EP258 Why Your Security Strategy Needs an Immune System, Not a Fortress with Royal Hansen
Cloud Security Podcast by GoogleShow Notes
Guest: Royal Hansen, VP of Engineering at Google, former CISO of Alphabet Topics: The "God-Like Designer" Fallacy: You've argued that we need to move away from the "God-like designer" model of security—where we pre-calculate every risk like building a bridge—and towards a biological model. Can you explain why that old engineering mindset is becoming risky in today's cloud and AI environments? Resilience vs. Robustness: In your view, what is the practical difference between a robust system (like a fortress that eventually breaks) and a resilient system (like an immune system)? How does a CISO start shifting their team's focus from creating the former to nurturing the latter? Securing the Unknown: We're entering an era where AI agents will call other agents, creating pathways we never explicitly designed. If we can't predict these interactions, how can we possibly secure them? What does "emergent security" look like in practice? Primitives for Agents: You mentioned the need for new "biological primitives" for these agents—things like time-bound access or inherent throttling. Are these just new names for old concepts like Zero Trust, or is there something different about how we need to apply them to AI? The Compliance Friction: There's a massive tension between this dynamic, probabilistic reality and the static, checklist-based world of many compliance regimes. How do you, as a leader, bridge that gap? How do you convince an auditor or a board that a "probabilistic" approach doesn't just mean "we don't know for sure"? "Safe" Failures: How can organizations get comfortable with the idea of designing for allowable failure in their subsystems, rather than striving for 100% uptime and security everywhere? Resources: Video version EP189 How Google Does Security Programs at Scale: CISO Insights BigSleep and CodeMender agents "Chasing the Rabbit" book "How Life Works: A User's Guide to the New Biology" book
More from Cloud Security Podcast by Google
EP293 Farewell (for now) Tim and Anton reflect on 5 years of podcasting and say farewell to their listeners in the final episode of Cloud Security Podcast by Google. What will the future bring? Resources: VIdeo version Show YouTube page Show on Apple Podcasts Show on Spotify
Guests: Jasika Bawa, Group Product Manager, Chrome Security Doug Turner, Engineering Director, Chrome Security Topics: Gemini agent harness found a sandbox escape that survived in the codebase for 13 years! How did that happen and how did that bug get noticed among what's surely a tidal wave of bugs being found by the machines? Chrome 149 and 150 fixed over a thousand security bugs—surpassing the last 23 milestones combined. That is a massive spike! The blog explains it's possible by having 'fixing agents' and 'critic agents' working in a loop that mimics human code reviews. I have to ask: how much of this is real, high-quality engineering, and how much of it is just two robots agreeing to grade each other on a curve? Historically, pushing updates was a monumental, scheduled event. Now, you're piloting two security releases a week to combat fast-moving attacks. That sounds like a direct route to developer burnout, and a complete nightmare for enterprise IT admins who just want their systems to stay stable. How are we balancing the need to protect users from N-day exploits versus making everyone play security whack-a-mole? I want to learn more about this long-term vision so let's address the elephant in the browser: nobody wants to restart Chrome. Personally, I have about 50 tabs open right now, and restarting feels like risking throwing my short-term memory into a woodchipper. You're talking about 'dynamic patching' that replaces background child processes on the fly without a restart, and you've rolled out a 'zero window auto-restart' on macOS. First off, are my tabs safe? Second, is dynamic patching actually going to work seamlessly, or is it just going to crash my Renderer mid-session and blame it on the GPU? If this is real, it's really amazing. Tell us about the "spannification" effort and the migration to Rust. There's two parallel technical safety efforts going on to–as we like to say at Google–eliminate classes of vulnerabilities. Tell us about the engineering efforts behind the C++ spans and the Rust journey! Ok I'd be a terrible Allan Friedman disciple if I didn't ask the supply chain question. First, Chrome has over 2,300 third-party dependencies. That's wild. How are we handling that? Resources: Video version "Stronger with every update: How we're making Chrome and the web safer in the AI Era" blog EP88 Improving Browser Security in the New Era of Work
Guest: Mike Armistead, CEO, Pulse Security AI Dan Lamorena, Chief Go-To-Market Officer, Pulse Security AI Topics: You've described Pulse as an 'operational management platform for cybersecurity leaders.' What does a security management platform look like in practice? How does Pulse bridge this 'translation layer' gap? How do you help a CISO transition from presenting patch rates and MTTD to discussing liability exposure and business capital allocation? What actually gets better when someone works with Pulse? Other than, of course, your ARR numbers for your next funding round? What is the single most surprising or alarming disconnect you've identified in your CISO and Board Engagement Survey? You've introduced the concept of the 'Minimum Viable Security Program (MV(S)P)' and emphasized that 'focus is power.' In an era of non-stop vendor noise, compliance updates, and emerging AI threats, how does Pulse help a CISO ruthlessly prioritize and execute their MV(S)P without getting distracted by the noise? Your company is officially 'Pulse Security AI,' so AI is central to your brand. To put on our healthy skeptic hats: how does Pulse pragmatically leverage AI to solve the CISO's actual day-to-day program management problems, rather than just adding to the marketing noise? Resources: Video EP114 Minimal Viable Secure Product (MVSP) - Is That a Thing? EP208 The Modern CISO: Balancing Risk, Innovation, and Business Strategy (And Where is Cloud?) EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff EP204 Beyond PCAST: Phil Venables on the Future of Resilience and Leading Indicators "The Bomber Mafia: A Dream, a Temptation, and the Longest Night of the Second World War" by Malcolm Gladwell
ZeroDay Cloud: How a hacking competition exposed the reality of AI-augmented offensive security. The Power of Multi-Agent AI: Why a single model is not enough, and how specialized agents (Threat Modeling, Hunting, Triage, and Adversarial Debate) collaborate like a human team. GitHub RCE & CosmosDB Cross Tenant Access: A breakdown of the record-breaking bounty for the GitHub RCE report and the Azure CosmosDB master key vulnerability discovered by Atlas. Humans vs. AI: Whether vulnerability researchers are becoming "buggy whip manufacturers" or if human insight, instinct, and the smell of danger remain irreplaceable.
How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? In this episode, hosts Timothy Peacock and Anton Chuvakin sit down with Christoph Kern, Principal Security Engineer at Google, to look under the hood of "secure-by-design." They trace Google's 15-year engineering journey to fundamentally eliminate entire classes of vulnerabilities rather than just playing whack-a-mole with bugs after they are written. 🛠️ Software Engineering vs. Software Craft: Why Google ditched "be careful" programming checklists in favor of hard compiler and framework-level invariants that make security defects physically impossible to build. 📦 Hiding the Risky Abstractions: How replacing high-risk programming constructs (like raw pointers in C++ or raw injection sinks in browser code) with safe, compiler-enforced abstractions secures codebases at a scale humans can no longer manually audit. 📢 "Marketing Didn't Write It": Christoph and the hosts unpack why the concept of "eliminating a class of vulnerabilities" is a rigorous, mathematical reality at Google rather than just public relations hype. 🤝 Empathy vs. Opinionated Platforms: The secret feedback loop Google uses to build highly opinionated developer platforms (like Boq or browser-native safe types) that protect systems without turning developers into frustrated "software artists" fighting the compiler. 📈 The Android Productivity Proof: The real-world metrics from Google's Android team proving that shifting to memory-safe languages (like Rust) dramatically drops vulnerabilities while actually boosting developer velocity and lowering rollback rates