Join your hosts, Anton Chuvakin and Timothy Peacock, as they talk with industry experts about some of the most interesting areas of cloud security. If you like having threat models questioned and a few bad puns, please tune in!
When it comes to Linux environments – spanning on-prem, cloud, and even–gasp–hybrid setups – where are you seeing the most significant blind spots for security teams today?
There's sometimes a perception that Linux is inherently more secure or less of a malware target than Windows. Could you break down some of the fundamental differences in how malware behaves on Linux versus Windows, and why that matters for defenders in the cloud?
'Living off the Land' isn't a new concept, but on Linux, it feels like attackers have a particularly rich set of native tools at their disposal. What are some of the more subtly abused but legitimate Linux utilities you're seeing weaponized in cloud attacks, and how does that complicate detection?
When you weigh agent-based versus agentless monitoring in cloud and containerized Linux environments, what are the operational trade-offs and outcome trade-offs security teams really need to consider?
SSH keys are the de facto keys to the kingdom in many Linux environments. Beyond just 'use strong passphrases,' what are the critical, often overlooked, risks associated with SSH key management, credential theft, and subsequent lateral movement that you see plaguing organizations, especially at scale in the cloud?
What are the biggest operational hurdles teams face when trying to conduct incident response effectively and rapidly across such a distributed Linux environment, and what's key to overcoming them?
When introducing AI agents to security teams at Google, what was your initial strategy to build trust and overcome the natural skepticism? Can you walk us through the very first conversations and the key concerns that were raised?
With a vast array of applications, how did you identify and prioritize the initial use cases for AI agents within Google's enterprise security?
What specific criteria made a use case a good candidate for early evaluation? Were there any surprising 'no-go' areas you discovered?"
Beyond simple efficiency gains, what were the key metrics and qualitative feedback mechanisms you used to evaluate the success of the initial AI agent deployments?
What were the most significant hurdles you faced in transitioning from successful pilots to broader adoption of AI agents?
How do you manage the inherent risks of autonomous agents, such as potential for errors or adversarial manipulation, within a live and critical environment like Google's?
How has the introduction of AI agents changed the day-to-day responsibilities and skill requirements for Google's security engineers?
From your unique vantage point of deploying defensive AI agents, what are your biggest concerns about how threat actors will inevitably leverage similar technologies?
Security is part of your DNA. In your day to day at TikTok, what are some tips you’d share with users about staying safe online?
Many regulations were written with older technologies in mind. How do you bridge the gap between these legacy requirements and the realities of a modern, microservices-based tech stack like TikTok's, ensuring both compliance and agility?
You have a background in compliance and risk management. How do you approach demonstrating the effectiveness of security controls, not just their existence, especially given the rapid pace of change in both technology and regulations?
TikTok operates on a global scale, facing a complex web of varying regulations and user expectations. How do you balance the need for localized compliance with the desire for a consistent global security posture? How do you avoid creating a fragmented and overly complex system, and what role does automation play in this balancing act?
What strategies and metrics do you use to ensure auditability and provide confidence to stakeholders?
We understand you've used TikTok videos for security training. Can you elaborate on how you've fostered a strong security culture internally, especially in such a dynamic environment?
SIEM migration is hard, and it can take ages. Yours was - given the scale and the industry - on a relatively short side of 9 months. What’s been your experience so far with that and what could have gone faster?
Anton might be a “reformed” analyst but I can’t resist asking a three legged stool question: of the people/process/technology aspects, which are the hardest for this transformation? What helped the most in solving your big challenges?
Was there a process that people wanted to keep but it needed to go for the new tool?
One thing we talked about was the plan to adopt composite alerting techniques and what we’ve been calling the “funnel model” for detection in Google SecOps. Could you share what that means and how your team is adopting?
There are a lot of moving parts in a D&R journey from a process and tooling perspective, how did you structure your plan and why?
It wouldn’t be our show in 2025 if I didn’t ask at least one AI question! What lessons do you have for other security leaders preparing their teams for the AI in SOC transition?
Agentic AI and AI agents, with its promise of autonomous decision-making and learning capabilities, presents a unique set of risks across various domains. What are some of the key areas of concern for you?
What frameworks are most relevant to the deployment of agentic AI, and where are the potential gaps?
