Risky Business Features

45:58

Bug count sounds impressive... but means little

Risky Business Features ·

2026/10/02

In this solo Risky Business Features episode, James Wilson explains why “number of bugs” fixed in any given update is a misleading metric. We’ve seen up to 1,000 individual bug fixes in a single update recently, but that doesn’t give defenders the full picture they need to manage risks.Not all bugs are equally exploitable, so the industry needs to catch up to the bugpocalypse with more transparency. And maybe an entirely different approach to patching.

en

45:44

How to launder illicit Bitcoin

Risky Business Features ·

2026/09/15

In this podcast episode, investigative journalist Geoff White joins James Wilson to talk about what happens to the money after ransomware gangs get a payday.The payment itself might be in the millions, but it’s difficult for gangs to convert their ill-gotten crypto gains into cash they can actually spend. Geoff explains the role of professional launderers and why cash-rich drug gangs are useful connections for crypto-rich cybercriminals. They also dive into who

en

75:04

Hunting software supply chain malware

Risky Business Features ·

2026/09/11

In this podcast episode, OpenSourceMalware founder Paul McCarty joins James Wilson to explain how researchers find and analyse malicious packages, GitHub repositories and developer tools.Paul walks James through static analysis, deobfuscation and reconstructing multi-stage kill chains to identify what attackers are trying to steal. They also discuss how LLMs make malware development easier while introducing operational security mistakes. The pair examine DPRK

en

40:46

Who gets to hack the hackers?

Risky Business Features ·

2026/09/03

In this podcast episode, Brad Arkin joins James Wilson to chat about the Trump administration’s call to let private entities conduct cyber operations against criminal groups.Brad’s firsthand experience responding to cyber incidents alongside US law enforcement gives him a unique perspective on how government and private sector relationships work, and how this program could improve the ability of both sides to tackle cybercrime. James and Brad also explore who might

en

29:22

How Brian Krebs doxxed TeamPCP

Risky Business Features ·

2026/08/28

In this podcast episode, James Wilson chats with Brian Krebs about the investigation that led him from recycled cybercrime handles and old forum records to the true identity of TeamPCP’s alleged leader in Perth.TeamPCP is the hacker group that has gone berserk in the software supply chain over the last year or so, stealing credentials to compromise developers, their software packages, and their repositories. In this interview Brian talks about his Signal

en

77:35

James Kettle on inventing new attack techniques with...

Risky Business Features ·

2026/08/17

In this podcast episode, James Wilson chats with PortSwigger’s Director of Research James Kettle about using an LLM to develop genuinely new attack techniques.Kettle has built what he calls the HTTP Terminator, an autonomous research system that generates and tests tens of thousands of potentially new HTTP desync techniques. The Terminator, which makes use of Kettle’s own research methodology, has already come up with new desync methods that James hadn’t thought of

en

83:49

How private LLM inference actually works

Risky Business Features ·

2026/08/07

In this podcast episode James Wilson chats with Tinfoil co-founder Tanya Verma about how you can run a powerful LLM in the cloud without the inference provider seeing your prompts.Tanya talks James through how private inference works, from trusted execution environments and hardware attestation, to TLS termination and GPU isolation. Customers can verify the exact code and model processing their data, while Tinfoil and its infrastructure providers remain locked

en

39:23

Benchmarks, borders and the true cost of AI regulation

Risky Business Features ·

2026/07/28

The US government is flirting with the idea of regulating most open weight models out of existence. What would that mean for everyone who’s currently using them?Policymakers who just look at the benchmarks and token costs might think frontier and open weight AI models are all interchangeable. That they can just banhammer them without causing any disruption. That’s far from the truth. In this solo podcast, James Wilson looks beyond the US vs China AI race rhetoric

en

48:03

Fortibleed: The bleeding edge of AI cybercrime

Risky Business Features ·

2026/07/16

In this podcast episode SOCRadar CISO Ensar Seker and James Wilson chat about the company’s deep dive into the Fortibleed campaign. A small investigation into a curiously open directory on an unknown server expanded into the discovery of an attack that targeted 400,000 Fortinet devices.As Ensar says, each time the SOCRadar team pulled a single thread, it led to a tapestry of AI-enabled cybercrime. They uncovered custom initial access, persistence and packet sniffing

en

44:24

What to do 'til the bugpocalypse gets here

Risky Business Features ·

2026/07/10

In this podcast episode Brad Arkin joins James Wilson to discuss how defenders can get ahead of the late-running bugpocalypse. While we’re confident the offensive cybersecurity capabilities of frontier and open-weight LLMs are real, attackers don’t yet seem able to fully utilise them. This creates a window of opportunity for defenders to tackle the threat. There are a few well-funded and seemingly overlapping industry efforts under way including Athena, Akrites, and

