ZeroSum
ZeroSum is a cybersecurity podcast that discusses the state of the industry honestly, rejecting typical threat-of-the-week news. It uses game theory to examine how the cyber market often leaves practitioners losing while VC gambles win. The show features guests from various perspectives, including vendors, investors, workers, and CISOs.
Episodes
The Firewall CISO Era Is Over - wtih Gina Yacone
Some CISOs "can't handle the fire that's coming." Advisory CISO Gina Yacone on why the leaders who came up guarding the firewall are running out of road, and what the job looks like now.Gina joins Aaron to trace how security leadership changed: from castle-and-moat network defense, to cloud and identity, to AI agents working inside the walls. They get into why compliance isn't governance, why budg
AI Attacks That Take Six Months, Not Six Minutes - with Jackson Reed
Jackson Reed built the red team at the US Army Corps of Engineers and took it through certification, then spent four years rebuilding and leading Target's. He isn't worried about swarms of agents overwhelming your SOC — defenders are good at bursty and anomalous. What concerns him is the operator with ten thousand actions a day of compute budget who spends ten of them, in each of a thousand enviro
AI Doom, and Why We Can Still Unplug the Servers - with Greg Ose
Everyone's quitting a lab to warn us about the end of the world. Greg Ose, who has spent his career building product security programs from the inside and now does it at GitHub, isn't buying the hysteria — and his reason is boring in the best way.We built this. We can explain, step by step, how every one of these incidents actually happened, including the recent one the industry summarized as "our
EDR Gives Attackers Up to a 10-Minute Head Start - with Tim MalcolmVetter
Tim MalcomVetter says every major EDR runs a two-to-ten-minute ingestion delay, and that it hands attackers a head start no AI SOC can close. The fix, he argues, isn't more AI. Tim ran a red team at Walmart, co-founded Wirespeed, and now runs incident response at Coalition, the cyber insurer that acquired it. That's a rare seat. He can tell you what a vulnerability actually costs, because his empl
AI, Ransomware, & The Security Poverty Line - with Randy Rose
Is AI closing the cybersecurity gap between big cities and small towns — or leaving under-resourced communities even further behind?In this episode of ZeroSum, Aaron sits down with Randy Rose, Vice President of Security Operations & Intelligence at the Center for Internet Security (CIS), to expose what's actually happening on the front lines of state and local government cybersecurity.Randy le
The AI Hacker Myth - with Silas Cutler
Is artificial intelligence actually creating a new breed of super-hackers, or is the industry just selling panic?In this episode of the Zero Sum Podcast, Aaron sits down with Silas Cutler, one of the top security researchers in the industry and a Principal Reverse Engineer at Censys. Silas strips away the corporate marketing hype to reveal what threat actors are actually doing in the wild. They di
What AI Just Exposed About Your Data - with Ward Balcerzak
An employee typed his own name into Copilot and found out he was on the layoff list.Nobody hacked anything. Years earlier someone had used "share with all" in SharePoint, back when nobody could realistically guess the link. Then AI made everything trivially findable.Ward Balcerzak is Field CISO at Sentra with nearly two decades in data security across Accenture, Allstate, Carbon Black, and Fidelit
Why Every Cyber Company Sounds the Same - with Joel Benge
Every CISO or engineer who's ever been told no by a board should watch this.Joel Benge spent years as the communications lead for the Department of Homeland Security's CISO office before writing "Be a Nerd That Talks Good." He's spent his career on one problem: getting technical people the budget, the headcount, and the buy-in they deserve — and figuring out why they so often don't get it.Aaron an
I'm Not AGI Pilled. I'm Human Pilled - with Casey Ellis
"You know who will be hiring juniors again? Bad guys."Casey Ellis founded Bugcrowd and launched the first bug bounty programs on it back in 2012, pioneering crowdsourced security as a service. He co-founded disclose.io, sits on the Black Hat and DEF CON Policy review boards, and now runs Tall Poppy Group, angel investing and advising the next generation of security startups.Fresh off a week at Bla
Top 5 BlackHat Takes - with Aaron Mog
