Show Notes
Agentic AI is changing the way applications are designed, tested, deployed, and secured.Traditional application security focuses on APIs, authentication, authorization, databases, code, sessions, and technical attack surfaces.But Agentic AI introduces a different challenge.A user may not need technical knowledge to influence the system.A simple natural language prompt can make an AI agent classify intent, call a tool, retrieve data, generate a response, trigger a workflow, or influence a business decision.In this podcast episode, Prabh speaks with Akansha about Threat Modeling for Agentic AI Systems, using a practical customer support chatbot architecture as the case study.The architecture discussed includes:Classifier agentResponder agentQA reviewer agentHuman approval processRetrieval databaseTool integrationsLogging and monitoringRefund workflowThird-party integrationsThe session explains how a customer request flows through different agents, how intent is classified, how responses are generated, how refund requests are reviewed, and why human approval is important for high-risk financial actions.Content Reference https://github.com/smartdevil09/AI-Security-Professional-Roadmap/blob/main/AI%20security%20concepts/Threat%20Modelling%20Agentic%20Architecture.pdfLinkedin Profilehttps://www.linkedin.com/in/akesharwani/In this episode, we discuss:How Agentic AI differs from traditional application securityWhy prompts and natural language interactions create new risksWhy threat modeling should happen before production deploymentWhy stakeholder engagement is criticalHow to understand the business problem before identifying threatsHow to create an asset inventory for AI systemsHow to identify business assets and AI assetsHow to prepare data flow diagrams for multi-agent systemsHow to define trust boundaries between users, agents, tools, databases, and third partiesWhy refund workflows need stronger approval controlsWhy human approval is required for critical financial transactionsWhy logging and monitoring must be carefully designedHow to avoid logging sensitive PII dataHow attackers may exploit AI agents using prompt injectionHow AI agents may be manipulated into unauthorized actionsHow traditional AppSec controls still matter in Agentic AI systemsHow third-party Agentic AI systems should be assessedWhat documentation should be requested from vendorsHow to use STRIDE, MITRE ATLAS, OWASP LLM Top 10, CVE, and CWE for threat enumerationHow to evaluate likelihood, impact, business risk, and compliance riskWhy threat modeling must be continuously updated as architecture and threats changeAkansha also explains that threat modeling Agentic AI is not a simple automated checklist activity.It requires business context, stakeholder interviews, architecture understanding, asset inventory, data flow mapping, trust boundary analysis, risk assessment, guardrail design, logging, monitoring, validation, and continuous review.#AgenticAI #AISecurity #ThreatModeling #AppSec #AIGovernance #OWASP #MITREATLAS #CyberSecurity #GRC #CoffeeWithPrabh
More from Prabh Nair
Cybersecurity tools can identify vulnerabilities.But offensive-security professionals need to understand something deeper:How can multiple weaknesses be connected into one meaningful attack path?https://www.linkedin.com/in/saurabh-kumar-pandey-1303b4126/In this practical podcast, Prabh speaks with Saurabh Kumar Pandey, an offensive-security practitioner, about how penetration testers approach a target from initial reconnaissance through enumeration, validation, exploitation and privilege escalation.Using a controlled lab scenario, the discussion explores the thinking behind each stage of a penetration test, rather than simply running automated tools.Topics coveredOffensive-security methodologyReconnaissance and attack-surface discoveryUnderstanding Nmap scan resultsService and version identificationSMB and NetBIOS security assessmentIdentifying configuration weaknessesFalse positives vs validated findingsWhy manual validation still mattersHow attackers chain vulnerabilitiesInitial-access thinkingOne of the strongest lessons from the session:A vulnerability by itself may not represent the complete risk. The real risk often appears when several weaknesses are chained together.That is why penetration testing requires more than scanners and exploit tools.The tester must continually ask:What did I learn? What can I validate? What does this give me access to next?The discussion also provides an important defensive lesson.A collection of seemingly manageable issues—unnecessary services, configuration weaknesses, exposed credentials or weak access controls can collectively create a much larger attack path
Let's learn the thin line difference between masquerad vs eavesdropping Attack#cybersecurity #infosec #pentesting #comptia#isaca #cybersecurity #infosec #isc2 #ccsp #cism
Prepare for the Offsec OSAI+ certification with insights on interview strategies for 2026 cybersecurity roles.Ankit Bharathan joins Prabh Nair to discuss the path to mastering the Offsec OSAI+ (AI-300) certification. This conversation focuses on the practical skills required for professionals aiming to enter the specialized field of AI Security.Beyond the technical curriculum, we analyze effective interview strategies and the specific criteria used for candidate selection in 2026. Whether you are looking to pivot your career or sharpen your expertise, this session provides a roadmap to navigating the hiring landscape for off-sec positions.A practical learning path discussed in the episode:Web Security → AI Fundamentals → Build an LLM App → RAG → Embeddings → Agents → Threat Modeling → AI Security Labs → AI Red TeamingThis episode will be useful for:Pentesters • Red Teamers • AppSec Engineers • AI Security Professionals • OSCP holders • Security Researchers • AI Engineers • Cybersecurity StudentsSubscribe for weekly technology infrastructure breakdowns and comment below on what certification topics you want covered next.Prepare for the Offsec OSAI+ certification with insights on interview strategies for 2026 cybersecurity roles.Ankit Bharathan joins Prabh Nair to discuss the path to mastering the Offsec OSAI+ (AI-300) certification. This conversation focuses on the practical skills required for professionals aiming to enter the specialized field of AI Security.Linkedin Profilehttps://www.linkedin.com/in/ankitbharathan/https://github.com/microsoft/AI-Red-Teaming-Playground-Labshttps://owasp.org/projects/top-10-for-large-language-model-applicationshttps://atlas.mitre.org/AI red teaming is becoming a serious extension of offensive security.But preparing for AI security assessments requires more than learning prompt injection.You need to understand how modern AI applications are actually built — LLMs, RAG pipelines, vector databases, embeddings, agents, APIs, web applications and the traditional infrastructure underneath them. Beyond the technical curriculum, we analyze effective interview strategies and the specific criteria used for candidate selection in 2026. Whether you are looking to pivot your career or sharpen your expertise, this session provides a roadmap to navigating the hiring landscape for off-sec positions.Subscribe for weekly technology infrastructure breakdowns and comment below on what certification topics you want covered next.
