Mindset: Modern SOC Strategies for Cloud & Kubernetes (Ft Sergej Epp. Ex-Deutsche Bank)
Join Ashish Rajan in this episodeas he dives deep into the evolving world of cloud security with Sergej Epp, formerly of Deutsche Bank and Palo Alto Networks, now with Sysdig.Discover why traditional security approaches fall short in today's dynamic cloud-native environments, where workloads resemble swarms of drones rather than predictable trains. Sergej explains the critical shift from basic posture management (CSPM/CNAPP) towards runtime security, emphasizing the need for an "assume breach" mindset.Learn about the staggering reality that over 60% of containers now live for less than a minute and the immense challenges this poses for detection, incident response, and forensics.This episode covers:The evolution from traditional security to cloud-native and runtime security.Why CNAPP/CSPM is like a map, but runtime security is the essential radar.The complexities of modern incident response with ephemeral workloads.Key strategies for Security Operations Centers (SOC) adapting to the cloud.The importance of visibility, data collection, and tools for hybrid and even air-gapped environments.How AI is starting to aid security operations and forensics.Guest Socials: Sergej LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction: Cloud Security & The One-Minute Container Problem(01:31) Meet Sergej Epp: 20+ Years in Cybersecurity (Deutsche Bank, Palo Alto, Sysdig)(02:44) What is Cloud Native Today? From Train Stations to Airports with Drones(05:34) Runtime Security Explained: Why It's Crucial Now(11:05) The Evolution of Cloud Security: Beyond Basic Posture Management(13:49) Incident Response Evolution: Tackling One-Minute Containers(18:34) Who Needs Runtime Security? Platform Engineers, SOC Teams & More(21:01) Runtime Security as a Platform: Beyond Detection to Prevention & Insights(24:45) Cloud Security Program Maturity: From On-Prem to Cloud Native SOC(29:20) AI in SOC Operations: Speeding Up Forensics & Context
24 Apr 35min
Scaling Container Security Without Slowing Developers
Are you struggling to implement robust container security at scale without creating friction with your development teams? In this episode, host Ashish Rajan sits down with Cailyn Edwards, Co-Chair of Kubernetes SIG Security and Senior Security Engineer, for a masterclass in practical container security. This episode was recorded LIVE at KubeCon EU, London 2025.In this episode, you'll learn about:Automating Security Effectively: Moving beyond basic vulnerability scanning to implement comprehensive automationBridging the Security-Developer Gap: Strategies for educating developers, building trust, fostering collaboration, and understanding developer use cases instead of just imposing rules.The "Shift Down" Philosophy: Why simply "Shifting Left" isn't enough, and how security teams can proactively provide secure foundations, essentially "Shifting Down."Leveraging Open Source Tools: Practical discussion around tools like Trivy, Kubeaudit, Dependabot, RenovateBot, TruffleHog, Kube-bench, OPA, and more.The Power of Immutable Infrastructure: Exploring the benefits of using minimal, immutable images to drastically reduce patching efforts and enhance security posture.Understanding Real Risks: Discussing the dangers lurking in default configurations and easily exposed APIs/ports in container environments.Getting Leadership Buy-In: The importance of aligning security initiatives with business goals and securing support from leadership.Guest Socials: Cailyn's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Intro: Container Security at Scale(01:56) Meet Cailyn Edwards: Kubernetes SIG Security Co-Chair(03:34) Why Container Security Matters: Risks & Exposures Explained(06:21) Automating Container Security: From Scans to Admission Controls(12:19) Essential Container Security Tools (Trivy, OPA, Chainguard & More)(19:35) Overcoming DevSecOps Challenges: Working with Developers(21:31) Proactive Security: Shifting Down, Not Just Left(25:24) Fun Questions with CailynResources spoken about during the interview:Cailyn's talk at KubeCon EU 2025
17 Apr 28min
How Attackers Stay Hidden Inside Your Azure Cloud
