Episode 109 - Honest Security with Jason Meller
Hacker Valley Studio8 Joulu 2020

Episode 109 - Honest Security with Jason Meller

In this episode of Hacker Valley Studio podcast, Ron and Chris are joined by Jason Meller, Founder, and CEO of Kolide. Jason has over 10 years of experience in managing and leading security organizations. Jason’s interest in technology and cybersecurity began in the 1990s when he began programming in Visual Basic and building AOL Instant Messenger bots. Building offensive tools accelerated Jason’s interest in defending networks and helped him learn how much honesty plays part in building security solutions.

Jason mentions that the security monitoring software at most organizations have the same functionality as spyware or surveillance tools. In addition, these tools are designed to scrutinize all the actions that occur on a device. COVID-19 has increased the rate of organizations going through a digital transformation; as a result, users at an organization are not in a cubicle but at their home. This could mean that security teams have an extremely elevated level of access to devices without transparency as to what is being monitored to protect an organization. This is why Honest Security was created - to create a transparent relationship between security teams and end-users.

Jason has collaborated with Jesse Kriss from Netflix who is actively working towards incorporating user-focused security. Jason describes that organizations should build a culture based on trusting users, treating them like adults, giving them the tools that they need to do their job, and not treating them as suspects from day one. Instead, organizations and security teams should seek teachable moments by giving recommendations and educating users.

Throughout the episode, Jason describes situations that involve users and security team members maneuvering around security tooling obstacles to get their job done. Since working at home, traditional tools have created friction in the user experience. For instance, not having the ability to use USB ports on work devices, disabling corporate VPN to watch a YouTube video, and having to create a ticket to install software to help them with their job. When this friction is created, users will resort to using their personal devices for work activities and miss the opportunity to benefit from security. In some cases, there are “evil” applications found on a device created by a user - but often bad applications installed by users are Chrome extensions or helper utilities that are sending browsing history to a marketing firm.

In the Honest Security manifesto, there’s a section on empathetic intelligence, Jason describes this concept as thinking of the daily life users, thinking of what challenges are users attempting to solve in their workflow, and what part of that workflow could pose a risk to the organization. An example of this would be a security team member trying to empathize with someone who is a developer- and thinking of their daily workflow. When empathizing the security team may realize that the developer is attempting to fix issues on a production application. While fixing the production application, the developer may try to bring a copy of the application database to their local device. Creating a local copy of the database could pose a security risk the copy of the database is not deleted in a reasonable time or the user has their device auto-backup folders to their corporate or personal cloud storage solution (ie. Google Drive). Creating education for avoiding this mistake is a prime example of empathic intelligence when practicing Honest Security.

As the episode progresses, Jason goes into depth and explains more tenants of Honest Security - The goal is not to give unlimited power to the user or security team but to enable everyone to be in the position to make the right decisions and give appropriate recommendations. When consequences are articulated, users can understand that when maneuvering around security tools can pose a risk to their device and organization. Ie) disconnecting from the corporate VPN. When coaching and education are put as a priority when practicing security, James describes it as empowering the user to be successful and more transparent.

0:00 - Intro

2:28 - This episode features Jason Meller, Founder, and CEO of Kolide!

2:54 - Jason shares his background and his path into cybersecurity.

4:07 - What is Honest Security?

5:22 - Jason’s examples of dishonest security

8:08 - Collaboration with Netflix and User-Focused Security

16:00 - Jason describes Empathetic Security

19:17 - Tenants of Honest Security

35:32 - Wrap Up and Resources for Honest Security

Links:

Learn more about Jason Meller and connect with him on LinkedIn.

Learn more about Honest Security and read the manifesto.

Learn more about Jason’s company Kolide

Learn more about Hacker Valley Studio.

Support Hacker Valley Studio on Patreon.

Follow Hacker Valley Studio on Twitter.

Follow hosts Ron Eddings and Chris Cochran on Twitter.

Learn more about our sponsor ByteChek.

