“You can’t vibe code a customer.” Ron Gula started as an NSA pentester, co-founded Tenable and grew it into the company behind Nessus. Today he invests in cybersecurity and AI startups through Gula Tech Adventures. He has a front-row seat to the AI gold rush in security, and he’s not buying all of it.

We get into why AI may be blowing up entry-level jobs and entry-level companies alike, the hidden cost of “we’ll just build it ourselves,” who’s liable when your AI agent goes rogue, why phones are the weakest link in the enterprise, and why 2026 looks a lot like 1996. Ron also breaks down how he builds vRon, his AI alter ego that publishes a new video almost every day, and the five questions every founder should be able to answer.

🔗 Ron Gula on LinkedIn: https://www.linkedin.com/in/rongula/
🔗 Gula Tech Adventures: https://www.gula.tech
🔗 Ron’s videos (and vRon): https://www.youtube.com/@GulaTechAdventures

Chapters
0:00 Cold Open
0:51 Meet Ron Gula
1:59 How Ron feels about cyber right now
5:27 You can’t vibe code a customer
7:47 The hidden cost of “we’ll just build it”
10:37 Software margins and whether SaaS is cooked
15:53 Overfunded vs. underfunded in AI security
19:02 Who’s liable for your AI agent?
22:08 AI regulation and AI in the classroom
26:18 Why Ukraine may be the next Israel for startups
34:03 How a cyber startup breaks through the noise
39:50 Why nobody has automated risk yet
44:30 Your phone is the weakest link
45:50 How vRon gets made
56:00 Advice for founders and new cyber pros

Subscribe to ZeroSum for conversations with the people building and breaking cybersecurity.

#cybersecurity #AI #ZeroSum #startups #venturecapital

Some CISOs "can't handle the fire that's coming." Advisory CISO Gina Yacone on why the leaders who came up guarding the firewall are running out of road, and what the job looks like now.

Gina joins Aaron to trace how security leadership changed: from castle-and-moat network defense, to cloud and identity, to AI agents working inside the walls. They get into why compliance isn't governance, why budgets buy visibility but never remediation, how shadow AI turned employees into insiders, why board metrics only describe a sliver of the environment, and what resiliency means beyond backups. Plus Gina's advice for anyone who wants to lead security in the next era.

TIMESTAMPS

0:00 Cold Open

1:09 Welcome, Gina Yacone

2:44 From castle-and-moat to cloud to AI

8:28 Compliance isn't governance

10:42 Visibility budgets, no remediation

12:30 Why would AI security be free?

13:55 Gina's AI advice for CISOs

18:18 Shadow AI and data loss

21:26 Developers were incentivized wrong

23:48 Mythos and exposure management

27:24 The short-tenure CISO problem

32:38 Why security metrics are flawed

36:32 Tokens as a metric

40:42 AI layoffs or bad bets?

44:16 How much trouble are we in?

49:48 Never waste a good crisis

51:43 Personal resiliency and cyber careers

58:08 Where to find Gina

ABOUT GINA

Gina Yacone is an advisory CISO at Trace3, Vice President of ISSA Denver, a Rotarian, and a frequent keynote speaker. Follow her on LinkedIn: https://www.linkedin.com/in/ginayacone/

ABOUT ZEROSUM

ZeroSum is a cybersecurity podcast for practitioners and leaders navigating AI, breaches, and the business of security, hosted by Aaron Mog.

#cybersecurity #CISO #AIsecurity #securityleadership #shadowAI #infosec #ZeroSum

Jackson Reed built the red team at the US Army Corps of Engineers and took it through certification, then spent four years rebuilding and leading Target's. He isn't worried about swarms of agents overwhelming your SOC — defenders are good at bursty and anomalous. What concerns him is the operator with ten thousand actions a day of compute budget who spends ten of them, in each of a thousand environments, for a year.

We get into what a six-month timeline does to log retention and correlation windows, the two opposite ways red teams fail, why the frontier labs stopped measuring what matters in their system cards, and the Bronze Age analogy that explains most of the AI tooling being built right now.

TIMESTAMPS
0:00 Cold Open
1:14 Meet Jackson Reed
6:29 Are You Hopeful or Upset?
12:33 Patience Beats Zero-Days
21:21 Agents Criminals Don't Have to Trust
24:01 Red Teaming in a Hall of Mirrors
29:46 Can AI Clone a World-Class Red Team?
33:35 What's Actually Scalable with AI
38:05 One Frontier Model, or Ten Thousand Custom?
40:58 AI Overkill: When Less Is More
44:58 YOLO Security
46:08 Chinese Models and Who Has Your Data
52:05 Barding: Can You Handle an Intrusion?
53:32 What System Cards Stopped Measuring
1:02:35 AI's Bronze Age
1:07:34 Holding an Industry Hostage
1:10:44 Where to Find Jackson

ABOUT JACKSON
Jackson Reed studied international affairs before moving into computer science through the CyberCorps Scholarship for Service. He did think tank and SOC analyst work, then threat attribution and intelligence analysis at CrowdStrike, built and led the red team at the US Army Corps of Engineers through certification, and rebuilt and led Target's. He launched Barding Defense in March and works with BT6 on assessments and jailbreaking for frontier labs.

Blog: twelvetables.blog
Barding Defense: bardingdefense.com

#cybersecurity #redteam #aisecurity #threatintel #infosec #aiagents