The TPRM Podcast

AI agents are getting access to enterprise systems faster than organizations can secure them. Many are running with the same credentials and permissions as the humans who created them. What happens when those agents make mistakes, get manipulated, or act outside their intended purpose? In Episode 21 of *Threats, Pitfalls & Risk Myths*, Nate Lee sits down with Matt Chiodi, former CISO and advisor at Cerby, to explore the growing security challenges of autonomous AI agents, non-human identities, and excessive permissions. Matt explains why organizations are repeating security mistakes from the early cloud era, why prompts aren't reliable security controls, and what least privilege looks like when you can't predict an AI agent's next move. They also discuss why AI may be necessary to oversee other AI systems, how security leaders can demonstrate measurable business value, and why third-party risk management needs to focus on operational impact rather than contract value. **In This Episode:** - Why AI agents shouldn't inherit human credentials and permissions- The risks of overprivileged AI agents- Why prompts aren't security boundaries- Least privilege and identity management for autonomous agents- Threat modeling, red teaming, and testing agent behavior- Why AI may need to monitor other AI systems- How CISOs can think like capital allocators- Why vendor criticality matters more than contract value- Security lessons organizations are repeating from the early cloud era **About the Guest** Matt Chiodi is a cybersecurity executive, former CISO, and advisor at Cerby, an identity security company focused on applications that traditional single sign-on systems cannot manage. Previously, Matt held security leadership responsibilities at Palo Alto Networks, including oversight of cloud security and the Unit 42 threat research organization. His experience spans enterprise security, identity management, cloud security, and emerging AI risks. **Your Host** Nate Lee is a B2B scaleup CISO and Founder of Cloudsec.ai and TrustMind/Evident AI. He works with SaaS companies to build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth. **About TPRM Podcast** *Threats, Pitfalls & Risk Myths* is hosted by Nate Lee and features candid conversations with cybersecurity leaders about the threats, decisions, and challenges shaping modern security programs. Subscribe for new episodes and practical perspectives on cybersecurity, third-party risk, AI, and security leadership. Website: https://www.tprmpodcast.com/ #Cybersecurity #AgenticAI #AISecurity

What if some of the things we call “security best practices” aren't actually reducing risk? Sean Cassidy, CISO at Plaid, joins Nate Lee to challenge some of the assumptions security teams have built their programs around. They dig into third-party risk management, phishing, AI, security automation, threat modeling and what happens when security processes create more friction than protection. Sean makes the case for a different approach: understand the actual risk, explain why a control matters, prepare for vendors to get breached, and use AI where it can genuinely make security teams better. They also get into where AI is already working inside security teams, why AI may be particularly good at repetitive judgment calls, the idea of an automated “security factory,” and the emerging possibility of persistent autonomous AI threat actors. In this episode: • Why Sean hates the phrase “security best practice”• Why more TPRM rigor doesn't necessarily mean less risk• What security teams should prepare for when a vendor gets breached• Why users shouldn't be your primary defense against phishing• How Plaid is using AI for security workflows• Why AI could finally help understaffed security teams scale• Where AI security reviews still fall short• Why threat modeling and security charters matter• The coming problem of autonomous AI threat actors Sean Cassidy is Chief Information Security Officer at Plaid and previously served as Head of Security at Asana. He was also co-founder and CTO of DefenseStorm. Watch the Full Episode *YouTube* / @tprmpodcast*Spotify*https://open.spotify.com/show/7JvPsyM...*Apple Podcasts*https://podcasts.apple.com/us/podcast...---About the Guest Sean Cassidy is Chief Information Security Officer at Plaid. His career spans software engineering, security entrepreneurship, and security leadership, including roles at Cisco and Limelight Networks. He co-founded DefenseStorm, where he served as CTO and helped build an early cloud-based security platform for banks and credit unions. His work there eventually led him from the vendor side of cybersecurity into security leadership and CISO roles. At Plaid, Sean focuses on building security programs around actual risk rather than process for process's sake. He is also exploring how AI and automation can help security teams scale, from phishing triage and vendor risk analysis to application security and the emerging challenge of autonomous AI threat actors.---About the Host Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.---About the Show The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators who are reshaping the future of cybersecurity. Each episode goes beyond headlines to explore the threats, pitfalls, and risk myths behind modern security programs, AI, software development, governance, and business resilience, helping leaders navigate technology with greater confidence.

