Show Notes
In this episode of ConversingLabs, host Paul Roberts interviews Chuck McWhirter, principal solutions architect at ReversingLabs, about the importance of sticking to basics when it comes to thwarting attacks from adversaries. Chuck recounts his experiences in both the public and private sectors, including his efforts in securing the 2002 Olympics – back when the Security Operations Center (SOC) had not yet evolved. The details of Chuck’s journey shed light on how enterprise security teams can better handle the cyber threats stemming from nation-state adversaries. By minimizing cybersecurity tool sprawl and alert fatigue, as well as assessing situational risk, Chuck argues that security teams stand a better chance against attackers.
More from ConversingLabs Podcast
In this episode of the ConversingLabs Podcast, host Paul Roberts speaks with Tim Brown about the evolving cybersecurity landscape, the lessons of the SolarWinds supply chain attack, and how AI is changing the balance between attackers and defenders. Explore our YouTube channel to learn more or visit us at https://www.reversinglabs.com/ Follow us on Twitter: https://twitter.com/ReversingLabs Follow us on LinkedIn: https://www.linkedin.com/company/reve... Follow us on Instagram: https://www.instagram.com/reversinglabs/
Host Paul Roberts welcomes Conversing Labs guest Steve Wilson, Chief AI and Product Officer at Exabeam and co-chair of the OWASP GenAI Security Project. Steve discusses his path from early programming to AppSec at Contrast Security and leading the OWASP Top 10 for LLMs, which grew into a large community and later an Agentic Top 10. Wilson explains AI’s recent leap via transformer architecture, cloud scale, and GPUs, and describes Exabeam’s evolution from SIEM and behavior analytics to generative and agentic AI with multiple security agents. He summarizes his 2024 O’Reilly book expanding OWASP risks into case studies and secure development practices, emphasizing that AppSec alone is insufficient for autonomous agents, requiring monitoring and “agent behavior analytics.” The conversation highlights AI supply chain risks (models, plugins/MCP, OpenClaw skills, fake Chrome extensions), scoping/least privilege, and the practical impact of tools like Claude Code on AppSec and security operations. 00:00 Welcome and Guest Intro 02:35 Steve’s Cyber Journey 04:13 OWASP LLM Top 10 Origins 06:21 From LLMs to Agents 06:59 Tron and AI History 09:32 Why Transformers Changed Everything 11:35 What Exabeam Actually Does 16:08 Writing the LLM Security Book 20:27 Agent Risks Beyond AppSec 22:05 What Changed Since 2024 23:30 Reasoning Models and Strawberry 26:18 Agentic Top 10 and Supply Chain 27:11 Hallucinated Dependencies 27:47 Model Supply Chain Trust 28:57 Plugins And Agent Exploits 29:58 MCP And Skills Risks 31:01 Chrome Plugin Trap 33:47 RAISE Framework Overview 35:12 Monitoring Digital Workers 38:40 Scoping And RAG 41:44 Excessive Agency Controls 43:02 Sandboxed Assistant Build 45:16 AI Impact On Infosec 49:15 Closing And Contact
In this episode of ConversingLabs Podcast, host Paul Roberts interviews ReversingLabs Chief Trust Officer Saša Zdjelar about the recent Notebook++ hack and what he thinks software supply chain security will look like in 2026. The two will also discuss the findings of RL’s fourth annual report on the subject, which offers six predictions for how threats will evolve, as well as how security teams will respond. Also, Saša will share his take that the technology industry needs to move away from a “move fast and break things” mindset in order to best secure software supply chains. Read Saša's commentary for Cyber Scoop here: https://cyberscoop.com/move-fast-break-things-cybersecurity-supply-chain-security-op-ed/ Read the 2026 Software Supply Chain Security Report here: https://www.reversinglabs.com/sscs-report
In this episode of ConversingLabs Podcast, host Carolynn van Arsdale welcomes North Carolina State University Professor Laurie Williams and Ph.D. student Sivana Hamer to discuss their team’s research on the effectiveness of software supply chain security (SSCS) frameworks. Their study, “Closing the Chain,” (PDF) found that software products would still be vulnerable to attacks like SolarWinds, Log4j and XZ Utils – even if they fully enforced 10 well-known SSCS frameworks published by government, industry, academia and open source.
In this episode of ConversingLabs, host Paul Roberts interviews Casey John Ellis, founder of Bugcrowd, about the state of vulnerability management and bug bounties in 2025. Casey shares his insights on current changes impacting both the threat landscape and the cybersecurity industry, such as matters at the federal level and increased AI usage. Looking at the future, Casey also mentions how important it is to welcome the next generation into cybersecurity.