Security Intelligence Podcast

Read Itzhak Chimino’s research on UnregStealer → https://www.ibm.com/think/news/unregstealer-human-operated-browser-credential-theft-targeting-brazilian-banking When it comes to Fable 5, Mythos 5, and GPT-5.6 Sol, the real story is in the safeguards. Last week, Anthropic and OpenAI both rolled out some powerful new models. And for perhaps the first time, the protections surrounding these models go...

Learn more about Q-Day → https://www.ibm.com/think/news/q-day-has-already-begun-are-you-ready On June 22, US President Donald Trump signed a pair of executive orders for the quantum computing, and post-quantum future. On this episode, Mason Molesky breaks down the post-quantum EOs: “Securing the Nation Against Advanced Cryptographic Attack,” which establishes a government‑wide mandate to accelerat...

Patch management, as most organizations practice it, is fundamentally broken. It treats what should be a strategic, risk-informed decision as a checkbox item. And checkboxes don't get done. The fix isn't better patching. It's exposure management: a risk-based approach that connects your vulnerabilities to your business context, your attack surface and the real-world threat landscape. In this episo...

Read more about IBM joining OpenAI Daybreak → https://newsroom.ibm.com/2026-06-22-ibm-and-openai-bring-frontier-ai-to-cyber-defense-helping-enterprises-keep-pace-with-machine-speed-threats Social engineering has plagued human beings since time immemorial. We’ve simply never been able to stop it. Until now. Maybe. On this episode of Security Intelligence, panelists Dave Bales, Kimmie Farrington and...

Apple unveiled an AI agent that can detect if your password’s been compromised and change it for you. The question is: Should you let it? On this episode of Security Intelligence, Michelle Alvarez, Erblind Morina and Austin Zeizel join host Matt Kosinski to discuss the promise and pitfalls of using AI agents to address the pernicious issue of cybersecurity hygiene. As people, we’re not great at it...

If you just ask an AI nicely enough, you can get it to hand over the keys to a total stranger’s Instagram account. But people can be tricked, too. So what’s the difference? Is there any? This week on IBM’s Security Intelligence, Jeff Crume, Claire Nunez and Nick Bradley join host Matt Kosinski to dig into what happens when social engineering meets AI. We cover the Meta/Instagram prompt injection a...

Open source software powers more than 90% of Fortune 500 companies. It also powers a growing number of cyberattacks. This week on Security Intelligence, we dig into IBM and Red Hat's $5 billion answer to that problem: Project Lightwell, a massive investment in AI-augmented engineers and a trusted security clearinghouse designed to shore up the open source ecosystem from the inside out. We also bre...

Today, the average enterprise network is like one big game of Telephone: Critical data flows between apps and assets, software systems and their subcomponents, on-prem laptops and cloud storage buckets. Every single gap between the pieces—every single transaction—is a possible vulnerability, a chance to hackers to get in or data to get scrambled. And the introduction of multiple AI models is only...

While Anthropic has restricted Mythos access to its Project Glasswing partners, it has always maintained that lessons from Glasswing would be shared with the broader cybersecurity community. Now, those lessons are starting to roll out. This week, on Security Intelligence, panelists Dustin “EvilMog” Heywood, Kimmie Farrington and Curtis Pitts discuss Cloudflare’s recent write-up on its adventures w...

Between OpenAI Daybreak, Microsoft MDASH and Mistral’s Mythos competitor, it’s been a big week for AI-powered vulnerability management. But are these tools all they’re cracked up to be? This week on Security Intelligence, Nick Bradley, Diego Matos Martins and Nikki Robinson discuss three bold moves in the AI vulnerability scanner space: OpenAI unveiled Daybreak, its frontier AI for cyber defense p...

AI tools can turn a team of three developers into a fully functioning company. They can also push that company to the brink of bankruptcy. On this week’s Security Intelligence, we talk LLMjacking: Hackers steal your AI API keys and then rack up massive bills, even blowing past usage caps in some cases. One small startup saw its typical bill balloon from $180 a month to $82,000 in two days. We chat...

Between Mythos, GPT-5.4-Cyber, Claude Security’s public beta and OpenAI’s new five-point plan for cyber defense, it seems like cybersecurity is top of mind for the major AI players today. Why—and why now? On this week’s episode of IBM Security Intelligence, Dustin “EvilMog” Heywood, Omari Jones and Kimmie Farrington discuss what CrowdStrike has called “cybersecurity’s Y2K moment.” As the major AI...

