Hacker Valley Studio

Security teams spent decades begging for more logs. Now the enterprise is generating petabytes a day, and the thing drowning in it isn't just the SOC anymore, it's your AI agents too. In this episode, Ron sits down with Myke Lyons, CISO at Cribl, who cut his teeth in telemetry and logging decades ago and has landed right back there in the age of AI. Ron and Myke dig into why most telemetry failures aren't data problems at all, they're decisions nobody made about why the logs are being collected in the first place. Myke breaks down what to track on every agent in your environment, why token spend belongs on the security team's plate, why dashboards are quietly dying, and why treating an AI agent like just another employee is a mistake that's going to bite security teams hard. Underneath it all is one question Myke keeps circling back to: do you actually know what normal looks like for every agent in your environment? Impactful Moments 00:00 - Introduction01:50 - Myth Busting: AI Agents Aren't Just Another User Account04:25 - Meet Myke Lyons, CISO at Cribl05:05 - What it means to run security at a telemetry company06:10 - From gigabytes of logs at GE to petabytes today07:45 - MITRE ATT&CK, Cribl's new APEX framework, and orienting telemetry10:20 - Why most telemetry problems are decision problems, not data problems13:20 - OCSF and how security teams are rethinking their schemas14:25 - Why the dashboard is dying17:35 - What Myke wants to track about every AI agent20:10 - How to spot an agent going rogue23:15 - Making your data AI-ready and the case for schematizing everything27:10 - Tokenomics: treating AI spend as a security responsibility29:05 - The non-negotiable logs every org should be collecting31:50 - Hot takes: build vs. buy, tier two to three, and Myke's daily AI briefing33:35 - Closing thoughts and outro Links Connect with Myke Lyons on LinkedIn: https://www.linkedin.com/in/mykelyons/ Learn more about Cribl: https://cribl.io/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/

Imagine how much investigation time your SOC could get back if the busywork just disappeared. Ron sits down with John Gillis, Staff Security AI Engineer at Adobe, who built an in-house AI investigation platform from scratch. John's system runs on more than 30 specialized agents that reason through cases instead of following a script. In one run, that meant over 140 detections investigated in under four hours at an 80 to 85% quality rating. Ron and John dig into the hard lesson that made John rip out his own tooling and rebuild it around function calling, why "humans first" drives every decision his team makes, and whether AI SOC is actually different from SOAR or just the same promise with way better marketing. Underneath all of it is the one thing John says decides whether any of this actually works: context. Give the AI too little and it's guessing, give it too much and it drowns just like a human would. Listen to find out what it actually takes to build an AI SOC that reasons instead of just automates. Impactful Moments 00:00 - Introduction02:05 - The rewind: how SOAR promised to save the SOC in 201503:35 - Meet John Gillis, Adobe's Staff AI Security Engineer05:30 - What cybersecurity looked like before AI at enterprise scale07:00 - The "humans first" strategy behind Adobe's AI investigator09:30 - Why careless context management is the biggest pitfall in agent design14:45 - Solving the speed problem: is it tooling, process, or people?17:10 - From monolith to microservices: rebuilding the platform for scale24:05 - What actually makes an AI agent's "persona" work26:00 - John's prediction for the SOC three years from now28:50 - The three skills every security practitioner needs for 202632:10 - Final verdict: is AI SOC really different, or SOAR with new branding? Links Connect with John Gillis on LinkedIn: https://www.linkedin.com/in/john-gillis/ If you're a researcher ready to make an impact, check out the announcement about Adobe’s new home for the Adobe Bug Bounty Program here: https://blog.adobe.com/security/a-new-home-for-the-adobe-bug-bounty-program Check out Adobe’s Bug Bounty profile on Intigriti: https://app.intigriti.com/programs/adobe/adobepublic/detail Learn more about Adobe: https://www.adobe.com/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/

What if the encrypted traffic flowing across the internet right now (emails, files, logins) is already being quietly collected and stored by someone waiting for the day they can finally crack it open? That's the threat behind "harvest now, decrypt later," and it's closer than most people think. Ron Eddings sits down with Michael Fasulo, Senior Director of Portfolio Marketing at Commvault, to talk about where post-quantum cryptography (PQC) really stands in 2026. They discuss "harvest now, decrypt later," the specific industries quietly racing to prepare, and why a commercially viable quantum machine might only be four years away. Ron and Michael trace the journey from a 1998 hack to today's quantum race, and the good news is there's still time to get ahead of it. Listen to hear where the real opportunity is, and how to start building your defense today. Impactful Moments00:00 - Introduction01:40 - Rewind: the 1998 Deep Crack story04:10 - Michael Fasulo and the current state of post-quantum cryptography in 202605:05 - Harvest now, decrypt later: do people really have the storage to do this?06:10 - Where is this actually happening? Nation-states vs. coffee shops08:50 - Who the real targets are: government, financial services, oil and gas10:05 - Are everyday SaaS tools like Zoom and Gmail implicated?12:25 - How Commvault helps organizations inventory their crypto footprint17:00 - Trust, vendor partnerships, and the Commvault / Microsoft Sentinel integration18:30 - Signs that a commercial quantum machine may be closer than we think24:45 - Are we already behind? What to do starting next week28:20 - Deep Crack revisited Links Connect with Michael Fasulo on LinkedIn: https://www.linkedin.com/in/michael-fasulo Learn more about Commvault: https://www.commvault.com – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/

What does the world's most prolific cybercrime operation look like from the inside? And why does it operate suspiciously like a mid-sized tech company, complete with HR headaches, salary negotiations, and a distracted boss nobody respects? Ron Eddings sits down with investigative journalist and author, Geoff White, who has spent over 20 years covering cybercrime for the BBC, Channel 4 News, and Sky News. Geoff has read 47,000 of Conti’s 300,000 leaked internal chats, the gang that dominated the ransomware world in 2021 and 2022, pulling in hundreds of millions of dollars in ransoms. From the Moscow movie studio the gang's leader used to launder money years previously, to the Ukraine war leak that brought the whole Conti empire down, this one plays like true crime… because it is. Geoff makes the case that defenders should think the same way: you're not buying security tools to fend off a hoodie in a basement, you're investing to outcompete a rival business. For anyone trying to integrate a better incident response plan, this episode reframes the whole conversation. Impactful Moments00:00 - Introduction01:45 - The Rewind: Colonial Pipeline and the week the East Coast ran dry03:50 - How Geoff went from tech news to cybercrime reporting05:10 - The difference between threat groups, APTs, and crime gangs07:25 - Inside the Conti leaks: 300,000 messages08:55 - Meet the gang: Stern, Mango, and Target13:20 - Stern's origin story: Zeus malware, money mules, and the 25th Floor front company16:50 - Ransomware gangs vs. the mafia: where's the protection?18:10 - The money: $2.5M single payouts and 400 years of wages19:30 - The Conti member arrested on a layover in Miami20:35 - The downfall: the Ukraine war and the leak that ended it all23:05 - What businesses can learn from Conti: recruitment, retention, reputation27:45 - Advice for defenders: response waves, segmentation, and negotiating down31:05 - Ron's takeaway: belonging and the thin line between operator and criminal Links Connect with Geoff White on LinkedIn: https://www.linkedin.com/in/geoffwhitetech/ Get your own copy of Geoff's books (Crime Dot Com, The Lazarus Heist, Rinsed): https://geoffwhite.tech/book/ Want more information on Conti? Check out Geoff’s BBC podcast series, Cyber Hack: The Conti Files, available on BBC Sounds, Spotify, and Apple Podcasts – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/