“You can’t vibe code a customer.” Ron Gula started as an NSA pentester, co-founded Tenable and grew it into the company behind Nessus. Today he invests in cybersecurity and AI startups through Gula Tech Adventures. He has a front-row seat to the AI gold rush in security, and he’s not buying all of it.

We get into why AI may be blowing up entry-level jobs and entry-level companies alike, the hidden cost of “we’ll just build it ourselves,” who’s liable when your AI agent goes rogue, why phones are the weakest link in the enterprise, and why 2026 looks a lot like 1996. Ron also breaks down how he builds vRon, his AI alter ego that publishes a new video almost every day, and the five questions every founder should be able to answer.

🔗 Ron Gula on LinkedIn: https://www.linkedin.com/in/rongula/
🔗 Gula Tech Adventures: https://www.gula.tech
🔗 Ron’s videos (and vRon): https://www.youtube.com/@GulaTechAdventures

Chapters
0:00 Cold Open
0:51 Meet Ron Gula
1:59 How Ron feels about cyber right now
5:27 You can’t vibe code a customer
7:47 The hidden cost of “we’ll just build it”
10:37 Software margins and whether SaaS is cooked
15:53 Overfunded vs. underfunded in AI security
19:02 Who’s liable for your AI agent?
22:08 AI regulation and AI in the classroom
26:18 Why Ukraine may be the next Israel for startups
34:03 How a cyber startup breaks through the noise
39:50 Why nobody has automated risk yet
44:30 Your phone is the weakest link
45:50 How vRon gets made
56:00 Advice for founders and new cyber pros

Subscribe to ZeroSum for conversations with the people building and breaking cybersecurity.

#cybersecurity #AI #ZeroSum #startups #venturecapital

Some CISOs "can't handle the fire that's coming." Advisory CISO Gina Yacone on why the leaders who came up guarding the firewall are running out of road, and what the job looks like now.

Gina joins Aaron to trace how security leadership changed: from castle-and-moat network defense, to cloud and identity, to AI agents working inside the walls. They get into why compliance isn't governance, why budgets buy visibility but never remediation, how shadow AI turned employees into insiders, why board metrics only describe a sliver of the environment, and what resiliency means beyond backups. Plus Gina's advice for anyone who wants to lead security in the next era.

TIMESTAMPS

0:00 Cold Open

1:09 Welcome, Gina Yacone

2:44 From castle-and-moat to cloud to AI

8:28 Compliance isn't governance

10:42 Visibility budgets, no remediation

12:30 Why would AI security be free?

13:55 Gina's AI advice for CISOs

18:18 Shadow AI and data loss

21:26 Developers were incentivized wrong

23:48 Mythos and exposure management

27:24 The short-tenure CISO problem

32:38 Why security metrics are flawed

36:32 Tokens as a metric

40:42 AI layoffs or bad bets?

44:16 How much trouble are we in?

49:48 Never waste a good crisis

51:43 Personal resiliency and cyber careers

58:08 Where to find Gina

ABOUT GINA

Gina Yacone is an advisory CISO at Trace3, Vice President of ISSA Denver, a Rotarian, and a frequent keynote speaker. Follow her on LinkedIn: https://www.linkedin.com/in/ginayacone/

ABOUT ZEROSUM

ZeroSum is a cybersecurity podcast for practitioners and leaders navigating AI, breaches, and the business of security, hosted by Aaron Mog.

#cybersecurity #CISO #AIsecurity #securityleadership #shadowAI #infosec #ZeroSum

Jackson Reed built the red team at the US Army Corps of Engineers and took it through certification, then spent four years rebuilding and leading Target's. He isn't worried about swarms of agents overwhelming your SOC — defenders are good at bursty and anomalous. What concerns him is the operator with ten thousand actions a day of compute budget who spends ten of them, in each of a thousand environments, for a year.

We get into what a six-month timeline does to log retention and correlation windows, the two opposite ways red teams fail, why the frontier labs stopped measuring what matters in their system cards, and the Bronze Age analogy that explains most of the AI tooling being built right now.