AI is accelerating cyberattacks to machine speed. But most security programs were built for a world where attackers moved at human speed. What happens when an attacker can move through an environment in seconds, security alerts keep multiplying, and hiring more analysts is no longer enough? In this episode of the **TPRM Podcast, Threats, Pitfalls & Risk Myths**, Nate Lee sits down with **Mandy Andras, Chief Information Security Officer at Elastic**, to explore how artificial intelligence is changing the economics, operations, and strategy of cybersecurity. Together, they examine how AI is accelerating existing attack techniques, why traditional security programs struggle to operate at machine speed, and how security leaders can redesign their approach to risk, detection, and response. Mandy shares how Elastic is applying AI and agentic workflows to its security operations, including an experiment in which a multi-agent approach to automated alert triage proved five times less expensive than a single-agent approach. But efficiency is only part of the equation. As organizations adopt AI, security teams must balance detection quality, token consumption, operational costs, and human judgment. Mandy explains why adding more people won't solve the growing volume of security alerts and why the next generation of security programs will need to rethink how they allocate resources. The conversation also explores how attackers are using AI to accelerate lateral movement, why traditional approaches to prevention need to evolve, and how security leaders can communicate risk in ways that resonate with business executives. **The conversation covers:** • Why AI is accelerating cyberattacks to machine speed • How attackers can use AI agents to accelerate lateral movement after gaining access • Why hiring more security analysts won't solve the growing volume of alerts • How Elastic reduced automated alert triage costs by 5X using a multi-agent approach • The economics of AI security, including token costs, detection quality, and operational efficiency • Why prevention, least privilege, and limiting the blast radius matter in an AI-driven environment • How red team exercises help organizations identify and prioritize real business risks • The changing role of human judgment in security operations • Why curiosity, critical thinking, and adaptability remain essential cybersecurity skills • How AI could transform governance, risk, compliance, and continuous risk assessment Mandy also shares how Elastic has experienced a more than 100-fold increase in bug bounty submissions over approximately nine to ten months, illustrating the scale of the operational challenges security teams are beginning to face. Drawing on her background in accounting, technology, auditing, and law, she offers a business-focused perspective on building security programs that can adapt to rapidly changing technology without losing sight of cost, effectiveness, and organizational priorities. Whether you're a CISO, security engineer, SOC analyst, technology executive, or business leader navigating AI adoption, this conversation offers practical insights into how security programs can evolve to meet the challenges of an increasingly automated world. --- ## Watch the Full Episode **YouTube** https://www.youtube.com/@TPRMPodcast **Spotify** https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=21e30095e8d94cf4 **Apple Podcasts** https://podcasts.apple.com/us/podcast/the-tprm-podcast --- ## About the Guest Mandy Andras is Chief Information Security Officer at Elastic. Her career spans accounting, systems auditing, security consulting, architecture, and enterprise security leadership. She also holds a law degree, bringing a multidisciplinary perspective to cybersecurity, risk management, governance, and regulatory requirements. At Elastic, she leads security efforts in an environment where AI and agentic technologies are reshaping both the threats organizations face and the tools available to defend against them. --- ## About the Host Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth. --- ## About the Show The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators who are reshaping the future of cybersecurity. Each episode goes beyond headlines to explore the threats, pitfalls, and risk myths behind modern security programs, AI, software development, governance, and business resilience, helping leaders navigate technology with greater confidence. --- #AI #CyberSecurity #Elastic #CISO #SecurityOperations #TPRMPodcast