In this episode, Ashish sits down with Christian Philipov, Principal Security Consultant at WithSecure, to explore the stealth tactics threat actors are using in Azure and why many of these go undetected.Christian breaks down the lesser-known APIs like Ibiza and PIM, how Microsoft Graph differs from legacy APIs, and what this means for defenders.The 3 common ways attackers stay stealthy in AzureWhy read-only enumeration activity often isn’t loggedWhat detection is possible and how to improve itHow conditional access and logging configuration can help defendersWhy understanding Microsoft Graph matters for security opsGuest Socials: Christian's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(02:09) A bit about Christian(02:39) What is considered stealthy in Azure?(04:39) Which services are stealthy in Azure?(06:25) PIM and Ibiza API(12:53) The role of Defender for Cloud(18:04) Does the Stealthy API approach scale?(19:26) Preventing Stealthy API attacks(21:49) Best Practices for Prevention in Azure(25:47) Behaviour Analysis in Azure(29:31) The Fun SectionResources spoken about during the interview:Christian's fwd:cloudsec talk - Staying Sneaky in Microsoft AzureChristian's Disobey Talk
10 Apr 35min
How Confluent Migrated Kubernetes Networking Across AWS, Azure & GCP
Ever tried solving DNS security across a multi-cloud, multi-cluster Kubernetes setup? In this episode recorded live at KubeCon, Ashish chats with Nimisha Mehta and Alvaro Aleman from Confluent's Kubernetes Platform Team.Together, they break down the complex journey of migrating to Cilium from default CNI plugins across Azure AKS, AWS EKS, and Google GKE. You’ll hear:How Confluent manages Kubernetes clusters across cloud providers.Real-world issues encountered during DNS security migration.Deep dives into cloud-specific quirks with Azure’s overlay mode, GKE’s Cilium integration, and AWS’s IP routing limitations.Race conditions, IP tables, reverse path filters, and practical workarounds.Lessons they’d share for any platform team planning a similar move.Guest Socials: Alvaro's Linkedin + Nimisha's Linkedin Podcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(01:55) A bit about Alvaro(02:41) A bit about Nimisha(03:11) About their Kubecon NA talk(03:51) The Cilium use case(05:16) Using Kubernetes Native tools in all 3 cloud providers(011:41) Lessons learnt from the projectResources spoken about during the interviewConfluent's Multi-Cloud Journey to Cilium: Pitfalls and Lessons Lea... Nimisha Mehta & Alvaro Aleman
2 Apr 15min
The New Future of Cloud Security: Vendor Lock-In, Runtime, and SOC Readiness
The cloud security landscape may have just shifted — and we're here to break it down.In this special panel episode, host Ashish Rajan is joined by an all-star group of cloud and cybersecurity experts to discuss one of the most important conversations in cloud security today: the changing nature of security architecture, SOC readiness, and how teams must evolve in a multi-cloud world.Guests include:Chris Hughes – CEO at Acqui & host of Resilient CyberJames Berthoty – Cloud and AppSec engineer, known for sharp vendor analysis and engineering-first content and Latio TechMike Privette – Founder of Return on Security, expert in cybersecurity economicsFrancis Odum – Founder of Software Analyst Cyber ResearchWe Cover:Why cloud security is now beyond CSPM and CNAPPThe impact of major market moves on enterprise cloud strategyWhat vendor lock-in really means in a multi-cloud eraHow runtime and real-time security are taking center stageThe rise of AI-SPM and AI-powered SOCsWhat CISOs and practitioners should actually be doing nowGuest Socials: David's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(02:05) A bit about our panelists(04:24) Current Cloud Security Landscape(09:36) Challenges with Multi-Cloud Security(18:06) Runtime Security for Cloud(23:34) Can SOC deal with CNAPP Alerts(26:23) CISO planning their cybersecurity program(32:38) Regulatory requirements in public sector(36:27) Success Metrics for Modern Cloud Security Program
26 Mar 51min
Detection Engineering with Google Cloud