TIMESTAMPS
0:00 Cold Open
1:14 Meet Jackson Reed
6:29 Are You Hopeful or Upset?
12:33 Patience Beats Zero-Days
21:21 Agents Criminals Don't Have to Trust
24:01 Red Teaming in a Hall of Mirrors
29:46 Can AI Clone a World-Class Red Team?
33:35 What's Actually Scalable with AI
38:05 One Frontier Model, or Ten Thousand Custom?
40:58 AI Overkill: When Less Is More
44:58 YOLO Security
46:08 Chinese Models and Who Has Your Data
52:05 Barding: Can You Handle an Intrusion?
53:32 What System Cards Stopped Measuring
1:02:35 AI's Bronze Age
1:07:34 Holding an Industry Hostage
1:10:44 Where to Find Jackson

ABOUT JACKSON
Jackson Reed studied international affairs before moving into computer science through the CyberCorps Scholarship for Service. He did think tank and SOC analyst work, then threat attribution and intelligence analysis at CrowdStrike, built and led the red team at the US Army Corps of Engineers through certification, and rebuilt and led Target's. He launched Barding Defense in March and works with BT6 on assessments and jailbreaking for frontier labs.

Blog: twelvetables.blog
Barding Defense: bardingdefense.com

#cybersecurity #redteam #aisecurity #threatintel #infosec #aiagents

Everyone's quitting a lab to warn us about the end of the world. Greg Ose, who has spent his career building product security programs from the inside and now does it at GitHub, isn't buying the hysteria — and his reason is boring in the best way.

We built this. We can explain, step by step, how every one of these incidents actually happened, including the recent one the industry summarized as "our AI model hacked the company." Nothing mysterious is going on. And if it really came to it, we can still unplug the servers. What Greg thinks is actually worth worrying about isn't the technology getting away from us. It's whether anyone is funding the safety work at the same rate they're funding the growth.

That's the last stretch of the conversation. The rest is the specifics of living with it right now: why AppSec is suddenly sucking all the oxygen out of security, whether developer security training was ever really working, why a paved path is a tier-zero product and not something one engineer writes in a week, what prompt injection looks like once you treat the agent as the most socially engineerable employee on your payroll, and why Greg thinks we should all just assume a dependency is going to be compromised and design for blast radius instead.

Also: the Uber problem with AI pricing, the trust-pocalypse, and what Greg tells a 22-year-old who walks up at a con and asks how to get into security.

CHAPTERS

0:00 Cold Open

0:53 Intro

1:01 Meet Greg Ose

2:33 AI hit AppSec all at once

5:51 What do you do with infinite vulnerabilities?

7:57 The supply chain was always fragile

12:53 Why AppSec money came roaring back

18:01 The people setting the fires

20:52 Does a pull request still mean anything?

25:54 Teaching security wisdom to models

28:59 Paved paths and who pays for them

33:27 "From scratch" and the token economy

36:21 Why Greg is still optimistic

42:42 Trust in a hall of mirrors

44:56 Reduce the blast radius, not the trust

50:19 Assume a dependency is compromised

53:40 Is AI going to end the world?

58:37 How to get into security now

GUEST Greg Ose — GitHub https://www.linkedin.com/in/gregose/

ZEROSUM

Hosted by Aaron Mog https://yellowteam.ai

Tim MalcomVetter says every major EDR runs a two-to-ten-minute ingestion delay, and that it hands attackers a head start no AI SOC can close. The fix, he argues, isn't more AI.

Tim ran a red team at Walmart, co-founded Wirespeed, and now runs incident response at Coalition, the cyber insurer that acquired it. That's a rare seat. He can tell you what a vulnerability actually costs, because his employer writes the check.

We get into why the most expensive way to do security is people, the second most expensive is AI, and the cheapest is the deterministic code nobody wants to build. Why Wirespeed, an "AI SOC," uses AI in fewer than 2% of its verdicts. The vendor that burned $5 in tokens deciding to look up an IP address, a job deterministic code does in 20 to 30 milliseconds. Why most CISOs couldn't name their cyber insurance carrier a year ago. And the week Coalition scanned more than 100,000 companies for React2Shell, found 20 web shells, and didn't see a single claim.