Welcome to our deep dive into the world of ransomware. In this video, we'll unravel the intricacies of ransomware investigation , exploring their mechanisms, common vectors, and the tools used for analysis. From understanding the initial infection point to decrypting locked files, our comprehensive analysis will equip you with the knowledge to stay one step ahead of cyber threats.In this video, we'll be breaking down ransomware: what it is, how it works, and some tips on how to investigate ransomware . We'll also be discussing the different types of ransomware analysis, including static and dynamic analysis.If you're investigating ransomware symptoms or trying to determine if a system is infected, this is the video for you! We'll discuss the different types of ransomware, how to investigate them, and how to determine if a system is infected. After watching this video, you'll be able to break down ransomware and investigate it in a way that will help you protect your data!Ransomware Serieshttps://www.youtube.com/playlist?list=PL0hT6hgexlYy0PZMz9DejEZ2iDKBC-RTGSOC Interview Questionshttps://www.youtube.com/watch?v=UF_oLGoRL_c&list=PL0hT6hgexlYxd24Jb8OE7vZoas-iTcHAcPlaylist Network Securityhttps://www.youtube.com/playlist?list=PL0hT6hgexlYzX6AWwcyDbAZQUKYJL2MdtGRC Interview Questionshttps://youtu.be/4TyfNtFGAC4Internal Auditor Playlist https://www.youtube.com/playlist?list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWvHow to make career progression post #isc2 and #isaca https://www.youtube.com/watch?v=PT0fnCWzAFA&pp=ygUJZ3JjIHByYWJoHow to make career in GRChttps://www.youtube.com/watch?v=_S4t9S5N4Ts&t=102s&pp=ygUJZ3JjIHByYWJoHow to Build PIMShttps://www.youtube.com/watch?v=IwAseU4ZmuQHow to Implement 27001 in an organization https://www.youtube.com/watch?v=sQqJH2naU6IHow to conduct PIAhttps://www.youtube.com/watch?v=z1BD7exH2Ow&t=774sHow to Make a career in GRChttps://www.youtube.com/watch?v=_S4t9S5N4Ts&t=7sTelegram Grouphttps://t.me/InfoseclearningStart your career in cybersecurity with free resources https://lnkd.in/g89gxkzc. Cybersecurity Career: How to Make a Career in Cybersecurity 2022 https://lnkd.in/gCGBnRM7Pentesting Career https://lnkd.in/gQYenKYdTelegram Group Linkhttps://t.me/InfoseclearningCybersecurity Guidehttps://www.youtube.com/playlist?list=PL0hT6hgexlYwdYBW6yqUQMuRqvABiQPXkFollow me on Instagramhttps://www.instagram.com/prabhnair/?...#soc #cybersecurity #infosec #ransomware , #Cybersecurity #malware Analysis, #RansomwareDecryption, Cyber Threats, #ransomwareattack #DigitalSecurity.
Welcome to our channel! In this video, we dive deep into realistic ITGC interview questions frequently asked in Big 4 firms. If you're preparing for an ITGC (IT General Controls) interview with top consulting firms like Deloitte, PwC, EY, and KPMG, this video is a must-watch!What You'll Learn:The most common ITGC interview questions asked by Big 4 firms.Insider tips on how to answer these questions effectively.Real experiences from candidates who have successfully navigated ITGC interviews.Essential knowledge for ITGC consulting and audit roles.Why Watch This Video?Securing a job in ITGC consulting or ITGC audit at a Big 4 firm can be challenging. This video equips you with the insights and confidence you need to ace your interview. Whether you're a fresh graduate or an experienced professional, understanding these interview questions is crucial for your success.What You'll Learn:The most common ITGC interview questions asked by Big 4 firms.Scenario-based questions to help you prepare for real-life interview situations.Insider tips on how to answer these questions effectively.Real experiences from candidates who have successfully navigated ITGC interviews.Techniques to handle questions with confidence and make a great impression.Essential knowledge for ITGC consulting and audit roles.Internal Audithttps://www.youtube.com/playlist?list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWvGRChttps://www.youtube.com/playlist?list=PL0hT6hgexlYz1Usn1Nrnur6OzVoz59zylAudit Serieshttps://www.youtube.com/watch?v=an15rFruIvo&list=PL0hT6hgexlYzvKY3AcOX2M7bkLRFVpQv4&pp=gAQBiAQB#ITGCInterviewPreparation#itaudit #audition #audition #itsecurity #itgc #sox