Show Notes
Hackers don't break in — they log in. That's the refrain cybersecurity researcher, TED speaker, and self-described friendly hacker Keren Elazari keeps coming back to, and it sets the tone for a conversation that cuts through a lot of the current AI hype.
Host Raghu Nandakumara sits down with Keren to talk about why, despite the constant headlines about AI-discovered zero-days and autonomous attack tools, the overwhelming majority of real-world breaches still come down to the same fundamentals: stolen credentials, unpatched known vulnerabilities, and social engineering. Keren points to Verizon's DBIR data showing that over 80% of web-facing attacks are credential-based, and to the CISA KEV catalog, where under 30% of known exploited vulnerabilities are even patched — numbers that make the "AI supercharges vulnerability discovery" conversation feel a little beside the point.
The two dig into what Keren calls the widening asymmetry between attackers and defenders: AI is getting good at finding vulnerabilities and writing exploits, but not nearly as good at patching them or getting fixes into messy, real-world production environments. She describes AI as "a time machine for attackers" — compressing weeks of reconnaissance and tooling into hours — and argues defenders need that same acceleration applied to mitigation and containment, not just detection.
The conversation also covers:
Shiny Hunters' evolving social engineering playbook — from impersonating employees to get help desks to reset access, to now impersonating the help desk itself to harvest credentials via fake SSO resets, SIM swapping, and deepfake voice tools
The GTG-1002 incident referenced in Anthropic's late-2025 report, where a nation-state actor used an AI model as an active accomplice in an orchestrated attack, and why Keren thinks the sophistication was in AI-driven orchestration, not novel exploit creation
Shadow AI as a new attack surface, using the rapid, often misconfigured spread of local "Open Claw" installations (many left listening on all ports) as a cautionary example
Jade Puffer, an early example of agentic, largely human-out-of-the-loop ransomware, and why Keren wasn't surprised given how much ransomware groups already reinvest in R&D
A malicious-package incident on Hugging Face, and the broader pattern of attackers targeting trusted open-source "watering holes" like GitHub and model/skill hubs
Keren closes out by introducing her reframed security fundamentals — Identity, Visibility, and Containment (IVC) in place of the classic CIA triad — and makes the case for "proactive paranoia": preparing for breaches before they happen rather than scrambling once they do. She and Raghu wrap with a shared hard truth: for all the AI conversation, security is ultimately about serving the humans on both sides of the equation, including the fact that attackers are humans too, and often know an organization's environment better than its own defenders do.
Stay connected with our host Raghu on LinkedIn
For more information about Illumio, check out our website at illumio.com
More from The Segment
The Monday Microsegment for the week of October 19. All the cybersecurity news you need to stay ahead, from Illumio's The Segment podcast. It looks like the accused OpenAI spy may have had an accomplice: ChatGPT. France's fridge fry has reached around 700 stores. And officials warn it may not be over. Could the next botnet think for itself? Researchers say small AI models are getting close. Plus, Aishwarya Ramani joins to discuss the growing cybersecurity risks of AI adoption in financial services Head to The Zero Trust Hub: hub.illumio.com Get the Industry’s First Vendor-Neutral Zero Trust Certification: https://www.illumio.com/zero-trust-certification
The Monday Microsegment for the week of October 12. All the cybersecurity news you need to stay ahead, from Illumio's The Segment podcast. Another suspected Shiny Hunter member is in custody as the FBI traces its attack to a single missed patch — and now-removed contractor. Hackers turn an AI attack tool on South Korean banks. And attackers lock Fortinet customers out of their own firewalls. Plus, Gary Barlet to discuss the recent cyberattack on the Pentagon. Head to The Zero Trust Hub: hub.illumio.com Get the Industry’s First Vendor-Neutral Zero Trust Certification: https://www.illumio.com/zero-trust-certification
AI is giving attackers new ways to move faster, scale attacks, and explore every possible path through an environment. But does that mean defenders need an entirely new security strategy? In this special episode of The Segment, Raghu Nandakumara is joined by John Kindervag, creator of Zero Trust and Chief Evangelist at Illumio; Rich Mogull, Chief Analyst at the Cloud Security Alliance; and Don Yeske, longtime federal cybersecurity leader and Senior Solutions Architect and Enablement Lead at Virtru, to celebrate the launch of their new book, Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era. Together, they explore why Zero Trust remains critical in the age of AI, how organizations can identify and secure their most important protect surfaces, and why trying to defend everything at once is often a recipe for failure. Download the book here: https://www.illumio.com/resource-center/cyber-resilience-at-machine-speed-the-zero-trust-model-for-the-ai-era In this episode, you’ll learn: Why AI changes the speed and scale of cyberattacks, but not the fundamentals of security How protect surfaces make Zero Trust practical and achievable Why attackers face a fundamentally different problem than defenders How segmentation and security boundaries can make an attacker’s job harder Why “the accumulation of tactics isn’t strategy” How organizations can prioritize their most critical assets instead of trying to secure everything at once Why AI is making security fundamentals more urgent, not obsolete How Zero Trust has evolved from the cloud era to the age of frontier AI
The Monday Microsegment for the week of October 5. All the cybersecurity news you need to stay ahead, from Illumio's The Segment podcast. Hackers steal records on 3 million people in a monthslong Pentagon break-in. Two suspected ShinyHunters members are in custody, and one is said to be helping the FBI. AI’s biggest names sign a safety pledge — with no penalties or enforcement attached. Plus, John Kindervag for this month’s book club discussion, featuring Think Like an Attacker by Dr. Chase Cunningham. Link to book: https://www.illumio.com/resource-center/think-like-an-attacker Head to The Zero Trust Hub: hub.illumio.com Get the Industry’s First Vendor-Neutral Zero Trust Certification: https://www.illumio.com/zero-trust-certification
AI may be the latest technology transformation, but for security teams, the challenges feel familiar. In this episode of The Segment, Raghu Nandakumara sits down with Ashish Rajan, CISO of TechRiot, host of the Cloud Security Podcast and AI Security Podcast, and author of AI Security Engineering, to explore what the cloud era can teach us about securing AI. They discuss how AI is reshaping cloud security, why the shared responsibility model gets even murkier with AI, and what changes when security teams have to protect agents whose behavior and intent aren’t always predictable. Ashish also shares how organizations can start building practical AI security programs today, why continuous evals and human oversight matter, and the AI skills security practitioners will need for what comes next. https://www.aisecuritypodcast.com/ https://www.cloudsecuritypodcast.tv/ https://www.amazon.com/dp/1394387687?lv=shuf&channelId=500&plpRedirect=mhFallback