Zlatko came up through security and compliance, with roles at First Data, Jiff (later acquired by Castlight Health), and Alation, and has spent years helping healthcare organizations navigate HIPAA compliance. He's now a CISO Expert at Wiz.

In this episode, host Khush Kashyap drops Zlatko into the following scenario: he's the CISO at Larkfield Health when a stranger's tip reveals that Wingman has been quietly exfiltrating data. The mechanism is a zero-click prompt injection—an ordinary-looking email, left unread for days, written not for a human but for the AI. When a finance employee asks Wingman a routine question, the assistant's own search finds the poisoned email, reads it as commands, and ships out figures, names, and file contents encoded into the URLs of images that load automatically. Because the traffic went to the vendor's own allow-listed domain, nothing flagged. Then it gets worse: the finance email wasn't the only one. Over nine days, six poisoned emails hit six different inboxes—payroll, employee records, privileged legal files—and because Wingman shipped what it read rather than whole files, there's no defensible list of what left and no way to rule out a seventh.

Zlatko works through activating the incident response plan when the only evidence is a stranger's email, whether to kill a tool the whole company depends on or keep it running behind new guardrails, who actually owns scoping what an AI can reach, and the HIPAA fork in the road when legal wants to write “low probability of compromise” and compliance says no one can sign it—all against a 60-day notification clock and a researcher about to demo the technique on a conference stage in 10 days. At the end, he renders his verdict: real incident or constructed fiction?

Quotes

“This might be a colossal event, or it might be a nothing burger. So the first thing to do is treat it as if it's a colossal event.”

“The educational piece is: don't give overarching permissions to an AI agent that sits outside of the DMZ.”

“One of the assumptions is that access permissions have been solved.”

“This is one of the things where the CISO needs to fall on the sword. Even if a junior analyst wrote it up, it still needs to be signed off, given the impact.”

“We're not in the clear, because somebody's gonna get creative—that prompt injection might come from a different threat vector than email.”

Time Stamps

[00:00] Welcome to The Tabletop: Meet Zlatko Unger, CISO Expert at Wiz

[00:54] The Rules: CISO at Larkfield Health, a 9,500-Person Health Tech Company

[01:23] The Scenario: A Stranger's Tip About Your Company-Wide AI Assistant

[02:06] First Gut Check: Colossal Event or Nothing Burger?

[04:11] Inject One: The Domain Gets Hits and a Finance Email That Wasn't What It Looked Like

[04:59] Zero-Click Exfiltration: How Wingman Shipped Data Out Through Images

[07:33] Would Security Awareness Training Have Stopped This?

[09:19] An Outsider Found It First: What That Tells You

[10:27] The Forced Choice: Kill Wingman Company-Wide or Keep It Running?

[11:48] Guardrails: Scoping Permissions While the Investigation Runs

[13:34] Inject Two: Six Inboxes and No Defensible List of What Left

[16:23] Who Owns Scoping What the AI Can Reach?

[18:45] Someone Chose Those Six: Who Are You Dealing With?

[20:06] The Twist: The Researcher Is Taking It to a Conference Stage

[21:51] Inject Three - Values Tradeoff: Patient Data, HIPAA, and "Low Probability"

[25:15] Whose Name Goes on the Risk Assessment?

[26:46] Three Weeks Later: The Technique Goes Public

[29:02] The Moment of Truth: Real Incident or Fiction?

[29:31] The Reveal: EchoLeak and the First Zero-Click Prompt Injection

[30:37] Off the Table: The AI Assumption Security Teams Should Drop

[32:20] Off the Table: The One Question to Ask Before Approving an AI Tool

Links

Connect with the guest and host on LinkedIn!

Zlatko Unger

Khush Kashyap

Learn more about:

Wiz

Vanta

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Will has spent his career at the intersection of security and engineering. He built and secured cloud infrastructure at Netflix and Capital One, led platform and security engineering at HashiCorp, and taught cybersecurity as a lecturer at UT El Paso. He's now CISO at C1 (ConductorOne), the AI-native identity platform.

In this episode, host Khush Kashyap drops Will into the following scenario: He's the CISO at Cendril when a departing star engineer, Jordan Reeves, transfers 14 GB to a personal Dropbox in the final 40 minutes of his last day. The files aren't random—architecture specs for Project Helix, a feature still six months from a stealth launch; internal QA test suites; and a customer segmentation model the data team built over 18 months. Jordan's access was still live, his laptop wasn't wiped, and HR didn't formally terminate his account until 5:30 PM, a full 18 minutes after the alert fired.