Detection rules aren’t just for fun—they’re critical for securing cloud environments. But are you using them the right way? In this episode, Ashish Rajan sits down with David French, Staff Adoption Engineer for Security at Google Cloud, to break down how organizations can scale Detection as Code across AWS, Azure, and Google Cloud.Why prevention isn’t enough—and how detection fills the gapThe biggest mistakes in detection rules that could blow up your SOCHow to scale detections across hundreds (or thousands) of cloud accountsThe ROI of Detection as Code—why security leaders should careCommon low-hanging fruit detections every cloud security team should implementDavid has spent over a decade working in detection engineering, threat hunting, and building SIEM & EDR products. He shares real-world insights on how companies can improve their detection strategies and avoid costly security missteps.Guest Socials: David's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(03:06) What is Detection as Code?(03:41) What was before Detection as Code?(05:36) Business ROI for doing Detection as Code?(07:49) Building Security Operations in Google Cloud(12:41) Threat Detection for different type of workload(14:54) What is Google SecOps?(20:36) Different kinds of Detection people can create(24:46) Scaling Detection across many Google Cloud accounts(28:47) The role of Data Pipeline in Detection(31:44) Detections people can start with(34:14) Stages of maturity for detection(36:43) Skillsets for Detection Engineering(39:32) The Fun Section
20 Mar 42min
CNAPPs & CSPMs don’t tell the full cloud security story
In this episode we speak to Nick Jones, an expert in offensive cloud security and Head of Research at WithSecure to expose the biggest security gaps in cloud environments and why CNAPPs and CSPMs alone are not enough often.How cloud pentesting differs from traditional pentestingWhy CSPMs & CNAPPs don’t tell the full cloud security storyThe biggest cloud attack paths—identity, IAM users, and CI/CDWhy “misconfigurations vs vulnerabilities” is the wrong debateHow organizations should prepare for a cloud pentestWith real-world examples from red team engagements and cloud security research, Nick shares insider knowledge on how attackers target AWS, Azure, and Kubernetes environments—and what security teams can do to stop them.Guest Socials: Nick's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(02:40) A bit about Nick Jones(03:56) How has Cloud Security Evolved?(05:52) Why do we need pentesting in Cloud Security?(08:09) Misconfiguration vs Vulnerabilities(11:04) Cloud Pentesting in Different Environments(17:05) Impact of Kubernetes Adoption on Offensive Cloud Security(20:19) Planning for a Cloud Pentest(29:04) Common Attacks Paths in Cloud(33:05) Mitigating Common Risk in Cloud(35:14) What is Detection as Code?(41:17) Skills for Cloud Pentesting(45:28) Fun Sections
13 Mar 49min
Securing AI Applications in the Cloud
What does it take to secure AI-based applications in the cloud? In this episode, host Ashish Rajan sits down with Bar-el Tayouri, Head of Mend AI at Mend.io, to dive deep into the evolving world of AI security. From uncovering the hidden dangers of shadow AI to understanding the layers of an AI Bill of Materials (AIBOM), Bar-el breaks down the complexities of securing AI-driven systems. Learn about the risks of malicious models, the importance of red teaming, and how to balance innovation with security in a dynamic AI landscape.What is an AIBOM and why it mattersThe stages of AI adoption: experimentation to optimizationShadow AI: A factor of 10 more than you thinkPractical strategies for pre- and post-deployment securityThe future of AI security with agent swarms and beyondGuest Socials: Bar-El's LinkedinPodcast Twitter - @CloudSecPod If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:-Cloud Security Podcast- Youtube- Cloud Security Newsletter - Cloud Security BootCampIf you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity PodcastQuestions asked:(00:00) Introduction(02:24) A bit about Bar-el(03:32) What is AIBOM?(12:58) What is an embedding model?(16:12) What should Leaders have in their AI Security Strategy?(19:00) Whats different about the AI Security Landscape?(23:50) Challenges with integrating security into AI based Applications(25:33) Has AI solved the disconnect between Security and Developers(28:39) Risk framework for AI Security(32:26) Dealing with threats for current AI Applications in production(36:51) Future of AI Security(41:24) The Fun Section
6 Mar 45min