Tech Updates

Zero trust is the best-selling security idea nobody actually owns. Adoption is near-universal in name. Maturity is a rounding error. What you'll hear: • What it actually is — NIST 800-207: assume breach, verify explicitly, least privilege, continuous verification • The execution gap — <1% mature in 2023, ~10% projected for 2026, while 63% claim adoption • What it stops and what walks around it...

Remember Dave's service account from 2017? It's still there — and now it has 108 friends. 79 of them are AI agents nobody owns. What you'll hear: • The ratio grew — 45:1 became 80:1, 109:1, up to 144:1 in cloud-native shops (and why the spread is the story) • The scariest stat — 64% of secrets leaked in 2022 were STILL live in January 2026 • 28.65M new secrets on public GitHub last year; AI coding...

Machines outnumber humans in the cloud 25-to-1. Somebody has to secure that army. Special Series role #5: the Cloud Security Engineer. What you'll hear: • What the job actually is — posture management, IAM least-privilege, pipeline security, cloud detection • The money — $85–125K entry, $166K mid, $201K senior, $300K+ staff at big tech; AWS Security Specialty averages $203K • The catch — Gartner:...

Attackers hand off your network in 22 seconds. Your tier-1 analyst is still opening the ticket. That's the whole argument for the agentic SOC — and why it terrifies people. What you'll hear: • The '92%' trap — three vendors, three different metrics wearing the same number • What's actually shipping — Cisco/Splunk's six agents, CrowdStrike, Microsoft, and the AI-SOC startups • The reality check — ~...

Two-thirds of web traffic is already post-quantum encrypted. Your browser did it without telling you. The migration got real. What you'll hear: • Your browser already switched — hybrid ML-KEM in Chrome/Edge/Firefox TLS by default • Our June predictions, graded — Cisco's full-stack PQC shipped; SD-WAN + hardware accel rolling out; Quantum Ready Assessments live • The whole ecosystem shipped — Apple...

Three weeks ago we told you what to watch at Hacker Summer Camp. Now it's over — and one attack sums up the whole week: Ghostjacking hijacked an AI coding agent 90% of the time using nothing but log files. Here's what actually mattered at Black Hat and DEF CON 2026 — graded against our own predictions. What you'll hear: • Our prediction scorecard — AI security dominated (1 in 3 Black Hat talks), M...

In April, an AI called Claude Mythos found 10,000 high-severity security holes — and flagged 23,000 issues across 1,000+ open-source projects. The punchline nobody's ready for: most still aren't patched. Finding bugs got automated. Fixing them didn't. This is your guide to Hacker Summer Camp 2026 — Black Hat, BSides, and DEF CON — what to watch, what to skip, and the AI reckoning underneath all of...

Last year, ransomware crews launched ~50% more attacks — and made ~8% less money. The lock stopped paying, so they stopped using it. In 2026, 94% of ransomware cases involve stealing your data, and only 68% even bother to encrypt it. Welcome to the exfiltration era, where your backups don't save you. What you'll hear: • The shift to encryptionless extortion — steal and threaten to leak, instead of...

Wi-Fi 7 promises 46 gigabits per second. Your access point is plugged into a 1-gig switch port. Guess which number wins. The radio is real and genuinely good — the rest needs a closer look. Let's separate the upgrade from the hype. What you'll hear: • The big three — Multi-Link Operation (MLO), 320 MHz channels, 4K-QAM — and why MLO is the only truly new idea • The latency truth — 46 Gbps is a lab...

In June 2026, researchers took over AI coding agents — Claude Code, Cursor, Codex — with no phishing, no malware, and a public credential developers paste into their own apps. It worked 85% of the time. The vendor's response? "Technically not defensible. We're not fixing it." Welcome to the new attack surface nobody secured. What you'll hear: • What MCP (Model Context Protocol) is — "USB-C for AI"...

Every breach in our last episode died the same way it started — with a password. So this week: the fix that's finally winning. On World Passkey Day this May, the FIDO Alliance counted 5 billion passkeys in use. The password isn't dead yet — but we finally have the thing that kills it. What you'll hear: • How a passkey works — public/private keypair, private key never leaves your device, origin-bou...

Six months into 2026 and the breach scoreboard is brutal: 22 million Aflac records, 30 million students locked out during finals, the FBI's own surveillance system breached, four banks knocked offline in an afternoon. But almost none of it was clever. No genius zero-days. Just a phone call, a stolen token, and an open door. This is the 2026 Breach Hall of Shame — we name names, correct the hype, a...