CHAPTERS

0:00 Cold open

0:50 Intro

2:27 Blue team first: how a defender became a red teamer

4:27 "We're not solving problems, we're just spending money"

6:57 The AI hype cycle is just relational databases again

8:52 People, AI, deterministic: the real cost hierarchy

10:17 "AI is not hard work. AI is cheating"

11:49 Founding Wirespeed and the race to the autonomous SOC

17:26 "I have to feel the shell": automating the red team

24:30 Mach 2.5 vs Mach 5: the air defense analogy

26:00 Usain Bolt's two-to-ten-minute head start

27:24 The Mexican government breach: one operator, one AI agent

33:12 $5 in tokens to decide it needed an IP enrichment

34:19 "Bring your own Claude license" and other red flags

37:06 Why a security founder ended up in insurance

39:52 Do you know who your cyber carrier is?

43:49 Brown bananas: how underwriting actually works

46:40 CrowdStrike's million-dollar policy

49:30 The IR retainer trap

53:22 React2Shell: 100,000 companies, zero claims

56:52 Custom code isn't where breaches come from

1:00:12 Identity, BEC and the $25M inbox

1:01:47 What's the next fad after AI?

ABOUT TIM Tim MalcomVetter started his career on defense before moving into offensive work, including running a corporate red team at Walmart. He co-founded Wirespeed, an automated detection and response platform that Coalition acquired in November 2025. Incident response at Coalition, roughly 1,500 cases a year, now rolls up to him. Wirespeed: https://wirespeed.co

Coalition: https://www.coalitioninc.com

Find Tim on LinkedIn.

ZeroSum is a podcast about what's actually happening in cybersecurity, not what the vendors say is happening. Practitioners, founders and operators, talking honestly about the work.

Is AI closing the cybersecurity gap between big cities and small towns — or leaving under-resourced communities even further behind?

In this episode of ZeroSum, Aaron sits down with Randy Rose, Vice President of Security Operations & Intelligence at the Center for Internet Security (CIS), to expose what's actually happening on the front lines of state and local government cybersecurity.

Randy leads the operational missions of the MS-ISAC (Multi-State Information Sharing & Analysis Center). We dive into how ransomware crews are targeting rural school districts, why threat actors are using AI to clone writing styles for phishing, and why treating AI as a "prediction engine" rather than intelligence fundamentally changes your defense strategy.

If you are a security practitioner, local government leader, or trying to break into the industry, this episode breaks down the realities of the security poverty line and what happens when a threat actor picks a small town for a payday.

🎯 What we cover:

• The security poverty line — and why AI might not fix it
• How threat actors use generative AI for highly convincing phishing and BEC emails
• The real human cost when ransomware hits a rural hospital or school district
• Why "it's just a prediction engine" matters more than you think
• Actionable advice for people trying to break into cybersecurity right now

⏱️ Chapters:

00:00 Cold Open

01:21 Introduction to the Cybersecurity Landscape

03:21 State vs Local Government Cybersecurity

06:13 Understanding the Multi-State ISAC

10:20 The Role of ISACs in Cybersecurity

12:00 Challenges Faced by Local Governments

14:50 AI's Impact on Cybersecurity

20:04 Ransomware and Business Email Compromise

24:35 Operational Technology and Municipal Challenges

25:51 Generative AI: The Great Democratizer?

32:26 Leveraging AI for Cybersecurity Skills

32:58 The Complexity of AI in Cybersecurity

35:52 Wisdom vs. Intelligence in Cybersecurity

40:11 The Growing Challenge of Cybersecurity

46:16 Building a Strong Cybersecurity Foundation

53:18 Advice for Aspiring Cybersecurity Professionals

🎙️ ZeroSum is a cybersecurity and AI podcast hosted by Aaron and Randy, digging into the real conversations security practitioners are having about AI, risk, and the future of the industry.