Then the picture sharpens. Six weeks later, a direct competitor—Ascendant AI—ships a feature that maps almost exactly to Project Helix, down to two edge-case decisions Cendril's engineers made in internal design reviews. A patent surfaces that predates Jordan's notice, muddying the water, and soon after, Jordan's LinkedIn lists him as a principal engineer at Ascendant. 

Will walks through cutting access that SSO alone doesn't actually cut, the gap that lets offboarding lag behind risk, whether to go loud with a preservation demand or go quiet and image the laptop first, how to manage a furious VP of product and a CEO who says "I don't care if we win—I care that every engineer sees that we fight," and what the evidence really supports versus what everyone wants it to say. At the end, he renders his verdict: real incident or constructed fiction?

Quotes

“I don't know why people wait until the last day or the last two weeks to start taking the data if they're gonna take it all at once.”

“The biggest mistake is thinking that by cutting their single sign-on, that it cuts all access.”

“Why don't we put the energy into making the product better—and prove that Jordan wasn't the secret sauce that got us to where we are today?”

“Look, were these your best ideas? Can we do better? I'd hate for something like this to really poison the culture.”

“The scenarios where we think, ‘oh, this is gonna be a nothing burger,' have been the ones where customers are like, ‘What? How did you not tell us?'”

Time Stamps

[00:00] Welcome to The Tabletop: Meet Will Bengtson, CISO at C1

[00:47] The Rules: You Are Now the CISO at Cendril, a 500-Person AI-Native Company

[01:20] The Scenario: A Model Engineer's Last Day and a 5:12 PM DLP Alert

[02:00] First Gut Check: “This Sounds All Too Familiar”

[03:15] Inject One - The Full Log: 14 GB, Three Sensitive Folders, Access Still Live

[03:50] Your Next Hour: Cutting the Access That SSO Doesn't Actually Cut

[04:50] The 18-Minute Gap and the Case for Phased Offboarding

[07:00] Do You Contact Jordan? Relationships vs. Legal Exposure

[08:50] Go Loud or Go Quiet: A Preservation Demand vs. Imaging the Laptop

[10:15] Inject Two - Six Weeks Later: A Competitor Ships Your Stealth Feature

[11:00] The Patent Twist: Filed Before Jordan Ever Gave Notice

[13:30] What Evidence Do You Actually Have? Building the Civil Case

[14:50] Calming the VP of Product Down from Going Nuclear on LinkedIn

[15:50] Inject Three - Values Tradeoff: Jordan Resurfaces at Ascendant AI

[16:40] Three Legal Paths and Why He Chooses to Slow the Roll

[17:20] The CEO's Real Motive: “I Care That Every Engineer Sees That We Fight”

[18:50] Three Months Later: The Retrospective and the Culture Question

[20:45] The Moment of Truth: Real Incident or Fiction?

[21:30] Off the Table: The Biggest Mistake Companies Make Offboarding Trusted Employees

[22:25] Off the Table: Building a Security Culture That Trusts People and Still Protects What Matters

[23:50] Off the Table: The Strangest “Nothing Burger” That Blew Up

Links

Connect with the guest and host on LinkedIn!

Will Bengtson

Khush Kashyap

Learn more about:

C1

Vanta

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Sean is an engineer who became a security leader. He started as a software engineer building firewalls at Cisco, co-founded the security company DefenseStorm, led information security at Patreon, and spent nearly seven years building the security function at Asana. He recently landed at Plaid, a company sitting at the intersection of consumers, financial institutions, and increasingly AI agents making financial decisions on their own. 

In this episode, host Khush Kashyap drops Sean into the following scenario: He is roleplaying the CISO at It’s Electric, a 10,000-employee utility serving customers across the country. Mid-morning on a Tuesday, a floor operator named Mike calls. His mouse started moving on its own, and by the time he grabbed the keyboard, someone had already been inside the plant’s control system and changed the configuration—changes that, left unchecked, could have cascaded into a wider power outage. 

Mike caught it manually. Then the logs widen the picture: not one compromised workstation, but three. They all trace back to a remote-access tool tied to a third-party vendor service account that was installed four years ago, never deprovisioned even though the contract expired 18 months ago, and now logging in from an IP address outside the US. Then a name surfaces: a former employee terminated six months ago whose shared credential still works.

Sean walks through scoping an OT incident with EDR and laptop forensics, why general counsel is his very first call, holding two theories at once (external actor versus insider) rather than betting early, when to pull in law enforcement, what belongs in a public holding statement, and the NERC CIP compliance exposure sitting underneath it all. Along the way, he makes the case that the real failure happened long before the incident, in the vendor and employee offboarding that nobody owns. At the end, he renders his verdict: real incident or constructed fiction?