Right now, somewhere, an adversary is copying your encrypted VPN traffic. They can't read it today. They're saving it — for the day a quantum computer can crack it open. It's called "harvest now, decrypt later," and in 2026 it stopped being a thought experiment. This episode breaks down the post-quantum migration for people who actually run networks. What you'll hear: • The three NIST post-quantum...

450%. That's how much more network traffic an AI agent generates than a human doing the same task. Cisco measured it, put it on the big screen at Cisco Live 2026, and then rebuilt its entire company around it. Last week in Las Vegas, Cisco made its biggest platform bet in two decades: every product — Catalyst, Meraki, Nexus, security, collaboration, Splunk — managed from one place, Cisco Cloud Con...

45 to 1. In the average enterprise, for every human user there are 45 machine identities. Every API key. Every service account. Every agent token. Every secret in every config file. Your IAM platform probably tracks about 2% of them. That's where the breaches are coming from now — Snowflake, GitHub PATs, Azure IMDS. This episode unpacks the NHI crisis, the vendor landscape, and the three control p...

$140K. When you mess up, the lights go out for real. Final episode of TechUpdates Special Series. The most consequential security job almost nobody talks about — defending the systems that keep the country running. Power grids. Water utilities. Petrochemical plants. Pipelines. What you'll hear: • What OT/ICS defenders actually do — segmentation, SCADA patching, PLC defense, plant-engineer coordina...

In late 2024, Verizon, AT&T, and T-Mobile all admitted the same thing: their lawful-intercept systems — the ones they build for law enforcement — had been compromised by a Chinese state actor called Salt Typhoon. Years of dwell time. Wiretap infrastructure for politicians, including a presidential campaign. Sixteen months later, what have we actually fixed? Plus — why Volt Typhoon is the warni...

$450K. The job didn't exist 24 months ago. Every Fortune 500 is hiring. Episode three of TechUpdates Special Series. AI bug bounties have crossed six figures for a single prompt injection. Frontier labs run model evaluation contests with prize pools in the hundreds of thousands. Two years ago the title "AI Security Engineer" was on zero org charts. Today it's on most of them. What you'll hear: • W...

In 2024, Microsoft signed a 20-year power purchase agreement to restart Three Mile Island. The nuclear plant. The one from the disaster. In 2025, Amazon bought a small modular reactor. In 2026, Meta locked up 20 years of natural gas at a cost nobody will put on record. We are watching hyperscalers become utilities. This episode covers the numbers, the deals, the grid bottleneck, the green accounti...

$240K. No degree required. The SOC analyst is dead. Episode two of TechUpdates Special Series. The SOC industry quietly restructured itself in the last 18 months — tier-one analyst headcount shrinking, SIEM vendors pivoting their pitch — and one role pulled away with software-engineer-grade compensation. The Detection Engineer. What you'll hear: • What detection engineers actually do (write detect...

In February, a maintainer of a widely-used npm package pushed a release that shipped malware to 47,000 downstream applications. The maintainer's GitHub account had been compromised four months earlier. Nobody noticed. It happened again in March. Again in early April. This episode is the supply chain security story the vendors aren't telling you correctly. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📚 WHAT Y...

$1.4M comp. SEC subpoena. Same job. Welcome to TechUpdates Special Series — four episodes on the cybersecurity roles people actually want to hear about. We start with the only C-suite job in tech where doing it right can still get you indicted: the CISO. What you'll hear: • What a CISO actually does (and what they delegate) • The real comp ladder — Series B startup $250K → Fortune 500 $800K → big...

"SaaS is dead." Satya Nadella said it on All-In in late 2024. Everyone laughed. Eighteen months later, Klarna went on the record — they fired Salesforce, fired Workday, and replaced them with Python scripts wired to Claude. ~$40M in annual SaaS spend. Gone. This episode breaks down what's actually happening to enterprise software, which layer is getting compressed, which layer is getting bigger, a...

In 2022, the median time between initial access and the secondary threat hand-off was 8 hours. At RSAC 2026, Mandiant put the new number on the main stage: 22 seconds. That one stat explains everything that got announced in San Francisco this year. This episode of Tech Updates is a full RSAC 2026 recap — the product flood, the agentic AI pivot, and the six predictions every CISO and senior enginee...

Malware isn't just "a virus." It's a whole ecosystem of tools designed to damage, steal, spy, and extort — and in 2026 it's more dangerous than ever. This episode is your complete field guide. WHAT IS MALWARE? Malware (malicious software) is any program intentionally designed to harm a system, steal data, or gain unauthorized access. It's not accidental — it's engineered. THE 5 MAJOR TYPES Viruses...