Jaksot(404)

Learning How to Learn: Mastering the Cyber Fundamentals with Rich Greene

Learning How to Learn: Mastering the Cyber Fundamentals with Rich Greene

The real edge in cybersecurity isn’t found in new tools, it’s built through timeless fundamentals and a mindset that never stops learning. In this episode, Ron sits down with Rich Greene, Senior Solutions Engineer and Instructor at SANS Institute, to uncover how true cyber value starts with skills, curiosity, and mindset. Rich shares his remarkable story of surviving a battlefield injury, retraining his brain, and how that journey shaped his approach to mastering cybersecurity. Together, they connect real-world lessons like the recent Discord breach to the core truth that even advanced systems depend on people who master the basics. Impactful Moments 00:00 - Introduction 02:00 - Discord breach and third-party risk 05:00 - Meet Rich Greene from SANS 06:00 - The power of mastering fundamentals 07:00 - Learning how to learn 08:30 - Rich’s story of rebuilding his memory 11:00 - Forcing the brain to grow stronger 12:00 - Top skills that get you paid 14:00 - Skills that lead to fulfillment 16:00 - Fundamentals that fuel long-term success 17:00 - The OSI model decoded 20:00 - Why operating systems matter 21:00 - Security operations fundamentals 23:00 - Why cloud is the #1 must-learn skill 25:00 - Final advice: sharpen your fundamentals   Links Connect with our Rich on LinkedIn: https://www.linkedin.com/in/secgreene/ Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

16 Loka 25min

How AI Elevates Cyber Hygiene with Jason Rebholz

How AI Elevates Cyber Hygiene with Jason Rebholz

What if protecting your digital twin becomes the new cyber hygiene? In this week's episode, Ron welcomes back cybersecurity leader Jason Rebholz, CEO of Evoke, to discuss how AI is reshaping the fundamentals of cyber hygiene. From data breaches and deepfakes to everyday habits that protect our digital lives, Jason shares how small actions and smarter use of AI can make all the difference. Together, they uncover how our growing digital footprints are giving rise to digital twins, AI replicas that can mirror our behaviors, voices, and even decisions, and what that means for the future of trust, identity, and security. Impactful Moments: 00:00 - Introduction 01:00 - The Neon app data leak story 03:00 - Why our voices are the new passwords 05:00 - How AI can strengthen cyber hygiene 07:00 - Jason’s mission to secure AI systems 09:00 - AI as a force multiplier for defenders 11:00 - Deepfakes and the new social engineering playbook 13:00 - Attackers’ use of AI and what it means for us 15:00 - The rise of digital twins and identity threats 19:00 - How to defend against “yourself” online 20:00 - Final reflection: Trust in the AI age   Links: Connect with Jason on LinkedIn: https://www.linkedin.com/in/jrebholz/ Check out the TechCrunch article on the Neon app data leak story: https://techcrunch.com/2025/09/25/viral-call-recording-app-neon-goes-dark-after-exposing-users-phone-numbers-call-recordings-and-transcripts/   Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

10 Loka 21min

Securing Software at AI Speed with Varun Badhwar

Securing Software at AI Speed with Varun Badhwar

The biggest security threat isn’t in the cloud, it’s hidden in the code you trust the most. In this episode, Ron sits down with Varun Badhwar, Co-Founder & CEO of Endor Labs, who shares why research shows that nearly 80–90% of application code comes from open source and third-party libraries, not your own developers. Varun discusses the unseen risks of AI-generated software, how attackers can now weaponize vulnerabilities in hours, and why precision in security matters more than ever. He also reveals how AI can be both the ultimate accelerator and the ultimate weakness in modern development.   Impactful Moments: 00:00 - Introduction 02:00 - Varun’s journey from RedLock to Endor Labs 04:00 - Why the software supply chain is broken 07:00 - AI coding assistants and insecure code risks 10:00 - The NPM self-replicating worm discovery 13:00 - Simple controls to enforce Zero Trust in code 16:00 - Pairing AI with security to prevent slop 19:00 - AI-powered security code reviews explained 22:00 - Why 88% of code goes unused 26:00 - Developer efficiency as the new security metric 29:00 - The next wave of AI-driven software threats   Links: Connect with our Endor on LinkedIn: https://www.linkedin.com/in/vbadhwar/     Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