What are you seeing in terms of how regulatory frameworks may need to be adapted to address the unique challenges posed by agentic AI?
How about legal aspects - does traditional tort law or product liability apply?
How does the autonomous nature of agentic AI challenge established legal concepts of liability and responsibility?
The other related topic is knowing what agents “think” on the inside. So what are the key legal considerations for managing transparency and explainability in agentic AI decision-making?
Why do so many organizations still collect logs yet don’t detect threats? In other words, why is our industry spending more money than ever on SIEM tooling and still not “winning” against Tier 1 ... or even Tier 5 adversaries?
What are the hardest parts about getting the right context into a SOC analyst’s face when they’re triaging and investigating an alert? Is it integration? SOAR playbook development? Data enrichment? All of the above?
What are the organizational problems that keep organizations from getting the full benefit of the security operations tools they’re buying?
Top SIEM mistakes? Is it trying to migrate too fast? Is it accepting a too slow migration? In other words, where are expectations tyrannical for customers? Have they changed much since 2015?
Do you expect people to write their own detections? Detecting engineering seems popular with elite clients and nobody else, what can we do?
Do you think AI will change how we SOC (Tim: “SOC” is not a verb?) in the next 1- 3 -5 years?
Do you think that AI SOC tech is repeating the mistakes SOAR vendors made 10 years ago? Are we making the same mistakes all over again? Are we making new mistakes?
Could you share insights into how Product Security Engineering approaches at Google have evolved, particularly in response to emerging threats (like Log4j in 2021)?
You mentioned applying SRE best practices in detection and response, and overall in securing the Google Cloud products. How does Google balance high reliability and operational excellence with the needs of detection and response (D&R)?
How does Google decide which data sources and tools are most critical for effective D&R?
You have had a fascinating career since we [Tim] graduated from college together – you mentioned before we met that you’ve consulted with a literal world leader on his personal digital security footprint. Maybe tell us how you got into this field of helping organizations treat sensitive information securely and how that led to helping keep targeted individuals secure?
You also work as a privacy engineer on Fuschia, Google’s new operating system kernel. How did you go from human rights and privacy to that?
What are the key privacy considerations when designing an operating system for “ambient computing”? How do you design privacy into something like that?
More importantly, not only “how do you do it”, but how do you convince people that you did do it?
When we talk about "higher risk" individuals, the definition can be broad. How can an average person or someone working in a seemingly less sensitive role better assess if they might be a higher-risk target? What are the subtle indicators?
Thinking about the advice you give for personal security beyond passwords and multi-factor auth, how much of effective personal digital hygiene comes down to behavioral changes versus purely technical solutions?
Given your deep understanding of both individual security needs and large-scale OS design, what's one thing you wish developers building cloud services or applications would fundamentally prioritize about user privacy?
Detection as code is one of those meme phrases I hear a lot, but I’m not sure everyone means the same thing when they say it. Could you tell us what you mean by it, and what upside it has for organizations in your model of it?
What gets better for security teams and security outcomes when you start managing in a DAC world? What is primary, actual code or using SWE-style process for detection work?
Not every SIEM has a good set of APIs for this, right? What’s a team to do in a world of no or low API support for this model?
If we’re talking about as-code models, one of the important parts of regular software development is testing. How should teams think about testing their detection corpus? Where do we even start? Smoke tests? Unit tests?
You talk about a rule schema–you might also think of it in code terms as a standard interface on the detection objects–how should organizations think about standardizing this, and why should they?
If we’re into a world of detection rules as code and detections as code, can we also think about alert handling via code? This is like SOAR but with more of a software engineering approach, right?
One more thing that stood out to me in your presentation was the call for sharing detection content. Is this between vendors, vendors and end users?
Your RSA talk highlights lessons learned from two years of AI red teaming at Google. Could you share one or two of the most surprising or counterintuitive findings you encountered during this process?
What are some of the key differences or unique challenges you've observed when testing AI-powered applications compared to traditional software systems?
Can you provide an example of a specific TTP that has proven effective against AI systems and discuss the implications for security teams looking to detect it?
What practical advice would you give to organizations that are starting to incorporate AI red teaming into their security development lifecycle?
What are some initial steps or resources you would recommend they explore to deepen their understanding of this evolving field?