Is open source good? Bad? Some secret third thing? Is this a silly question to even ask? In this special crossover episode of Security Intelligence and Mixture of Experts, we bring together AI and security experts to address one of the thorniest questions in tech right now: How do you enjoy the unique benefits of open source AI while managing its very real risks? MoE stalwarts Gabe Goodhart and Ma...

We’ve all heard tales of what lurks on the dark web. Black markets dealing in contraband. Roving criminal gangs. Troves and troves of private data for sale. Much, much worse. Thankfully, most of it’s fake. The real trouble is figuring out what isn’t. In this episode of Security Intelligence, Senior Threat Intelligence Analyst Robert Gates helps us untangle the web of lies that cybercriminals spin...

Learn more about how enterprises confront agentic attacks → https://newsroom.ibm.com/2026-04-15-ibm-announces-new-cybersecurity-measures-to-help-enterprises-confront-agentic-attacks Sophos let OpenClaw run wild on its network (sort of). It wasn’t as bad an idea as it sounds! With a few guardrails and restrictions in place, the security software firm turned OpenClaw into a serious little pen tester...

Earlier this week, OpenAI dropped GPT-5.4-Cyber, a “cyber-permissive” variant of GPT-5.4 . Basically: It's lets you do some things in the name of security research and defense that you can’t normally do with a regular GPT model. But you have to prove you’re a cybersecurity pro with good intentions to get access. On this bonus episode of Security Intelligence, Jeff Crume and Martin Keen join host M...

Anthropic says its newest AI model, Claude Mythos, has found thousands of zero-day vulnerabilities across every major OS and web browser. It's so powerful, they won't release it publicly. Instead, they’re restricting access to a handful of trusted partners, who get to experiment with Mythos through a new initiative called Project Glasswing. Where does that leave the rest of us, who don’t get to ti...

What happens when one of the world’s most popular AI coding tools falls into the wrong hands? On this episode of Security Intelligence, Nick Bradley, Dave Bales and JR Rao discuss the Claude Code source code leak. Attackers are already using the opportunity to spread malware through fake repos, but the real question is how threat actors might use their newfound knowledge of Claude Code’s internals...

LiteLLM is a nifty little Python library that gives you access to about 100 different AI services through one API. It gets an estimated 3.4 million downloads a day. And last week, it was turned into a Trojan horse, distributing infostealers to hundreds of thousands of devices. (At least, that’s what TeamPCP says—the hackers behind the LiteLLM breach and a slew of other high-profile software supply...

Most cybersecurity pros only run into cryptocurrency when they’re dealing with ransomware gangs demanding payouts in Bitcoin. But what if crypto infrastructure were more than just a means of money laundering? In this episode of IBM’s Security Intelligence podcast, X-Force threat intelligence consultant Austin Zeizel makes the case that blockchain — the decentralized ledger underlying many cryptocu...

Follow the Security Intelligence podcast on your preferred platform → https://www.ibm.com/think/podcasts/security-intelligence Someone finally cracked the Xbox One after 13 years. Here’s why security pros should care. On this episode of Security Intelligence, panelists Ian Molloy, Seth Glasgow and Kimmie Farrington discuss the Xbox One hack presented at RE//verse 2026. More than just a neat story...

When agentic browsers like Perplexity Comet share their reasoning, they give cybercriminals valuable information. Plus: 40-year-old code liabilities, the failure of shift lift, and new X-Force research. Read more about “Slopoly” → https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks

Follow the Security Intelligence podcast on your preferred platform → https://www.ibm.com/think/podcasts/security-intelligence Did you miss out on the [un]prompted AI security conference? So did most of us. Except our very own Dustin “Evil Mog” Heywood, who joins us today to share highlights from the event. And speaking of [un]prompted, we also discuss one of the biggest announcements to come out...

Can IAM handle AI? Find out → https://www.ibm.com/think/podcasts/security-intelligence A consumer just wanted to control his own personal robot vacuum with a PlayStation controller. He ended up controlling thousands of strangers’ vacuums, too. This week on Security Intelligence, we cover one of the wildest IoT security stories in recent memory: How one user accidentally built an army of 6,700 robo...

AI agents are coming to the enterprise—but can we actually control them? On this bonus episode of Security Intelligence, IBM Fellow and CTO IBM Security Sridhar Muppidi helps us dig into the rise of agentic AI security risks, from generative AI systems with backend access to autonomous agents that can schedule meetings, call APIs and automate workflows — often with highly privileged access. Tradit...