AI Security Policies Don’t Work. This Does | Edward M | Security Mondays S1 Ep.2
Security Mondays with Eva BennShow Notes
Hi, I’m Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what’s actually top of mind, the threats they’re seeing, the tools they’re using, and the decisions they’re making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. Claude Desktop introduces a new class of endpoint risk: AI agents with autonomous execution, persistent scheduled tasks, MCP server integrations, browser-control extensions, and OAuth-authenticated connectors to external services. Most of this configuration lives in JSON files scattered across multiple directories with no centralised visibility. In this video you'll see how you can use Claudit-Sec, an open-source tool that gives you and your organization visibility into your dependencies.AI is fundamentally changing how security works. Data is no longer just moving through files, it’s moving through conversations. Policies sitting in PDFs are becoming liabilities. And many teams are still trying to solve modern problems with outdated approaches.But here’s the shift: security today is less about blocking fast and more about understanding behavior, building trust, and bringing people along. The teams that win are the ones focusing on visibility, alignment, and real-world usage instead of just control.I’m doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and insights you can actually use this week.This week, I sat down with Edward, Security and AI Leader at Harmonic Security. We unpack what it really takes to stay relevant as AI reshapes how security teams operate day to day, from governance to tooling to human behavior.What you’ll walk away with:- Why traditional security policies are becoming a liability in the age of AI- How data is now leaving organizations through prompts, not just files- The biggest mistake teams are making with AI governance right now- A simple 3-step checklist to get ahead of AI risks this week- Practical ways to build visibility, align teams, and drive real adoptionIf you find this helpful, I’d really appreciate you giving us a thumbs up, subscribing, and sharing it with your community.Resources we mention in the video:Connect with Edward M: https://www.linkedin.com/in/ed-merrett/Ed’s guide on securing cowork : https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guideClaudit: https://github.com/HarmonicSecurity/claudit-secHarmonic: https://harmonic.security Ed’s AI Security Slack Channel: https://join.slack.com/t/ai-security-community/shared_invite/zt-3sgp2o6iu-8xPekFxZDZ73fUUw1Ey9xQ Chapters00:00 – Intro: Navigating AI in Cybersecurity01:00 – Why AI Is Changing Security Forever03:59 – Biggest Lesson: Stop Blocking, Start Listening05:27 – Why Security Policies Are Becoming a Liability07:22 – What Security Leaders Should Do Instead09:14 – How to Build Visibility Into AI Usage11:02 – Biggest AI Governance Mistakes Teams Make13:39 – Demo: AI Security Tool in Action20:23 – 3-Step Checklist to Manage AI Risk This Week23:17 – Getting Teams to Actually Adopt Secure AI PracticesFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabenn_TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/
More from Security Mondays with Eva Benn
Remember the headlines about the 3 researchers at Hacktron AI who hacked OpenAI through a photo upload? After $3K in Claude tokens and less than 72 hours they had access to OpenAI’s internal code. Today, we’re hearing from Zayne Zhang, co-founder and CEO of Hacktron AI, and we’re going underneath the headlines into how they did it, how the economics of vulnerability exploitation have changed, and most importantly, what you can do about it.
If you have a hundred findings rated 9.2, which one do you fix first? The score can't tell you. Proof that an attacker can actually exploit it can.
In 2010, Dave DeWalt was CEO of McAfee when one bad update blue-screened computers across 1,672 companies in just 16 minutes. That was one bad update. Now imagine that same kind of accident in the age of autonomous AI agents, systems that can make decisions and take action across production environments at machine speed.