I've been going to BlackHat since 2001. This year, the scariest thing on the floor was a booth almost nobody was crowding.Fresh off plane from Vegas, this is a solo ZeroSum episode — no guest, just my top 5 takes from the week. The throughline: the industry is running on hype and extraction, while the one real capability shift sat in plain sight.We get into build vs. buy flipping, the "ask me abou
Malware Moves in 27 Seconds. Humans Can't Keep Up - with Graham Westbrook
Malware used to take 18 minutes to move through your network. Now it takes 27 seconds. Humans can't respond fast enough anymore.Graham Westbrook is VP of International Markets at SimSpace — the "AI Proving Grounds" for cybersecurity — with a background spanning DoD/DISA, CrowdStrike, Flashpoint, and a postgrad in AI from Oxford. Aaron sits down with him for a genuinely global, big-picture conversa
AI Is Better at Hacking Than He Is, and He's Not Worried - with Scott Behrens
He's an L8 Principal Engineer at Netflix — the kind of technical leader the company puts on the problems that decide whether it wins or loses. And he just watched AI out-hack him.Scott Behrens is an L8 Principal Security Engineer at Netflix, where over 11 years he's watched the security team grow from a handful of people to over a hundred. Today he's the technical lead for Netflix's Live product s
Why Security Always Failed and What Finally Changes That - with Justin Somaini
For 30 years, the security industry could never fully win. Justin Somaini explains what finally changes that.Justin Somaini is one of the people who helped define the modern CISO role — former CISO of Symantec, Yahoo, SAP, and Box, and now a Partner at YL Ventures. In this episode, Aaron sits down with him for a genuinely optimistic conversation about why security has always fallen short, and why
The Haystack Got Bigger. The Needles Didn't - with Ed Bellis
The haystack got bigger. The needles didn't. Ed Bellis on why the vulnerability problem stopped being human-scale.Ed built Kenna Security, sold it to Cisco, and is now back with Empirical Security, building custom AI models that predict which vulnerabilities will actually get exploited in your environment — not just which ones score high on a generic global list. He joins Aaron for a candid conver
We Don't Need to Throw Out Security, We Need to Update It. - with Diana Kelley
"We don't need to throw out what we've been doing all of our careers. We just need to be AI-aware in how we apply it."Diana Kelley — CISO at Noma Security, formerly CISO at Protect AI, and a 25+ year veteran of Microsoft, IBM, and Symantec — joins Aaron for a grounded conversation on what actually changes, and what doesn't, when AI enters security.We cover why trust boundaries and identity are sti
Is Anybody Safe? Adaptability in the Age of AI Disruption - with Mark Carney
Is any security company safe from AI disruption? Evolve Security CEO Mark Carney's answer: no and that's the wrong question anyway.Aaron talks with Mark Carney, CEO of Evolve Security and one of the OG figures in security services, about where the industry sits at a genuine inflection point. Mark breaks down why tech-enabled services are hotter than ever while human-only services are a dying breed
The Scariest Story a CISO Has Ever Told the Board - with Jason Loomis
"This is the scariest story I've ever had to tell my board."CISO Jason Loomis on what AI is really doing to security teams.Aaron sits down with Jason Loomis for a raw, funny, unfiltered conversation about AI's impact on security teams, careers, and the humans caught in the middle. Jason lays out his "farm team" problem: the tier-one SOC, GRC, and help desk roles that grow new talent are being auto
The Cyber Industry Is Moving Fast but Chasing the Wrong Things - with Cris Neckar
The cyber industry is moving faster than ever and Cris Neckar thinks it's chasing the wrong things.In the debut episode of Zero Sum, host Aaron Mog sits down with Cris Neckar, security researcher turned entrepreneur turned VC at Two Bears Capital in Whitefish, Montana. Cris traces his unusual path from hardcore offensive work to venture capital, and explains why the biggest roadblocks in security
Breaking In, Standing Out, and Becoming a "Data Shepherd" — with Wade Wells
Entry-level security jobs are vanishing so how does anyone break in now? Detection engineer and educator Wade Wells has thoughts.Detection engineer, educator, and B-Sides San Diego organizer Wade Wells joins Aaron for a practical, honest look at entering and surviving in security today. Wade, who teaches cybersecurity students across all levels, admits the field moves so fast he can no longer conf