2 Loka 34min

The End of Search and the Rise of AI Browsers and Voices with Ron Eddings

The End of Search and the Rise of AI Browsers and Voices with Ron Eddings

Search engines aren’t dying quietly, they’re being replaced in real time by AI browsers and voice agents. AI isn’t just answering questions anymore; it’s acting for us. In this episode, Ron Eddings explores how tools like NanoBrowser and Comet are reshaping browsing, why Google may be in trouble, and how AI voices are becoming the new interface for productivity. From breakthroughs to risks, this is a front-row look at how AI agents are changing how we work, connect, and live online.   Impactful Moments: 00:00 - Introduction 01:00 - AI agents as everyday tools 02:00 - Testing AI-powered browsers 03:00 - Comet: AI browser from Perplexity 04:30 - Why Google should be worried 05:30 - Real-world tasks for AI browsers 07:00 - Automating cybersecurity inventory 09:00 - Comet in action on LinkedIn 10:00 - Testing for malicious exploits 11:00 - Risks of persuasive AI prompts 12:00 - The rise of voice agents 13:30 - First real-world AI voice experience 15:00 - Security concerns with customer data 16:30 - Double-edged sword of AI adoption 17:30 - System prompt leakage vulnerabilities 18:00 - Why voice could shrink attack surfaces Links: Connect with Ron on LinkedIn: https://www.linkedin.com/in/ronaldeddings/   Check out NanoBrowser: https://nanobrowser.ai/ Check out Comet by Perplexity: https://www.perplexity.ai/comet Read the article ‘No more links, no more scrolling - the browser is becoming an AI Agent.’ here: https://venturebeat.com/ai/no-more-links-no-more-scrolling-the-browser-is-becoming-an-ai-agent Read the article ‘How Voice AI Prompt Injection Threatens Enterprise Security’ here: https://www.teneo.ai/blog/how-voice-ai-prompt-injection-threatens-enterprise-security   Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

25 Syys 18min

Where Automation Ends, Cyber Ingenuity Begins with Phillip Wylie

Where Automation Ends, Cyber Ingenuity Begins with Phillip Wylie

Some tools replace tasks. Others reshape the way we think about security. In this episode, Ron welcomes back Phillip Wylie, one of the most respected voices in offensive security, author, educator, and longtime friend of the Hacker Valley community. With over 27 years of experience across cybersecurity disciplines, Phillip has guided thousands of professionals through his books, talks, and mentorship. He shares how AI is reshaping pen testing and red teaming, the value of automating away repetitive tasks, and why the fundamentals of security will always matter. From defining red teaming in 2025 to guiding newcomers on how to break in, Phillip delivers insights that balance cutting-edge innovation with timeless wisdom. Impactful Moments: 00:00 - Introduction 01:00 - Why Phillip keeps podcasting 03:00 - AI opportunities in pen testing 04:30 - What automation should replace 06:00 - Red teaming vs pen testing in 2025 08:00 - Defining adversary emulation 10:40 - Building the ideal AI assistant 15:00 - The best AI use cases today 18:30 - AI-driven threat modeling 21:00 - Breaking into pen testing now 25:00 - Building a portfolio and personal brand 27:30 - Why in-person networking still matters   Links: Connect with Phillip on LinkedIn: https://www.linkedin.com/in/phillipwylie/   Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

18 Syys 33min

The Power of Showing Up: Daily Streams, Big Impact with Gerald Auger

The Power of Showing Up: Daily Streams, Big Impact with Gerald Auger

What if showing up with consistency could spark opportunities, create careers, and build a global movement? In this episode, Ron sits down with Gerald Auger, Ph.D., cybersecurity educator, content creator, and founder of Simply Cyber. Gerald shares how his daily livestream grew into a thriving community, why consistency is the key to influence, and how AI is reshaping the way cyber professionals work. From building SimplyCyberCon to launching a new pentesting venture, Gerry’s journey is a masterclass in community, creativity, and courage. This episode is filled with inspiration and practical takeaways for anyone ready to grow their career, brand, or business in cybersecurity.

