Show Notes
Traditional SCA and SAST tools are notorious for drowning security teams in false positives, historically flagging nine out of ten alerts incorrectly. But while generative AI seems like a magic bullet, simply wrapping an out-of-the-box LLM around your code can result in confident hallucinations and astronomical costs extrapolating to as much as $52 million a year for a large enterprise using frontier models. In this episode, Ashish sits down with Harry Wetherald, CEO and co-founder of Maze, to discuss the evolution of AI-native AppSec and Cloud Security. Harry breaks down the critical difference between vulnerability reachability (is the code active?) and true exploitability (can an attacker actually trigger it logically?). He also explains why the historical walls between cloud security and application security teams are finally crumbling as AI acts as a perfect translator between the two domains. If your team is debating "Build vs. Buy" for AI security tools, this episode is essential. Harry shares the biggest red flags to watch out for in AI vendors (beware the "black box"), how to intelligently route across models to optimize token costs by 100x, and how a true "security brain" orchestrates multiple investigations to provide reliable context across your entire environment.
Guest Socials - Harry's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels: -Cloud Security Podcast- Youtube - Cloud Security Newsletter If you are interested in AI Security, you can check out our sister podcast - AI Security Podcast
Questions asked: (00:00) Introduction to AI in AppSec(01:50) Harry Wetherald's Background and the Founding of Maze(02:30) Reachability vs. Exploitability Explained(04:45) The "Build vs. Buy" Dilemma for AI Security Tools(08:30) Bridging the Gap Between Siloed AppSec and CloudSec Teams(11:30) Evaluating Out-of-the-Box LLMs vs. Specialized Security Tools(14:20) Solving the Historic AppSec False Positive Problem(18:50) AI Vendor Red Flags: The Danger of "Black Box" Products(20:50) How to Build a True AI-Native Security Architecture(24:45) The Hidden Cost of AI Models: Why Optimization is Crucial(28:00) When to Keep a Human in the Loop for Remediation(34:00) Building a "Security Brain" to Inform AI Coding Agents(39:20) The Launch of Maze Code for Deep Cloud and Code Investigations
More from Cloud Security Podcast
Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turning on a model like Mythos without a multi-stage orchestration layer is like handing someone the keys to a Ferrari when they don't know how to drive. He talks about the 66,000+ CVE "vulnpocalypse" panic and that only 1% of vulnerabilities are ever actively exploited in the wild. We also examine real-world autonomous threats like "Jade Puffer" (the first documented agentic ransomware path) and walk through 3-step maturity framework for enterprise AI adoption: Visibility, Observability, and Actionability via Agentic Governance Gateways
When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those services are spun down but the DNS records remain, it creates "dangling" domains ripe for takeover, a vulnerability that can compromise entire hosted zones, auth tokens, and session cookies. In this episode, Ashish sits down with Ramesh Ramani, Staff Security Engineer at Block, to discuss how his team reduced their domain takeover bug bounty reports from over 80 in a single submission down to near zero. Ramesh breaks down the complex challenge of DNS attribution, explaining why automating DNS cleanup is impossible without first identifying resource owners and consolidating approved registrars. We explore the technical architecture behind Block's stateless, AWS-native automation system, which continuously enumerates their external attack surface and routes vulnerable CNAMEs, MX records, and Elastic IPs directly to the responsible application teams. Ramesh also shares his thoughts on the limitations of AI when evaluating least privilege and parsing logs, emphasizing why security engineers still need deterministic signals.
When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environment. In this episode, Ashish sits down with David Gibson, SVP of Strategic Programs at Varonis, to explain why the rapid adoption of AI copilots and autonomous agents is fundamentally a data security crisis. We spoke about how connecting AI to your corporate environment before locking down your data creates massive, unintentional insider threats, allowing employees to instantly discover sensitive information they shouldn't see. We explore the Varonis Atlas framework, which provides a unified control plane to inventory AI systems, implement runtime guardrails, and execute automated red teaming. David also breaks down emerging threats like "hallucination squatting," untrusted agent inputs, and why managing identity groups without understanding data access is like holding a keyring without knowing what doors the keys unlock.
Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, security engineers at the AI software creation platform Lovable, to discuss how they actively secure AI-generated code and protect creators from supply chain risks. Focusing on solutions rather than alarmism, Marcus and Samuel detail their response to an incident where malicious contractors mimicked AI agent commits. They outline their multi-layered defense strategy: securing a predefined tech stack, utilizing integrated security scanners, and tuning coding agents with strict guardrails to ensure secure output by default. The conversation also covers the evolution of the shared responsibility model in the AI era, the critical importance of foundational hygiene like Git commit signing, and the necessary transition from local "YOLO mode" to secure, sandboxed agent environments. Discover how platforms can leverage AI not just to write code, but to actively assist users in finding and resolving security issues through concepts like "CISO agents."
Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is still stuck at the bottom of the Pyramid of Pain, your incident response team is doused in noise while true threats slip through undetected. In this episode, Ashish sits down with Nicole Beckwith, Senior Director of Security Engineering & Operations at Cribl (former Secret Service investigator and Kroger security ops lead), to break down Cribl's open APEX framework. Nicole explains how APEX focuses on behavioral chaining, time-boxing, and clustering over raw telemetry to build high-fidelity detections without needing a thousand individual rules for every MITRE ATT&CK box. We also explore the shift from a "single pane of glass" to a deterministic "single lens" over federated data, why AI agents must be provisioned as true identities rather than unmonitored service accounts, and how to analyze hyper-fast threat archetypes like Anthropic's GTG 1002.