NO. 372 — LastPass Employee Hack, State AI Propaganda, Crowdstrike Report Analysis…

NO. 372 — LastPass Employee Hack, State AI Propaganda, Crowdstrike Report Analysis…

Unsupervised Learning is about ideas and trends in Cybersecurity, National Security, AI, Technology, and Culture—and how best to upgrade ourselves to be ready for what's coming.

Unsupervised Learning is about ideas and trends in Cybersecurity, National Security, AI, Technology, and Culture&mdash;and how best to upgrade ourselves to be ready for what's coming.

Exploring the fascinating intersection of security, technology, and humans.

Unsupervised Learning

Unsupervised Learning (Member Edition)

🔹 Thanks to ProjectDiscovery for sponsoring today’s video. I've been using their tools like Nuclei and Subfinder for years, and now they’ve brought that power to the cloud with a full vulnerability management platform.

➡ Try it yourself at https://ul.live/PD1

For over a decade, I've been exploring how AI and context intersect—and I believe Unified Entity Context (UEC) is the key to unlocking what comes next.

In this podcast, I walk through my journey—from security assessments and AI-powered tools to building real-world demos like Alma and Threshold. The core idea? That most hard decisions are only hard because we lack the necessary context. With rich, accurate, and fresh context, even complex decisions become simple.

If you're building in security, investing in AI, or just trying to understand where things are heading, this concept might reframe everything.

Check out the full video here: https://youtu.be/IHUqk90ch7I

🔹 Thanks to ProjectDiscovery for sponsoring today&rsquo;s video. I've been using their tools like Nuclei and Subfinder for years, and now they&rsquo;ve brought that power to the cloud with a full vulnerability management platform.
➡ Try it yourself at <a href="https://ul.live/PD1">https://ul.live/PD1</a>
For over a decade, I've been exploring how AI and context intersect&mdash;and I believe Unified Entity Context (UEC) is the key to unlocking what comes next.
In this podcast, I walk through my journey&mdash;from security assessments and AI-powered tools to building real-world demos like Alma and Threshold. The core idea? That most hard decisions are only hard because we lack the necessary context. With rich, accurate, and fresh context, even complex decisions become simple.
If you're building in security, investing in AI, or just trying to understand where things are heading, this concept might reframe everything.
Check out the full video here: https://youtu.be/IHUqk90ch7I

Unified Entity Context

https://api.omny.fm/orgs/070af456-729b-4a0f-9c09-a6c100397b59/clips/ba06b395-3c9e-4512-9725-b2de0015c9c2/transcript

What really happened at RSA 2024?

Daniel Miessler and Jason Haddix break it down.

Fresh off a whirlwind RSA week, Daniel sits down with Jason Haddix (Arcanum Information Security) to talk about what mattered—beyond the show floor noise. From off-site innovation summits to real-world AI implementation, this deep dive covers:

-Where the real innovation happened (hint: not on the show floor)
-Key takeaways from the OpenAI and Airbnb AI Security events
-Jason’s talk on AI pentesting methodology and the Prompt Injection Taxonomy 
-The future of cybersecurity moats and the risk of AI-native disruption 
-Why agents aren’t the main character—data is -DARPA's AIxCC competition and the rise of Cyber Reasoning Systems 
-Challenges with evals, autonomous security workflows, and VDP backlash -Behind the scenes at RSA: puppies, parties, burnout, and brutal honesty

They also explore content creation, the future of platform-native context, and why being opinionated (with receipts) matters more than ever in security and tech. 

Jason's Company https://arcanum-sec.com

What really happened at RSA 2024?
Daniel Miessler and Jason Haddix break it down.
Fresh off a whirlwind RSA week, Daniel sits down with Jason Haddix (Arcanum Information Security) to talk about what mattered&mdash;beyond the show floor noise. From off-site innovation summits to real-world AI implementation, this deep dive covers:
-Where the real innovation happened (hint: not on the show floor) -Key takeaways from the OpenAI and Airbnb AI Security events -Jason&rsquo;s talk on AI pentesting methodology and the Prompt Injection Taxonomy -The future of cybersecurity moats and the risk of AI-native disruption -Why agents aren&rsquo;t the main character&mdash;data is -DARPA's AIxCC competition and the rise of Cyber Reasoning Systems -Challenges with evals, autonomous security workflows, and VDP backlash -Behind the scenes at RSA: puppies, parties, burnout, and brutal honesty
They also explore content creation, the future of platform-native context, and why being opinionated (with receipts) matters more than ever in security and tech.&nbsp;
Jason's Company https://arcanum-sec.com

Reviewing RSA 2025 with Jason Haddix

https://api.omny.fm/orgs/070af456-729b-4a0f-9c09-a6c100397b59/clips/364e98f1-9b0c-4153-bd66-b2d700384308/transcript

➡ Get full visibility, risk insights, red teaming, and governance for your AI models, AI agents, RAGs, and more—so you can securely deploy AI powered applications with ul.live/mend

In this episode, I speak with Bar-El Tayouri, Head of AI Security at Mend.io, about the rapidly evolving landscape of application and AI security—especially as multi-agent systems and fuzzy interfaces redefine the attack surface.

We talk about:

• Modern AppSec Meets AI Agents
 How traditional AppSec falls short when it comes to AI-era components like agents, MCP servers, system prompts, and model artifacts—and why security now depends on mapping, monitoring, and understanding this entire stack.