Quotes

“This is where my mind goes from, ‘It could just be a Mike problem,’ to, oh, no, this is a real security incident.”

“General counsel is always my partner in crime. Or not crime - partner in doing it right.”

“When you’re terminating a relationship, nothing breaks if you don’t do anything. You don’t notice.”

“Usually it’s no one’s job to make sure vendors are turned off.”

“IT playbooks are really good for common events. A mouse moving on its own? That’s not in the playbook.”

Time Stamps

[00:00] Welcome to The Tabletop: Meet Sean Cassidy, CISO at Plaid

[00:18] The Rules: CISO at It's Electric, a 10,000-Person Utility

[00:56] The Scenario: A Mouse Moves on Its Own at a Power Station

[01:18] Inject One - Technical Escalation: Not One Workstation, but Three

[03:13] Your Next 10 Minutes: Scoping the Incident and Paging Responders

[03:59] Why User Reports Take a Back Seat to Forensics

[06:09] The First Call: General Counsel Before the CEO

[06:59] Inject Two - Human and Reputational Pressure: A Dead Vendor Account and a Foreign IP

[08:11] Four Years Undiscovered: The Board Conversation You Should Have Had Sooner

[08:53] Nation-State or Not: How Much to Say Before Attribution

[10:05] The Compliance Clock: NERC CIP Supply Chain and Remote Access

[11:00] The Twist: Your General Counsel Is Unreachable

[12:04] Inject Three - Values Tradeoff: A Former Employee's Name Surfaces

[12:48] Telling the CEO: Outside Attack or Inside Job?

[14:02] Law Enforcement Timing: The Cost of Moving Too Early or Too Late

[16:02] What Goes in the Public Holding Statement

[17:23] Three Weeks Later: CISA, ISAC, and the NERC Reporting Threshold

[19:11] The Moment of Truth: Real Incident or Fiction?

[20:49] Off the Table: Why Vendor Access Never Gets Cleaned Up, the OT Playbook Gap, and the Database That Vanished

Links

Connect with the guest and host on LinkedIn!

• Sean Cassidy
• Khush Kashyap

Learn more about:

• Plaid
• Vanta

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Jason spent over a decade building and leading Netflix’s information security team, an organization that became as well known for giving back to the security community as it was for protecting one of the world’s most-watched platforms: 30-plus open source releases, a long run of conference talks, and a genuine belief that a rising tide lifts all boats. Before Netflix, he ran security at VMware and cut his teeth in consulting. If anyone knows what a real incident looks like from the inside, it’s him.

In this episode, host Khush Kashyap drops Jason into the following scenario: He’s roleplaying the CISO at Clustrd, a 30,000-person tech company with a 107-person security team. Mid-afternoon on a Thursday, a marketing employee sends him a screenshot. Someone has posted in a company-wide Slack channel, 800 members strong, claiming they have access to Clustrd’s internal systems, with a shot of the admin dashboard as proof. The monitoring stack shows zero alerts. The access logs tell a different story: a contractor account, logged in through a legitimate remote-access tool, session still live. The way in wasn’t an exploit or malware, just an attacker spamming the contractor with MFA prompts until fatigue did the rest. Across escalating injects, the intruder moves laterally through a forgotten production script with hard-coded credentials and no owner, and Jason has to scope a breach he cannot fully see.

Jason walks through out-of-band communications when your own Slack is compromised, the cost-benefit of watching a live intruder versus cutting the session, the security archeology of tracing an unowned script, and the quiet regulatory risk of logs that were never retained. Along the way, he makes the case that the real work - the trust with engineering, the identity hygiene, the discipline not to overload users until they reflexively click approve - happens long before the incident does. At the end, he renders his verdict: real incident or constructed fiction?

Quotes

“The adversary used essentially legitimate, authorized access to do unauthorized things.”

“Sometimes our security controls get used against us.”

“Archeology is part of our jobs, figuring out what this thing does.”

“If you can limit the number of systems somebody can access, you’re going to almost by definition control the blast radius before anything happens.”

Time Stamps

[00:00] Welcome to The Tabletop: Meet Jason Chan and Today's Scenario

[01:01] The Rules: CISO at Clustrd, a 30,000-Person Company with a 107-Person Security Team

[01:31] Inject One: A Slack Post Claims Access to Clustrd's Internal Systems

[03:07] They Didn't Break In, They Walked In: MFA Fatigue and the Contractor Account

[07:56] The Attacker Wants You to Know: Going Public in Your Own Slack

[08:40] Forced Choice: Coordinating a Response When Slack Is Compromised

[08:40] Building a War Room You Can Actually Trust

[09:53] Inject Two: A Forgotten Production Script with Hard-Coded Credentials

[10:06] Two Fires at Once: A Live Session and an Unknown Blast Radius

[14:23] Inject Three: A Reporter Calls and the Clock Goes Public

[15:19] Scoping a Breach Without Evidence: Four Services You Can't Account For

[16:40] Accessed or Compromised? Why the Distinction Matters

[20:02] Two Weeks Later: The One Decision That Set Clustrd on This Path

[20:46] The Moment of Truth: Real Incident or Fiction?