en

71:29

Mythos on your desk? Using local LLMs for code reviews

Risky Business Features ·

2026/06/30

In this podcast episode James Wilson chats with Karsten Nohl about his research into using local LLMs to replace cloud AI in security code reviews. In essence, Karsten created a hybrid code reviewing system where both cloud and local models are used to orchestrate, triage outputs, and write reports. In this system, only the local LLMs have source code access, with the cloud models used to manage the local models. In this “source-local” review technique, the source

en

35:14

Pitching security startups to VCs in the AI era

Risky Business Features ·

2026/06/23

In this podcast Patrick Gray and James Wilson chat with Decibel Partners founder and Managing Partner Jon Sakoda to talk about pitching cybersecurity startups to VC firms in the AI age. Coding agents and large language models have made it easier than ever to create software products, but despite this, the bar for what interests an investor is still largely the same. Everyone can run the marathon, but it’s usually the same few folks who finish first. So tune in to

en

43:05

How using open weight models can blow up in your face

Risky Business Features ·

2026/06/19

In this podcast episode James Wilson and Brad Arkin talk about how to safely use open weight large language models in the enterprise. The cost of frontier models was already driving interest in freely available open weight models like DeepSeek, Kimi and Qwen. But now the US government is forcing Anthropic to pull its Fable and Mythors models from the market, the argument for having greater control over your own AI stack is stronger than ever.But as you’ll hear in

en

52:39

The state of the art in AI model jailbreaks

Risky Business Features ·

2026/06/16

In this solo podcast episode, James Wilson breaks down the current state of AI model jailbreaks.If you’ve somehow missed the story, last week Anthropic released its Fable 5 and Mythos 5 models to the public. In the name of safety, both models were guardrailed up the wazoo, but that didn’t stop a bunch of jailbreakers from figuring out how to bypass at least some of their safety restrictions. In response to these guardrail bypasses the White House issued an export

en

38:32

Why NPM v12 won’t stop supply chain attacks

Risky Business Features ·

2026/06/12

In this podcast episode, James Wilson is joined by Open Source Malware Security co-founder Paul McCarty to talk about the supply chain attack mitigations coming in NPM v12. NPM disabling (by default) auto-run install scripts and dynamic dependencies is a positive step forward… but it’ll take years for this new version to be adopted, and these changes do nothing to prevent malicious packages being imported into projects. Further, Paul thinks disabling these features

en

23:02

Everything is getting much worse, much faster

Risky Business Features ·

2026/06/05

In this podcast Brad Arkin joins James Wilson to talk about how the fear of being left behind in the AI era means enterprises are taking risks that would have been considered insane just a couple of years ago.Fears around outages or being hacked have been trumped by fears of being labelled an AI laggard. So where are we all going? Say hello to tech debt-riddled, vibe-coded apps, crazy dependencies on AI providers, and an emerging threat landscape that can’t be

en

64:01

Solo podcast: A deep dive on TeamPCP

Risky Business Features ·

2026/06/02

In this solo episode, James Wilson takes a detailed look at TeamPCP. It started off by launching clumsy attacks against misconfigured Kubernetes clusters in September 2025. But by February this year, TeamPCP had skilled up and was smashing global software supply chains in the highest profile attacks of 2026. TeamPCP upskilled and turned the software development ecosystem into its personal credential harvesting machine. Here’s how TeamPCP did it, and what we can

en

36:51

How to survive supply chain attacks

Risky Business Features ·

2026/05/25

In this podcast James Wilson chats with Brad Arkin about why software supply chain attacks have gone from rare, once-in-a-while disasters to an operational problem affecting mainstream enterprises almost daily.AI has made attackers faster, and “vibe coding” means the number of environments pulling packages from the internet has gone to the moon. It also means legacy tooling that seeks out the bad packages and cleans them up isn’t enough. Package cooldown windows

en

18:56

How the CopyFail disclosure went sideways

Risky Business Features ·

2026/05/21

In this episode, Theori’s Brian Pak and Andrew Wesie join James Wilson to discuss why the CopyFail exploit was publicly disclosed before Linux distributions had their patches ready. As you’ll hear in this episode, mistakes were made and lessons learned. It’s worth a podcast, too, because in our opinion this incident foreshadows the inevitable problems that open source software will face in the unfolding vulnpocalypse.

en

29:25

NCSC’s Ollie Whitehouse on surviving the "bugpocalypse"

Risky Business Features ·

2026/05/18

In this edition of Risky Business Features Ollie Whitehouse, the CTO of the UK’s National Cyber Security Centre, joins Patrick Gray and James Wilson to talk about why “patch faster” will only get organisations so far in the face of the AI “bugpocalypse”.As Ollie explains, organisations will need to reduce internet-facing attack surface and make better architecture decisions as 0day discovery speeds up. This episode is also available on YouTube.

en

All Episodes

Similar Podcasts

Lead With AI

Tamara Nall

Manufacturing Matters

Tech B2B

The Good Tech Companies

HackerNoon

The Vergecast

The Verge

Computer America

Ben Crossman