Securing AI at the Speed of Engineering | DoorDash | Forward Deployed Security | GRC Engineering

Securing AI at the Speed of Engineering | DoorDash | Forward Deployed Security | GRC Engineering

Is your security team moving at the speed of your engineering team? In this special live recording of the AI Security Podcast from San Francisco, Ashish is joined by Nick Reva (Global Director, Engineering Security, DoorDash) and Shivani Doke to tackle the two most critical conversations in AI right now: Proactive Offensive Security and the evolution of GRC .

In the first half, Nick explains why traditional AppSec teams fail to keep up with AI development, and shares his strategy for building "Forward Deployed" tiger teams that embed directly with product engineers . Nick also coins the term "Claude Kiddie", a new breed of script kiddies using AI to generate sophisticated bug bounty reports and argue with triage administrators .

In the second half, Shivani defines the emerging role of the "GRC Engineer." As AI compresses the software development lifecycle and introduces complex third-party (and fourth-party) risks, static PDF policies and manual compliance screenshots are dead . Learn how GRC is shifting left, embedding guardrails directly into CI/CD pipelines, and eventually using AI agents to automate the bane of every compliance officer's existence: evidence collection.

Questions asked:

(00:00) Introduction: Live from San Francisco (04:00) Audience Story: How an AI Agent Exfiltrated Data via a Vibe-Coded App (06:50) Meet Nick Reva: Securing DoorDash at Silicon Beach (08:30) "Shift Far Left": Embedding Tiger Teams in AI Development (09:30) Using PromptFoo for Automated Prompt Injection Testing (11:30) Why Security Must Operate at the Speed of Engineering (12:30) The Netflix Model: Forward Deployed Security Engineers (15:30) AI-Enabled Threat Modeling and PR Reviews (19:30) Build vs. Buy: Why Speed Matters More Than Money in AI Security (24:30) The Rise of the "Claude Kiddie" in Bug Bounties (30:30) Who Owns AI Risk in the Enterprise? (Business vs. Security) (37:00) Meet Shivani Doke: The Evolution of GRC Engineering (38:30) Why Traditional Compliance Standards (SOC2/ISO) Fail with AI (43:30) Owning Third-Party AI Risk vs. In-House AI Risk (44:30) The Death of PDF Policies: Shifting GRC Left into CI/CD (50:30) The New Privacy Paradigm in Third-Party SaaS Reviews (52:30) Dealing with Unauthorized AI Software Expensed on Corporate Cards (57:30) Fourth-Party Risk and Transitive Dependencies in the Cloud (01:00:30) Will GRC Agents Finally Automate Compliance Screenshots?

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(57)

Baiting the Bot: How to Use Deception to Stop Autonomous AI Agents

Baiting the Bot: How to Use Deception to Stop Autonomous AI Agents

When AI agents start swarming your enterprise, they won't care about stealth. They will land a beachhead and instantly spawn 500 agents to crawl, probe, and exfiltrate data at machine speed. Is your d...

23 Juli 51min

Why AI Agents Are Forcing a Redesign of Application Security?

Why AI Agents Are Forcing a Redesign of Application Security?

When the CEO of Anthropic declares that human coding will disappear within six months, followed quickly by the death of software engineering itself, what does that mean for the future of cybersecurity...

26 Juni 51min

Why Asset Intelligence is Replacing the CMDB & Static Dashboards

Why Asset Intelligence is Replacing the CMDB & Static Dashboards

Why do CISOs still struggle with asset intelligence in 2026? Despite decades of security tooling, most organizations still have a massive 40% "dark matter" blind spot in their environment and the expl...

11 Juni 42min

The AI AuthZ Problem: Why Human Least Privilege Fails for Autonomous Agents

The AI AuthZ Problem: Why Human Least Privilege Fails for Autonomous Agents

Why are security leaders terrified of connecting AI agents to production data? Because unlike humans, AI agents don't apply judgment, and they operate at machine speed, meaning they can relentlessly h...

4 Juni 47min

Verification vs. Validation: How Autonomous AI is Changing Cybersecurity

Verification vs. Validation: How Autonomous AI is Changing Cybersecurity

Are autonomous AI agents operating unchecked in your enterprise? With the release of open source frameworks like OpenClaw, deploying an AI agent is now as simple as texting, but it comes with massive,...

13 Maj 1h 10min

The Zero-Click AI Hack: How to Contain the Blast Radius of Autonomous Agents

The Zero-Click AI Hack: How to Contain the Blast Radius of Autonomous Agents

Is an AI agent's identity a workload or an action? Ashish spoke to Elie Bursztein, Distinguished Research Scientist and co-author of Google SAIF (Secure AI Framework) about how it is neither and that ...

29 Apr 47min

Buy vs. Build AI Security: Why [Box.com](http://Box.com) CISO is Creating their Own Agentic SOC

Buy vs. Build AI Security: Why [Box.com](http://Box.com) CISO is Creating their Own Agentic SOC

If your AI solution is just helping humans process the same amount of alerts a little faster, you haven't transformed anything, you've just created a faster hamster wheel.In this episode, Ashish and C...

22 Apr 46min

Populärt inom Teknik

uppgang-och-fall
market-makers
rss-laddstationen-med-elbilen-i-sverige
skogsforum-podcast
elbilsveckan
 och-bilen-gar-bra
bli-saker-podden
rss-uppgang-och-fall
natets-morka-sida
rss-veckans-ai
rss-en-ai-till-kaffet
developers-mer-an-bara-kod
hej-bruksbil
rss-technokratin
rss-milpodden
solcellskollens-podcast
rss-it-sakerhetspodden
algoritmen
ai-sweden-podcast
rss-fabriken-2