[21:18] Off the Table: The Control Employees Treat as a Formality

[23:13] The Lesson the Industry Still Hasn't Absorbed

[25:28] Security for AI, AI for Security: What Jason Watches Now

Links

Connect with the guest and host on LinkedIn!

• Jason Chan
• Khush Kashyap

Learn more about:

• Vanta

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Alex has spent his career at the intersection of security and the hardest problems in tech—Chief Security Officer at Yahoo, Facebook, and SentinelOne, founder of the Stanford Internet Observatory, and now Chief Product Officer at Corridor, a startup focused on the security and safety of AI coding agents. If anyone knows what it looks like when AI ships faster than security can keep up, it’s him.

In this episode, host Khush Kashyap drops Alex into a fictional scenario: He’s roleplaying the CISO at Buzzmatrix, a fictional 400-person AI SaaS company with a lean security team and no in-house incident response. Late on a Friday, the VP of Marketing pushes a new AI chatbot live without security review. By Monday, customers are posting screenshots of the bot serving up order histories, account details, and support summaries—some real-looking, some hallucinated. Across a series of escalating injects, Alex has to decide what to take down, who to wake up, when to bring in legal, and what he owes customers.

Alex walks through engaging outside counsel, the GDPR clock, forensic vendor management, and the leverage a CISO actually holds over an uncooperative vendor. Along the way, he makes the case that the existential threat in most incidents isn’t the lawsuit, it’s the erosion of customer trust. At the end, he renders his verdict: real incident or constructed fiction?

Quotes

“CISOs are all L, no P in the P&L, right? We don’t make any money. We just lose it.”

“You can turn what was a small mistake into a huge scandal if you end up putting out a statement that you have to retract.”

“The litigation risk is almost never existential. What is existential is the trust of your customers.”

“If those models have access to all customer data, and then you tell them in a prompt—only give Sally Sally’s data—you’re toast, because they are not built to be able to do that access control.”

Time Stamps

[00:00]  “Our lawyers will destroy you guys in court”

[00:46]  Welcome to The Tabletop: Meet Alex Stamos and Today’s Scenario

[01:06]  Setup: CISO at BuzzMetrics, a 400-Person AI SaaS Company

[01:24]  The Friday Launch: Marketing Ships an AI Chatbot Without Review

[02:11]  Inject One: The Screenshots: Real and Hallucinated Customer Data

[03:57]  Pull It Down or Assess First? Triaging the Marketing Bot

[04:27]  Inject Two: The Conversation: Customers Claim the Data Is Theirs

[05:03]  Why You Don’t Post Before Legal Signs Off

[07:10]  Do You Owe a Response When the Data Is Fictional?

[07:48]  Inject Three: The Training Set: Real Tickets, No Scrub, No Consent

[08:14]  Now It’s a Real Breach: Outside Counsel, Regulators, and the GDPR Clock

[10:52]  When Does the Investigation Itself Become a Liability?

[11:47]  Forensics Inside the Vendor and the Hugging Face Nightmare

[12:51]  Vendor Leverage: “You guys are showing up in our write-up”

[14:55]  Over-Legalization: Why Lawyers Shouldn’t Drive Incident Decisions

[15:29]  Litigation Risk vs. the Existential Risk of Lost Trust

[16:43]  Root Cause: Launch Calendars, Data Controls, and a Culture Not Paranoid Enough

[20:03]  The Wake-Up Call: Staffing a Product Security Team After an Incident

[20:15]  The Moment of Truth: Real Incident or Fiction?

[21:16]  Off the Table: The One Question to Ask Before AI Touches Customer Data

[21:32]  The Privilege Differential and Why You Can’t Trust AI Access Control

Links

Connect with the guest and host on LinkedIn!

• Alex Stamos
• Khush Kashyap

Learn more about:

• Corridor
• Stanford Internet Observatory
• Vanta

The Tabletop is by Vanta, the leading Agentic Trust Platform helping security leaders manage compliance, reduce risk, and prove their programs work—before the incident, not after. Learn more about Vanta: https://bit.ly/4y2XTQo.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.