AI isn't just changing how we write software. It's changing how organizations capture knowledge, how security teams operate, and how expertise itself is created, shared, and retained. But what happens when your experience becomes part of the AI systems you build? In this episode of the TPRM Podcast: Threats, Pitfalls & Risk Myths, Nate Lee sits down with Joe Sullivan, Chief Trust Officer at Corridor and former Chief Security Officer at Facebook, Uber, and Cloudflare, to explore one of the biggest shifts facing cybersecurity and every knowledge-based profession. Together they discuss how AI is reshaping security leadership, why organizations need to rethink vulnerability management, what trust means in an AI-first world, and how security professionals can prepare for a future where human expertise increasingly becomes part of intelligent systems. As AI agents become more capable, organizations aren't just automating tasks—they're beginning to codify institutional knowledge. That creates tremendous opportunities for innovation while raising new questions about ownership, privacy, resilience, and the future of work. Nate and Joe explore why the next generation of security leaders must think beyond prevention, how AI is changing the relationship between people and technology, and why adaptability may become the most valuable skill of all. The conversation covers: • Whether AI is capturing more than just our work—it may be capturing our expertise• How AI is transforming cybersecurity operations and security leadership• Why vulnerability management needs a fundamentally different approach• The future of AI agents inside the enterprise• Open source AI, transparency, and building trust in intelligent systems• Why adaptability may matter more than prevention in modern cybersecurity• How security leaders can embrace AI while managing real business risk• What the future of work looks like for security professionals, executives, and knowledge workers Joe also shares lessons from decades of experience leading security at Facebook, Uber, and Cloudflare, along with practical insights into how organizations can prepare for an AI-driven future. Whether you're leading security, building AI products, managing technology risk, or simply trying to understand how artificial intelligence is reshaping the workplace, this conversation offers practical insights into one of the most important technology shifts of our time. Watch the Full Episode YouTubehttps://youtube.com/@TPRMPodcast Spotifyhttps://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA Apple Podcastshttps://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699 About the Guest Joe Sullivan is Chief Trust Officer at Corridor and previously served as Chief Security Officer at Facebook, Uber, and Cloudflare. Before joining the technology industry, he was a federal prosecutor specializing in cybercrime. Throughout his career, he has helped shape modern cybersecurity practices while advising organizations on security, trust, governance, and the responsible adoption of emerging technologies. About the Host Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth. About the Show The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators who are reshaping the future of cybersecurity. Each episode goes beyond headlines to explore the threats, pitfalls, and risk myths behind modern security programs, AI, governance, software development, and business resilience, helping leaders navigate technology with greater confidence.

Most conversations about AI focus on one question: **Will AI replace jobs?** Alex Stamos thinks that's only part of the story. In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Alex Stamos, Chief Product Officer at Corridor, former Chief Security Officer at Facebook, former CISO of Yahoo, and founding director of the Stanford Internet Observatory. The conversation explores how AI is fundamentally changing software development, cybersecurity, and the future of work. As autonomous coding agents become more capable, organizations are entering a world where software can be written, reviewed, and deployed at unprecedented speed. That creates enormous opportunities, but it also introduces entirely new security challenges that many organizations are unprepared for. Nate and Alex discuss how AI is reshaping application security, why security teams can no longer rely on saying "no," and how organizations should rethink software development, vulnerability management, and business risk in an AI-first world. The conversation also explores: • Why AI will permanently change software engineering• How autonomous coding agents are transforming development• The future of application security and vulnerability discovery• Why security leaders must become business enablers• The growing gap between AI adoption and governance• Career advice for professionals navigating rapid technological change• The societal impact of AI and what happens if organizations move faster than people can adapt• Why resilience, not prevention, will define the next generation of cybersecurity Alex also shares lessons from leading security at Facebook, Yahoo, SentinelOne, and Stanford, along with practical advice for CISOs, engineers, founders, and technology leaders preparing for an AI-driven future. Whether you're leading security, building software, managing risk, or simply trying to understand how AI is changing work, this conversation offers thoughtful insights into where technology is headed and what leaders should do next. ## Listen & Subscribe Spotifyhttps://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA Apple Podcastshttps://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699 YouTubehttps://youtube.com/@TPRMPodcast ## About the Guest Alex Stamos is Chief Product Officer at Corridor and one of the cybersecurity industry's most respected leaders. Previously, he served as Chief Security Officer at Facebook, Chief Information Security Officer at Yahoo, founding director of the Stanford Internet Observatory, and CISO at SentinelOne. He has advised governments, taught cybersecurity at Stanford University, and spent decades helping shape modern security practices. ## About the Host Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth. ## About the Show The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators exploring the real-world challenges shaping cybersecurity today. Each episode goes beyond headlines to examine the threats, pitfalls, and risk myths behind modern security programs, AI, governance, and business resilience.