The Security Podcast of Silicon Valley

Chris Kirschke spent 27 years in security operations before a venture studio's general partner asked him to run a company. His first answer was that CISO does not spell CEO. He took the job anyway, and Kyberis AI now runs a threat graph that pulls in any OpenCTI-compliant feed, commercial or OSINT, and exposes it to security agents through MCP. Jon and Chris start with what has to be true before any of that works. Chris borrows the thesis Jason Clinton laid out at Anthropic. If you can't trust the inputs, you'll never trust the output, and that holds whether the thing consuming the input is an L1 analyst, a 2003 IDS, or a threat-hunting agent. Then the good part. Chris has enabled write access on a production system exactly once in his career. Cisco NetRanger, shunning turned on, signature matched, ACL written to the downstream router. He watched a production system go from hero to zero in 7 minutes, and finding a way to power cycle a router that size took him longer than the outage. Sean Gray was in the data center with him, still in college. That's the story sitting under the question Chris now puts to anyone selling autonomous remediation. Are you actually going to give an agent write access? Also in this one. The engineer at Gartner who wired an anti-CISO agent to his own Gartner login, his tech stack, and his team's engineering bandwidth, so he can ask Claude to explain to his boss why they're not doing the shiny thing yet. Why Chris thinks the case for AppSec being dead is horseshit, and why the SIEM isn't going anywhere either. The hoodie-or-suit question he'd hand his younger self. And the product he'd write an angel check for tomorrow, which has nothing to do with security and everything to do with understanding what his teenage daughters just said to him. Chris's ask is simple. Go to developer.kyberis.ai and start building. Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours with 40+ security engineers are free at ysecurity.io/startups. Chris Kirschke: https://www.linkedin.com/in/kirschke/Kyberis AI: developer.kyberis.ai Jon McLachlan: https://www.linkedin.com/in/jon-mclachlan/YSecurity: https://ysecurity.io

Every employee at your company probably has ChatGPT, Claude, and Gemini installed, and nobody's tracking what data goes where. Xia Hua, co-founder and CEO of Traceforce, came back a year after her first appearance to show us what that looks like from the inside. Her team's open source scanner, MCP X-Ray, found a prompt injection flaw in Playwright, one of the most widely used MCPs, and she triggered it live with a single sentence. We also get into Anthropic's report on the espionage campaign that used Claude and a set of MCPs against about 30 organizations. And the bigger problem underneath it all, that data and instructions are now co-mingled, so any tool that reads text can be told what to do by that text. Xia: www.linkedin.com/in/xia-hua-ph-dTraceForce: www.traceforce.aiMCP X-Ray: www.github.com/traceforce/mcp-xray Jon: www.linkedin.com/in/jon-mclachlanSasha: www.linkedin.com/in/aliaksandr-sinkevichYSecurity: www.ysecurity.io 🔒 Sponsored by YSecurity Closing a big deal and getting hit with a vendor questionnaire, SOC 2 request, or pen test requirement? That's exactly what we handle. YSecurity embeds a team of security engineers with backgrounds from Apple, Uber, Microsoft, Robinhood, and Brex directly into your company. No full-time hire, no bloated retainer. You set a monthly cap and we handle everything. Book a free strategy call and we'll tell you exactly where you stand. 👉 Book your free call: 30 Min Meeting | YSecurity.io | Cal.com 👉 Learn more: YSecurity | On-Demand Cybersecurity Team for Startups — SOC 2 in 5 Months

Most companies still test security long after code is shipped. That delay creates blind spots. In this episode, Rejah Rehim, Co-Founder & CEO of Beagle Security, explains how automated penetration testing gives teams a clearer picture of their real exposure—while keeping the process simple enough for developers to run themselves. Rejah: https://www.linkedin.com/in/rejah/ Beagle Security: https://beaglesecurity.com/ Jon: https://www.linkedin.com/in/jon-mclachlan/ Sasha: https://www.linkedin.com/in/aliaksandr-sinkevich/ YSecurity: https://www.ysecurity.io/ 🔒 Sponsored by YSecurity Closing a big deal and getting hit with a vendor questionnaire, SOC 2 request, or pen test requirement? That's exactly what we handle. YSecurity embeds a team of security engineers with backgrounds from Apple, Uber, Microsoft, Robinhood, and Brex directly into your company. No full-time hire, no bloated retainer. You set a monthly cap and we handle everything. Book a free strategy call and we'll tell you exactly where you stand. 👉 Book your free call: 30 Min Meeting | YSecurity.io | Cal.com 👉 Learn more: YSecurity | On-Demand Cybersecurity Team for Startups — SOC 2 in 5 Months

Most people think hackers exploit systems. The best hackers improve them. In this episode, Ted Harrington explains how to unlock your “inner hacker”—the mindset that turns obstacles into innovation. From breaking outdated rules to building smarter, safer companies, this conversation reframes what it means to lead with curiosity. Ted: https://www.linkedin.com/in/securityted/ Ted’s website: https://www.tedharrington.com/ Jon: https://www.linkedin.com/in/jon-mclachlanSasha: https://www.linkedin.com/in/aliaksandr-sinkevichYSecurity: https://www.ysecurity.io 🔒 Sponsored by YSecurity Closing a big deal and getting hit with a vendor questionnaire, SOC 2 request, or pen test requirement? That's exactly what we handle. YSecurity embeds a team of security engineers with backgrounds from Apple, Uber, Microsoft, Robinhood, and Brex directly into your company. No full-time hire, no bloated retainer. You set a monthly cap and we handle everything. Book a free strategy call and we'll tell you exactly where you stand. 👉 Book your free call: 30 Min Meeting | YSecurity.io | Cal.com 👉 Learn more: YSecurity | On-Demand Cybersecurity Team for Startups — SOC 2 in 5 Months

Deepak Dutt, founder of Zighra, reveals how continuous behavioral authentication is changing the game—from stopping $200M fraud schemes to securing military operations.Deepak: https://www.linkedin.com/in/deepakdutt/Zighra: https://zighra.com/Jon: https://www.linkedin.com/in/jon-mclachlanSasha: https://www.linkedin.com/in/aliaksandr-sinkevichYSecurity: https://www.ysecurity.io 🔒 Sponsored by YSecurity Closing a big deal and getting hit with a vendor questionnaire, SOC 2 request, or pen test requirement? That's exactly what we handle. YSecurity embeds a team of security engineers with backgrounds from Apple, Uber, Microsoft, Robinhood, and Brex directly into your company. No full-time hire, no bloated retainer. You set a monthly cap and we handle everything. Book a free strategy call and we'll tell you exactly where you stand. 👉 Book your free call: 30 Min Meeting | YSecurity.io | Cal.com 👉 Learn more: YSecurity | On-Demand Cybersecurity Team for Startups — SOC 2 in 5 Months