for an AI-powered SOC? Is it "Time to Context," "Reduction in Human Toil," or something else?
How do you help a skeptical SOC Manager—who has been burned by false positives for a decade—trust an autonomous agent to perform a "containment" action at 3:00 AM?  
Resources:
EP227 AI-Native MDR: Betting on the Future of Security Operations?
EP10 SIEM Modernization? Is That a Thing?
The original "10X" paper "Autonomic Security Operations: 10X Transformation of the Security Operations Center"

Guest:
Dan Lorenc, Founder / CEO, Chainguard
Topics:
We just saw a security tool (Trivy) get used to pop an AI infrastructure tool (LiteLLM) to eventually pop end users. Have we reached the point where our security tooling is actually our largest unmanaged attack surface? 
Why now? Software supply chain security had the perennial vibe of "not top concern" for most organizations, right?
TeamPCP pushed malicious code to existing GitHub tags. We've been screaming about pinning versions to SHAs for years, but clearly, nobody is listening. Is it time to admit that 'convenience' is the primary enemy of supply chain security?
The Axios incident showed a victim compromised in under two minutes. In a world of auto-updating dependencies, is the concept of a human-in-the-loop for software updates officially dead, or do we need to look very hard at version pinning and such?
With XZ Utils case, we saw a long-game social engineering attack. Beyond just 'watching npm closely,' what are the realistic architectural safeguards for an org that knows they can't audit every line of an update?
We've spent the last three years talking about SBOMs (Software Bill of Materials) like they were a pill for supply chain health. But if the scanner producing the SBOM is the one that's compromised, isn't the SBOM just a signed receipt for your own house being on fire? 
What is the one practical thing they can do to ensure their CI/CD isn't a credential-exfiltration-as-a-service platform?
Resources:
Video version
North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack
EP100 2022 Accelerate State of DevOps Report and Software Supply Chain Security
EP116 SBOMs: A Step Towards a More Secure Software Supply Chain
EP226 AI Supply Chain Security: Old Lessons, New Poisons, and Agentic Dreams
EP24 Linking Up The Pieces: Software Supply Chain Security at Google and Beyond
Matt Levine blog

Guests:
No guests! Just Tim and Anton
Topics:
Hard to believe we've been doing these since 2022, is that right?
What did we see this year at RSA, apart from AI? And more AI? And more AI?
What framework can we use to understand the approaches vendors take to AI and security? Just saying "AI washing" is not enough!
How to tell "AI washer" from "AI tourist"? 
I sense that "securing AI" (and agents) is finally growing as fast as "using AI for security", do you agree?
Is the AI vulnerability apocalypse coming? Soon?
Have we seen any signs of AI backlash?
Resource:
Video version
EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025
RSA 2025: AI's Promise vs. Security's Past — A Reality Check blog
EP172 RSA 2024: Separating AI Signal from Noise, SecOps Evolves, XDR Declines?
EP119 RSA 2023 - What We Saw, What We Learned, and What We're Excited About
EP70 Special - RSA 2022 Reflections - Securing the Past vs Securing the Future
EP255 Separating Hype from Hazard: The Truth About Autonomous AI Hacking
EP256 Rewiring Democracy & Hacking Trust: Bruce Schneier on the AI Offense-Defense Balance

Guests:
Kelli Vanderlee, Senior Manager, Threat Analysis, Mandiant, Google Cloud
Scott Runnels, Mandiant Incident Response, Google Cloud
 Topics:
Do we need to rethink "Mean Time to Respond" entirely, or are we just in deep trouble?
Why are threat groups collaborating so well, and are there actual lessons for defenders in their "business" model?
What is the scalable advice for teams worried about voice phishing and GenAI cloning?
What does "weaponizing the administrative fabric" actually mean in a world where identity is the perimeter?
Why is identity/SaaS compromise "news" in 2026 when cloud security folks have been shouting about it for years? What actually changed?
What's the latest in supply chain compromise, particularly regarding malicious open-source packages?
How do we defend against malware that is "lazy" enough to use the victim's own AI tools for reconnaissance?
What is the specific advice for Detection and Response (D&R) teams to handle "living off the land" (or "living off the cloud")?
How do you fix the situation when IT and Security departments genuinely hate each other?
Besides reading the report, what is the one book or piece of advice for a CISO to survive this year?
Resources:
Video version
M-Trends 2026 Report
EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends
EP254 Escaping 1990s Vulnerability Management: From Unauthenticated Scans to AI-Driven Mitigation
EP205 Cybersecurity Forecast 2025: Beyond the Hype and into the Reality
EP147 Special: 2024 Security Forecast Report
"The Evolution of Cooperation" book