If you watch one video from Season 2 of Security Mondays, make it this one.10 episodes. Some of the most respected names in cybersecurity. Five themes that kept coming up again and again. I boiled it all down to under 15 minutes, so you can walk away with guidance you can use THIS week.Season 2 is officially a wrap. I got to sit down with leaders from completely different backgrounds, with completely different experiences. And they kept landing on the same five lessons. That's not a coincidence.A huge thank you to the incredible guests who made Season 2 possible:Rob Lee: AI security, cybersecurity fundamentals, and how AI is changing the speed of security.Thomas Rocha: AI threat intelligence and how the threats are changing.Helen Oakley & Dimitri Raidman: AI supply chain security and the risks hiding across the AI stack.Neil Provost: Security invariance, and building security that holds up as environments change.Joshua Copeland: Security theater, and why having a control is NOT the same as proving it works.Heath Adams: The attacker mindset, and thinking like the people trying to break your systems.Josh Bressers: The future of open source and the security challenges it faces.Tim Raines: AI aerospace strategy and the security implications of AI in critical environments.Rob Joyce: Offensive operations, national security, and lessons from decades in the field.Every conversation pointed to the same thing:AI is exposing every weak spot in the security playbook we already had, at a speed and scale we can no longer ignore.The five themes:1. AI changed the speed, not the fundamentals.2. Know what you have and what it can access.3. Assume agents will fail and contain the blast radius.4. Stop believing your security works. Test it.5. Finding vulnerabilities is getting cheap. Fixing them is the hard part.But HOW do you actually use any of this on Monday morning?Don't try to do everything at once. Pick ONE lesson. Put it into practice this week.That's how we roll here.Thank you for watching, commenting, and sharing these episodes with your teams. You made Season 2 what it was, and it has meant the world to me. ❤️Season 3 is coming soon, and we're kicking it off with Dave DeWalt on October 5th. Until then, I'll be here every Monday with practical AI security guidance you can turn into action.Which of the five themes hits closest to home for your team? Tell me in the comments 👇If you enjoyed this episode, I'd really appreciate a subscribe and a thumbs up.Follow along for more free cybersecurity education. 🤗---Want to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.comFollow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/
Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week.This week, I sat down with Rob Joyce, former Director of Cybersecurity at the National Security Agency and founder of Joyce Cyber. We talked about what changed once AI agents could run most of an attack on their own, and the concrete moves a security leader can make this week to keep pace. What you'll walk away with: - What still stops a top-tier attacker, and the one defense to add now. - What changed in AI-enabled offense, and the assumption to drop from your threat model. - How to check if you qualify for the NSA's free cyber services and sign up this week. - The identity audit to run today: phishing-resistant MFA and killing stale accounts. - The one thing to start Monday, and how to know by Friday that you moved. If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Rob: LinkedIn: https://www.linkedin.com/in/rob-joyce-b43445116/ ResourcesUSENIX Enigma 2016 — "Disrupting Nation State Hackers" (talk): https://www.youtube.com/watch?v=bDJb8WOJYdA USENIX Enigma 2016 talk page + transcript: https://www.usenix.org/conference/enigma2016/conference-program/presentation/joyce NSA Cybersecurity Collaboration Center (free services, eligibility): https://www.nsa.gov/ccc Anthropic — "Disrupting the first reported AI-orchestrated cyber espionage campaign" (Nov 2025): https://www.anthropic.com/news/disrupting-AI-espionage Rob Joyce at the Secureframe National Cybersecurity Summit (six moves; AI offense): https://secureframe.com/blog/rob-joyce-dib-cybersecurity Rob Joyce testimony, House Select Committee on the CCP (Mar 5, 2025): https://docs.house.gov/meetings/ZS/ZS00/20250305/117983/HHRG-119-ZS00-Wstate-JoyceR-20250305.pdf XBOW tops HackerOne (2025): https://xbow.com/blog/xbow-on-hackerone-whats-next Chapters:00:00 — Why Hackers Don't Care Who You Are Anymore05:18 — AI Just Changed the Economics of Hacking07:55 — Why Every Organization Is Now a Potential Target10:15 — The Three Defenses You Can't Afford to Ignore17:04 — When AI Agents Become the New Insider Threat20:07 — Why Attackers Can Now Outpace Your Patch Cycle30:01 — The Cryptography Deadline Security Leaders Can't IgnoreWant to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.comAnd follow along for more free cybersecurity education. 🤗LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://www.instagram.com/evabennofficial/TikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/