11 Syys 34min

The Rise of the Autonomous Blue Team with Vineet Edupuganti

The Rise of the Autonomous Blue Team with Vineet Edupuganti

What if defenders had their own AI-powered task force, always on, always adapting, and finally one step ahead of attackers? In this episode, Ron welcomes Vineet Edupuganti, Founder and CEO of Cogent Security, to discuss how AI agents are rewriting the rules of cybersecurity. Vineet shares why traditional vulnerability management is fundamentally broken, why exposure management matters more than ever, and how Cogent is building an “AI Task Force” to give defenders the edge. From his early days in machine learning to reshaping the future of cyber defense, Vineet breaks down the urgent need for automation, context-driven insights, and explainable AI in security. Impactful Moments: 00:00 - Introduction 02:00 - Vineet’s journey into AI and cyber 04:30 - Why vulnerability management is broken 06:10 - Generative AI as a defender’s edge 08:20 - Why AI agents outperform brittle automation 09:45 - The first use cases for Cogent’s agents 12:00 - Rethinking tier-one SOC analyst roles 13:30 - The rise of exposure management (CTEM) 17:10 - Cogent’s vision for an AI task force 18:30 - Early wins and insights with Cogent 20:00 - Biggest misconceptions about AI in security 23:00 - What enterprises should demand from vendors 25:00 - Why explainability is essential in AI systems 27:00 - Startups vs incumbents in cybersecurity innovation 29:30 - Why enterprises must invest in AI now   Links: Connect with our guest, Vineet Edupuganti, on LinkedIn: https://www.linkedin.com/in/vineetedupuganti Learn more about Cogent Security: https://www.cogent.security    Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

4 Syys 37min

Turning AI Into Your Super Tool with Ron Eddings

Turning AI Into Your Super Tool with Ron Eddings

AI is neither friend nor foe, it’s both. The way we choose to use it determines whether it helps or harms. In this solo episode, Ron Eddings shares lessons from his first job at a grocery store, his early days in cybersecurity, and today’s AI-driven landscape. From productivity hacks like meeting transcription, to creative tools like content-aware editing, to the dark side of phishing and deepfakes, Ron shows why human judgment remains the ultimate defense. This is a passionate reminder that the real power isn’t in the tools, it’s in us. Impactful Moments 00:00 - Introduction 01:15 - AI is the tool, not the toolbox 03:00 - A grocery store scam that taught a life lesson 06:00 - The irreplaceable role of human judgment 07:30 - First cybersecurity job at Booz Allen Hamilton 09:00 - How AI boosts productivity with meeting transcription 12:00 - Creative shortcuts with AI in image and video editing 15:00 - Vibe coding and generative red teaming 17:30 - AI-powered phishing and scam emails 18:50 - Testing a deepfake voice on Ron’s mom 21:30 - Why curiosity and skepticism beat AI deception 22:30 - Final challenge: don’t serve AI—make AI serve you Links: Connect with our Ron on LinkedIn: https://www.linkedin.com/in/ronaldeddings/ Check out our upcoming events: https://www.hackervalley.com/livestreams Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Continue the conversation by joining our Discord: https://hackervalley.com/discord Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

28 Elo 22min

Suosittua kategoriassa Koulutus

rss-murhan-anatomia
voi-hyvin-meditaatiot-2
psykopodiaa-podcast
rss-liian-kuuma-peruna
jari-sarasvuo-podcast
aamukahvilla
rss-tule-tule-hyva-ero
rss-finnish-with-eemeli-podcast
rss-arkea-ja-aurinkoa-podcast-espanjasta
adhd-podi
psykologia
ihminen-tavattavissa-tommy-hellsten-instituutti
rss-luonnollinen-synnytys-podcast
rss-narsisti
ilona-rauhala
rss-niinku-asia-on
rss-uskonto-on-tylsaa
rss-monarch-talk-with-alexandra-alexis
rss-koira-haudattuna
rss-vapaudu-voimaasi