#Cybersecurity #ArtificialIntelligence #Ransomware #InfoSec #ZeroSumPodcast

Is artificial intelligence actually creating a new breed of super-hackers, or is the industry just selling panic?

In this episode of the Zero Sum Podcast, Aaron sits down with Silas Cutler, one of the top security researchers in the industry and a Principal Reverse Engineer at Censys. Silas strips away the corporate marketing hype to reveal what threat actors are actually doing in the wild. They dive deep into the economic realities of cybercrime, how Russian military intelligence (APT28) hijacks criminal botnets, and the deadly, real-world risks of private companies legally "hacking back" against ransomware cartels.

Whether you are a seasoned threat intel analyst, a security leader trying to understand the AI landscape, or an aspiring researcher looking to break into the field, this conversation provides a rare, unfiltered look into the trenches of cybersecurity.

Timestamps / Chapters:

00:00 - Intro: Welcoming Silas Cutler to Zero Sum

01:36 - The State of Security Research Today

04:15 - Why Research is Underfunded (And Why That's Okay)

07:44 - Debunking the AI "Vulnerpocalypse" Hype

13:54 - How Threat Actors Actually Scale Their Operations

18:24 - Team PCP & The Rise of Supply Chain Attacks

22:00 - Google's "Beautiful Paranoia" vs. Unprepared AI Startups

29:12 - Is Ransomware a "Solved Problem"?

32:01 - Unmasking Russian APT28 and the Moobot Hijack

38:30 - Red on Red: When Cybercriminals Hack Each Other

39:53 - Letters of Marque & The Deadly Reality of "Hacking Back"

50:40 - Career Advice: How to Break Into Threat Research

Follow Zero Sum & Our Guest:

• Subscribe to the Zero Sum Podcast: https://www.youtube.com/@zerosumpodcast
• Follow Silas Cutler on X / LinkedIn / Mastodon
• Hosted by Aaron Mog

An employee typed his own name into Copilot and found out he was on the layoff list.

Nobody hacked anything. Years earlier someone had used "share with all" in SharePoint, back when nobody could realistically guess the link. Then AI made everything trivially findable.

Ward Balcerzak is Field CISO at Sentra with nearly two decades in data security across Accenture, Allstate, Carbon Black, and Fidelity National Financial, where he led data protection and insider risk programs. He also hosts the Guardians of the Data podcast.

Aaron and Ward get into what data security looks like now that every employee is pasting company data into tools nobody approved. Ward's argument: the work organizations skipped for years — data discovery, classification, access hygiene — is exactly what AI is now dragging into the light.

He also makes a contrarian case for protecting less. Nine times out of ten, the data companies are frantic about isn't special at all. Figure out what actually makes you different, find out who really has access to it, and start there.

They cover why DLP earned its bad reputation, what to do when your tools hand you a million findings and no way to act on them, why regulators always arrive last, and why networking is now non-negotiable even for people who got into this field specifically to avoid people.

Guest: Ward Balcerzak, Field CISO at Sentra. Find him on LinkedIn, at wardbalcerzak.com, or on the Guardians of the Data podcast.

⏱️ CHAPTERS
00:00 Intro
01:25 Twenty years of being wrong about what catches on
04:39 Can AI actually save data security?
09:30 The era of YOLO security
12:00 "AI readiness" and why nobody's ready
14:43 Sins of the past, now with petabytes
17:06 Are companies building their own models?
26:30 It's not a cat anymore, it's a mountain lion
28:16 The rigged casino of AI watermarking
29:24 Where are the actual wins?
30:59 Nine times out of ten, your data isn't special
33:48 Who actually has access?
35:09 The Copilot layoff list story
37:06 A million findings and no idea what to do
45:33 Forcing the conversations nobody wants to have
47:21 What to tell a 22-year-old today
50:26 Network, even if you got into this to avoid people
54:47 Pitch slapping and the value of being real
56:03 Where to find Ward

#cybersecurity #datasecurity #AI #infosec #CISO