Safe Mode Podcast

The rules of responsible disclosure were written for a different era — one where humans found bugs, humans reported them, and 90 days felt like plenty of time to patch. That era is over. In this episode, Greg sits down with Gal Elbaz, co-founder and CTO of Oligo Security, to unpack how AI-assisted vulnerability research is breaking the frameworks the security industry has relied on for decades. From MITRE admitting it can no longer keep up with the volume of CVE reports, to Linus Torvalds saying the same about the Linux kernel, the cracks in the system are impossible to ignore. Gal draws on his years as a hands-on researcher at Check Point — and his current work leading Oligo's research team — to offer perspective from both sides of the disclosure table. He and Greg dig into the Microsoft controversy, the tension between researcher leverage and community responsibility, and why the Spider-Man rule applies more than ever to the security research community right now. They also tackle the big questions: Should disclosure timelines be based on exploitability rather than a fixed number of days? Who owns the decision to accelerate a disclosure? And is it time to throw out CVSS scores and build something new? Gal's bottom line: the noise needs to be cut, the critical bugs need better definition, and both vendors and researchers need to get back to the table — as humans. For our reporter chat, Greg talked with Derek Johnson about the reaction to the Trump administration's fight with Anthropic.

AI is reshaping cybersecurity faster than most organizations can govern it—and the risk no longer stops at the edge of the enterprise. In this episode, Greg speaks with Brian Dye, CEO of Corelight, about the World Economic Forum’s Global Cybersecurity Outlook 2026: why fraud and phishing are rising on the CEO agenda, why ransomware still dominates operations, and how leaders can build measurable resilience amid growing third‑party and cloud dependencies. In the reporter chat, Greg talks with Derek Johnson on the reaction at the recent NASS conference to the raid on election efforts in Fulton County, Georgia. Join Virtru on Feb 18th for the inaugural DCMMC at 1801 Pennsylvania Ave for a no-nonsense CMMC deep dive followed by a bourbon tasting—grab your spot here. https://www.virtru.com/dcmmc-event

Retired Lt. Gen. Charlie “Tuna” Moore, former deputy commander of U.S. Cyber Command, joins Safe Mode to break down his new paper on “dominating the digital space” and a whole-of-society strategy for defending the United States from cyber aggression. Host Greg Otto digs into why cyber deterrence often fails below the threshold of armed conflict and what a National Cyber Operations Team—integrating private-sector talent under Cyber Command oversight—could look like in practice. Plus, journalist Matt Kapko returns to unpack the messy ethics and incentives behind ransomware negotiations after new guilty pleas spotlight just how unregulated the space can be.

In our final episode of 2025, Dave Lewis, global advisory CISO for 1Password, joins Greg Otto to unpack the “access‑trust gap”: the growing mismatch between what employees (and tools like AI assistants) can access at work and what security teams can actually see, verify, and control. Dav explains how this gap shows up in everyday ways—logins that bypass intended controls, personal devices used for work, and teams adopting apps or AI tools faster than IT can govern them—and why that combination creates quiet but serious risk. You’ll hear practical advice on narrowing the gap with stronger identity checks, smarter device trust, cleaner SaaS governance, and simple guardrails for safe AI use that don’t crush productivity.