SECURITY.COM The Podcast

The channel isn't dying. The traditional reseller model is. Alan Maxwell, who leads Broadcom's Catalyst partner business internationally, puts the number on it: fewer than 15–20% of partner sales engineers could pass an unscripted, hands-on XDR architecture exam today, and the partners winning right now are the ones who stopped selling licenses and started selling outcomes.Alan just wrapped a six-part series on SECURITY.COM called The Resilient Channel. This conversation pulls it together for the VARs, MSSPs, distributors and integrators who sit between the vendor and the SOC: which structural force partners are underestimating most (regulation and cyber insurance, not AI), what separates a services-led partner from one with services language bolted on (revenue mix, hiring, comp plans), a 24-month plan to flip from 80% resale to 50/50, why MDF reform is finally real, a one-question test for whether a vendor's "agentic SOC" is agentic at all, and the liability gray area nobody in the industry has solved: when an autonomous agent knocks production offline, who holds the bag?Chapters00:00 – Who this episode is for: a 4-minute primer on the channel05:10 – Three things vendors and customers get wrong about partners06:44 – The partner's new burden: regulation, insurance, AI-speed threats11:38 – Architecting for margin: real services partners vs. fake ones17:23 – Technical enablement: why most SEs can't pass an unscripted exam22:38 – MDF reform, co-marketing that converts, compliance as an edge28:59 – Agentic AI claims, marketing math, and the liability gray area34:57 – One thing every partner CEO should do next quarterRead the seriesThe Resilient Channel, Part 1: https://www.security.com/expert-perspectives/resilient-channel-series-part-1Part 2: https://www.security.com/expert-perspectives/resilient-channel-series-part-2Part 3: https://www.security.com/expert-perspectives/resilient-channel-series-part-3Part 4: https://www.security.com/blog-post/resilient-channel-series-part-4Part 5: https://www.security.com/blog-post/resilient-channel-series-part-5Part 6: https://www.security.com/expert-perspectives/resilient-channel-series-part-6

Symantec Threat Hunters found malware that turns a legitimate document-security platform into its own exfiltration channel. Infostealer.Speagle hijacks Cobra DocGuard to chase Chinese ballistic missile documents — then uses the platform's own driver to delete itself. A look at the Runningcrab activity cluster. Listen in.

SIEM was supposed to be the nerve center of every security operation — collect every log, correlate every event, surface every threat. Most organizations ended up with an expensive log warehouse that generates more noise than signal.Recorded live from RSAC, Dan sits down with Justin Falck — Head of Product for Endpoint at the Enterprise Security Group at Broadcom — to break down where the SIEM model broke, why "magic correlation" never showed up, and what's actually replacing it in modern security operations.In this episode:The original promise of SIEM and where the math fell apartHow detection engineering became a budget black holeWhy XDR and MDR are reshaping the SOC"Owning the blades" — vendor-native correlation vs. data-lake aggregationWhere SIEM still works (and the team sizes it takes)A look at CBX, Carbon Black's XDR launch from RSACMore at security.com. Subscribe, rate, and share with your fellow defenders.Stay sharp, stay curious, stay human.

The Evolution of Cybersecurity Media & PR — with Tony Welz, W2 CommunicationsCybersecurity went from a niche trade-press beat to a nation-state strategy domain in about 25 years. Dan Mellinger sits down with Tony Welz, co-founder of W2 Communications — a strategic communications agency that's specialized in cybersecurity for 23 years — to unpack how the story got told along the way, and who's telling it now.Tony's been in the room for nearly every inflection point: working with Sourcefire from their A-round through their Cisco acquisition, watching FireEye seed the modern threat-research content model, navigating the Target/Sony/Ashley Madison breach era, and helping clients adapt to today's SEC disclosure rules and geopolitical cyber reality.

Iran has always been active in cyberspace — but with U.S. and Israeli kinetic operations underway in March 2026, they're under pressure to make an impact, and cyber is where they can fight asymmetrically. Dan Mellinger and Symantec threat intelligence veteran Dick O'Brien break down what defenders are actually seeing right now: active intrusions on 5–6 organizations in the U.S. and Canada, the recent Stryker attack that weaponized Microsoft Intune instead of malware, and why Iranian operators are rapidly absorbing Russian cloud-attack tradecraft. Plus: why Iran is effectively the #2 most prevalent nation-state adversary, the surprisingly effective social engineering campaigns they're running, the little-known Iranian origins of modern ransomware, and the practical steps every U.S.-facing organization should take this week.More analysis at security.com.