•  Threat Discovery, Simulation, and Mitigation
 How Mend’s AI security suite identifies unknown AI usage across an org, simulates dynamic attacks (like prompt injection via PDFs), and provides developers with precise, in-code guidance to reduce risk without slowing innovation.

•  Why We’re Rethinking Identity, Risk, and Governance
Why securing AI systems isn’t just about new threats—it’s about re-implementing old lessons: identity access, separation of duties, and system modeling. And why every CISO needs to integrate security into the dev workflow instead of relying on blunt-force blocking.

Subscribe to the newsletter at:
https://danielmiessler.com/subscribe

Join the UL community at:
https://danielmiessler.com/upgrade

Follow on X:
https://x.com/danielmiessler

Follow on LinkedIn:
https://www.linkedin.com/in/danielmiessler

Chapters:

00:00 - From Game Hacking to AI Security: Barel’s Tech Journey
03:51 - Why Application Security Is Still the Most Exciting Challenge
04:39 - The Real AppSec Bottleneck: Prioritization, Not Detection
06:25 - Explosive Growth of AI Components Inside Applications
12:48 - Why MCP Servers Are a Massive Blind Spot in AI Security
15:02 - Guardrails Aren’t Keeping Up With Agent Power
16:15 - Why AI Security Is Maturing Faster Than Previous Tech Waves
20:59 - Traditional AppSec Tools Can’t Handle AI Risk Detection
26:01 - How Mend Maps, Discovers, and Simulates AI Threats
34:02 - What Ideal Customers Ask For When Securing AI
38:01 - Beyond Guardrails: Mend’s Guide Rails for In-Code Mitigation
41:49 - Multi-Agent Systems Are the Next Security Nightmare
45:47 - Final Advice for CISOs: Enable, Don’t Disable Developers

➡ Get full visibility, risk insights, red teaming, and governance for your AI models, AI agents, RAGs, and more&mdash;so you can securely deploy AI powered applications with&nbsp;<a href="https://www.mend.io/mend-ai-security-lp/?utm_source=promotion&amp;utm_medium=paid_soci[%E2%80%A6]_influencer_danielmiessler&amp;utm_origin=social&amp;utm_from=promotion">ul.live/mend</a>
In this episode, I speak with Bar-El Tayouri, Head of AI Security at<a href="https://www.mend.io/"> Mend.io</a>, about the rapidly evolving landscape of application and AI security&mdash;especially as multi-agent systems and fuzzy interfaces redefine the attack surface.
We talk about:
&bull; Modern AppSec Meets AI Agents How traditional AppSec falls short when it comes to AI-era components like agents, MCP servers, system prompts, and model artifacts&mdash;and why security now depends on mapping, monitoring, and understanding this entire stack.
&bull;&nbsp; Threat Discovery, Simulation, and Mitigation How Mend&rsquo;s AI security suite identifies unknown AI usage across an org, simulates dynamic attacks (like prompt injection via PDFs), and provides developers with precise, in-code guidance to reduce risk without slowing innovation.
&bull;&nbsp; Why We&rsquo;re Rethinking Identity, Risk, and Governance Why securing AI systems isn&rsquo;t just about new threats&mdash;it&rsquo;s about re-implementing old lessons: identity access, separation of duties, and system modeling. And why every CISO needs to integrate security into the dev workflow instead of relying on blunt-force blocking.
Subscribe to the newsletter at: <a href="https://danielmiessler.com/subscribe">https://danielmiessler.com/subscribe</a>
Join the UL community at: <a href="https://danielmiessler.com/upgrade">https://danielmiessler.com/upgrade</a>
Follow on X: <a href="https://x.com/danielmiessler">https://x.com/danielmiessler</a>
Follow on LinkedIn: <a href="https://www.linkedin.com/in/danielmiessler">https://www.linkedin.com/in/danielmiessler</a>
Chapters:
00:00 - From Game Hacking to AI Security: Barel&rsquo;s Tech Journey 03:51 - Why Application Security Is Still the Most Exciting Challenge 04:39 - The Real AppSec Bottleneck: Prioritization, Not Detection 06:25 - Explosive Growth of AI Components Inside Applications 12:48 - Why MCP Servers Are a Massive Blind Spot in AI Security 15:02 - Guardrails Aren&rsquo;t Keeping Up With Agent Power 16:15 - Why AI Security Is Maturing Faster Than Previous Tech Waves 20:59 - Traditional AppSec Tools Can&rsquo;t Handle AI Risk Detection 26:01 - How Mend Maps, Discovers, and Simulates AI Threats 34:02 - What Ideal Customers Ask For When Securing AI 38:01 - Beyond Guardrails: Mend&rsquo;s Guide Rails for In-Code Mitigation 41:49 - Multi-Agent Systems Are the Next Security Nightmare 45:47 - Final Advice for CISOs: Enable, Don&rsquo;t Disable Developers

A Conversation with Bar-El Tayouri from Mend.io

https://api.omny.fm/orgs/070af456-729b-4a0f-9c09-a6c100397b59/clips/8da7809c-e181-4e59-830b-b2d40166db65/transcript

NO. 372 — LastPass Employee Hack, State AI Propaganda, Crowdstrike Report Analysis…

In 1 playlist(s)

Unsupervised Learning

Social links

Follow podcast

Recent clips