Ex-NSA Hacker Chief: The REAL Reason Hackers Get In | Rob Joyce | S2 E9

Remember the headlines about the 3 researchers at Hacktron AI who hacked OpenAI through a photo upload? After $3K in Claude tokens and less than 72 hours they had access to OpenAI’s internal code. Today, we’re hearing from Zayne Zhang, co-founder and CEO of Hacktron AI, and we’re going underneath the headlines into how they did it, how the economics of vulnerability exploitation have changed, and most importantly, what you can do about it.

If you have a hundred findings rated 9.2, which one do you fix first? The score can't tell you. Proof that an attacker can actually exploit it can.

In 2010, Dave DeWalt was CEO of McAfee when one bad update blue-screened computers across 1,672 companies in just 16 minutes. That was one bad update. Now imagine that same kind of accident in the age of autonomous AI agents, systems that can make decisions and take action across production environments at machine speed.

If you watch one video from Season 2 of Security Mondays, make it this one.10 episodes. Some of the most respected names in cybersecurity. Five themes that kept coming up again and again. I boiled it all down to under 15 minutes, so you can walk away with guidance you can use THIS week.Season 2 is officially a wrap. I got to sit down with leaders from completely different backgrounds, with completely different experiences. And they kept landing on the same five lessons. That's not a coincidence.A huge thank you to the incredible guests who made Season 2 possible:Rob Lee: AI security, cybersecurity fundamentals, and how AI is changing the speed of security.Thomas Rocha: AI threat intelligence and how the threats are changing.Helen Oakley & Dimitri Raidman: AI supply chain security and the risks hiding across the AI stack.Neil Provost: Security invariance, and building security that holds up as environments change.Joshua Copeland: Security theater, and why having a control is NOT the same as proving it works.Heath Adams: The attacker mindset, and thinking like the people trying to break your systems.Josh Bressers: The future of open source and the security challenges it faces.Tim Raines: AI aerospace strategy and the security implications of AI in critical environments.Rob Joyce: Offensive operations, national security, and lessons from decades in the field.Every conversation pointed to the same thing:AI is exposing every weak spot in the security playbook we already had, at a speed and scale we can no longer ignore.The five themes:1. AI changed the speed, not the fundamentals.2. Know what you have and what it can access.3. Assume agents will fail and contain the blast radius.4. Stop believing your security works. Test it.5. Finding vulnerabilities is getting cheap. Fixing them is the hard part.But HOW do you actually use any of this on Monday morning?Don't try to do everything at once. Pick ONE lesson. Put it into practice this week.That's how we roll here.Thank you for watching, commenting, and sharing these episodes with your teams. You made Season 2 what it was, and it has meant the world to me. ❤️Season 3 is coming soon, and we're kicking it off with Dave DeWalt on October 5th. Until then, I'll be here every Monday with practical AI security guidance you can turn into action.Which of the five themes hits closest to home for your team? Tell me in the comments 👇If you enjoyed this episode, I'd really appreciate a subscribe and a thumbs up.Follow along for more free cybersecurity education. 🤗---Want to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.comFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week.Every week there's a new AI security product and a new reason to panic. This episode is the opposite of that. Tim Rains has spent his career figuring out how organizations actually get compromised and which strategies actually hold up, and his take on AI is refreshingly calm: most of what works still works, and the real skill is knowing which few parts of your program AI genuinely breaks.I'm doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and resources you can go use this week.What you'll walk away with:- A clear sense of which parts of your strategy to revisit for AI, and which to leave alone- Where to double down on fundamentals versus where to fund something new- A 90-day change for vulnerability management when discovery and exploitation move at machine speed- The security requirements to set before an AI system reaches production- A way to tier AI use cases by consequence and decide how much autonomy each getsConnect with Tim:- LinkedIn: https://www.linkedin.com/in/timrains/Tim's book:- Cybersecurity Strategy for the AI-Driven Era, 3rd ed. (Packt): https://www.packtpub.com/en-us/product/cybersecurity-strategy-for-the-ai-driven-era-9781806028573- Amazon: https://www.amazon.com/Cybersecurity-Strategy-AI-Driven-Era-data-driven/dp/1806028573Resources we talked about- Tim on securing AI agents (Okta Executive Exchange): https://www.okta.com/newsroom/articles/adt-ciso-tim-rains-on-why-ai-agent-access-is-crucial-and-risky/- OpenAI–Hugging Face incident, Black Hat 2026 (SC Media): https://www.scworld.com/news/black-hat-2026-openai-reveals-agents-planned-collective-attacks-via-secret-message-board- MITRE ATT&CK: https://attack.mitre.org/- CWE-20, Improper Input Validation (MITRE): https://cwe.mitre.org/data/definitions/20.html- OWASP API Security Top 10: https://owasp.org/API-Security/Chapters00:00 — The AI Shift Every Security Leader Needs to Prepare For03:03 — The Three Security Priorities AI Changes First07:35 — Why AI Can't Be a Separate Security Strategy09:40 — Where Security Budgets Should Go Now13:15 — Why Vulnerability Scanning Is No Longer Enough20:21 — How to Secure AI When Input Can't Be Trusted23:32 — Why AI Autonomy Could Multiply Your RiskFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/