Cloud Security Podcast by Google

Two hosts reflect on five years of cloud security conversations and announce a hiatus. They cut through cloud and AI hype and revisit changing threat models from agentic identities. They swap career and parenting lessons, recommend books on reliability and accidents, and share final thanks and parting thoughts.

They talk about a Gemini AI uncovering a 13-year Chrome sandbox escape and how models can reason across complex systems. They explain pipelines that turn discoveries into verified fixes and faster twice-weekly security releases. Discussion covers dynamic patching to avoid restarts, memory-safety moves like Rust and spanification, and managing thousands of open-source dependencies.

Guest: Mike Armistead, CEO, Pulse Security AI Dan Lamorena, Chief Go-To-Market Officer, Pulse Security AI Topics: You've described Pulse as an 'operational management platform for cybersecurity leaders.' What does a security management platform look like in practice? How does Pulse bridge this 'translation layer' gap? How do you help a CISO transition from presenting patch rates and MTTD to discussing liability exposure and business capital allocation? What actually gets better when someone works with Pulse? Other than, of course, your ARR numbers for your next funding round? What is the single most surprising or alarming disconnect you've identified in your CISO and Board Engagement Survey? You've introduced the concept of the 'Minimum Viable Security Program (MV(S)P)' and emphasized that 'focus is power.' In an era of non-stop vendor noise, compliance updates, and emerging AI threats, how does Pulse help a CISO ruthlessly prioritize and execute their MV(S)P without getting distracted by the noise? Your company is officially 'Pulse Security AI,' so AI is central to your brand. To put on our healthy skeptic hats: how does Pulse pragmatically leverage AI to solve the CISO's actual day-to-day program management problems, rather than just adding to the marketing noise? Resources: Video EP114 Minimal Viable Secure Product (MVSP) - Is That a Thing? EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators "The Bomber Mafia: A Dream, a Temptation, and the Longest Night of the Second World War" by Malcolm Gladwell

ZeroDay Cloud: How a hacking competition exposed the reality of AI-augmented offensive security. The Power of Multi-Agent AI: Why a single model is not enough, and how specialized agents (Threat Modeling, Hunting, Triage, and Adversarial Debate) collaborate like a human team. GitHub RCE & CosmosDB Cross Tenant Access: A breakdown of the record-breaking bounty for the GitHub RCE report and the Azure CosmosDB master key vulnerability discovered by Atlas. Humans vs. AI: Whether vulnerability researchers are becoming "buggy whip manufacturers" or if human insight, instinct, and the smell of danger remain irreplaceable. https://www.wiz.io/blog/atlas-ai-vulnerability-researcher

Christoph Kern, Principal Security Engineer at Google who led efforts to eliminate whole classes of vulnerabilities. He explains replacing risky primitives with compiler-enforced safe abstractions. He traces a 15-year secure-by-design journey, the rise of memory-safe approaches like Rust, and how opinionated platforms boost security and developer productivity.

Noah Korba, VP of Digital Core, Cybersecurity, and Enterprise Architecture at General Mills, leads cloud migration and large-scale recovery drills. He describes hands-on, keyboard-driven rebuilds of ~90% of their Google Cloud estate. They map minimum viable business functions to keep supply chains moving. He also discusses OT vs IT recovery challenges and whether boards should be involved in live resilience exercises.

Shuman Ghosemajumder, former Google trust-and-safety leader and Reckon CEO, pioneers large-scale fraud defense. He traces automated abuse from Gmail's early days to credential stuffing. He explains the Smart Cow problem, likens AI scam floods to a DDoS on trusted channels, and champions lightweight on-device AI and device-to-device trust to rebuild scalable communications trust.

Dan Lussier, founder of Nano and seasoned security engineer, built a lean, ClickHouse-based SIEM using Rust and AI tooling. He recounts a two-week, $7,000 build, explains why ClickHouse delivers sub-second search at scale, and describes AI-assisted triage, natural-language search, and detection-as-code topics in short, punchy segments.

Morgan Adamski, former NSA leader and current Head of Cyber Digital Tech Risk at PwC USA, brings public-private cyber collaboration experience. He discusses practical threat sharing through people and automation. He covers defending shared cloud infrastructure, using ecosystem concentration as a defensive strength, preparing for AI-era breaches, and building trusted relationships before crises.

Matt Rowe, Chief Security Officer at Lloyds Bank, leads security modernization to help the bank operate like a large fintech. He talks about transforming the SOC, modernizing IAM for humans and agents, balancing rapid AI adoption with safety, and prioritizing exposure-driven remediation and pragmatic sequencing of fixes.