Guest:

• Monzy Merza, co-founder and CEO at Crogl

Topics:

• We often hear about the aspirational idea of an "IronMan suit" for the SOC—a system that empowers analysts to be faster and more effective. What does this ideal future of security operations look like from your perspective, and what are the primary obstacles preventing SOCs from achieving it today?
• You've also raised a metaphor of AI in the SOC as a "Dr. Jekyll and Mr. Hyde" situation. Could you walk us through what you see as the "Jekyll"—the noble, beneficial promise of AI—and what are the factors that can turn it into the dangerous "Mr. Hyde"?
• Let's drill down into the heart of the "Mr. Hyde" problem: the data. Many believe that AI can fix a team's messy data, but you've noted that "it's all about the data, duh." What's the story?
• "AI ready SOC" - What is the foundational work a SOC needs to do to ensure their data is AI-ready, and what happens when they skip this step?
• And is there anything we can do to use AI to help with this foundational problem?
• How do we measure progress towards AI SOC? What gets better at what time? How would we know?
• What SOC metrics will show improvement? Will anything get worse?

Resources:

• EP242 The AI SOC: Is This The Automation We've Been Waiting For?
• EP170 Redefining Security Operations: Practical Applications of GenAI in the SOC
• EP227 AI-Native MDR: Betting on the Future of Security Operations?
• EP236 Accelerated SIEM Journey: A SOC Leader's Playbook for Modernization and AI
• EP238 Google Lessons for Using AI Agents for Securing Our Enterprise
• "Simple to Ask: Is Your SOC AI Ready? Not Simple to Answer!" blog
• Nassim Taleb "Antifragile" book
• "AI Superpowers" book
• "Attention Is All You Need" paper

Guest:

• Jibran Ilyas, Director for Incident Response at Google Cloud

Topics:

• What is this tabletop thing, please tell us about running a good security incident tabletop?
• Why are tabletops for incident response preparedness so amazingly effective yet rarely done well?
• This is cheap/easy/useful so why do so many fail to do it? Why are tabletops seen as kind of like elite pursuit?
• What's your favorite Cloud-centric scenario for tabletop exercises? Ransomware? But there is little ransomware in the cloud, no?
• What are other good cloud tabletop scenarios?

Resources:

• EP60 Impersonating Service Accounts in GCP and Beyond: Cloud Security Is About IAM?
• EP179 Teamwork Under Stress: Expedition Behavior in Cybersecurity Incident Response
• EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends
• EP177 Cloud Incident Confessions: Top 5 Mistakes Leading to Breaches from Mandiant
• EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics
• EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?

Guest:

• David Gee, Board Risk Advisor, Non-Executive Director & Author, former CISO

Topics:

• Drawing from the "Aspiring CIO and CISO" book's focus on continuous improvement, how have you seen the necessary skills, knowledge, experience, and behaviors for a CISO evolve, especially when guiding an organization through a transformation?
• Could you share lessons learned about leadership and organizational resilience during such a critical period, and how does that experience reshape your approach to future transformations?
• Many organizations are undergoing transformations, often heavily involving cloud technologies. From your perspective, what is the most crucial—and perhaps often overlooked—role a CISO plays in ensuring security is an enabler, not a roadblock, during such large-scale changes?
• Have you ever seen a CISO who is a cloud champion for the organization?
• Your best advice for a CISO meeting cloud for the first time?
• What is your best advice for a CISO meeting AI for the first time?
• How do you balance the continuous self-improvement and development with the day-to-day pressures and responsibilities?

Resources:

• "A Day in the Life of a CISO: Personal Mentorship from 24+ Battle-Tested CISOs — Mentoring We Never Got" book
• "The Aspiring CIO and CISO: A career guide to developing leadership skills, knowledge, experience, and behavior" book
• EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff
• EP101 Cloud Threat Detection Lessons from a CISO
• EP104 CISO Walks Into the Cloud: And The Magic Starts to Happen!
• EP129 How CISO Cloud Dreams and Realities Collide
• All CISO podcast episodes
• "Shadow Agents: A New Era of Shadow AI Risk in the Enterprise" blog
• "Blocking shadow agents won't work. Here's a more secure way forward" blog