ConversingLabs Podcast

Host Paul Roberts welcomes Conversing Labs  guest Steve Wilson, Chief AI and Product Officer at Exabeam and co-chair of the OWASP GenAI Security Project. Steve discusses his path from early programming to AppSec at Contrast Security and leading the OWASP Top 10 for LLMs, which grew into a large community and later an Agentic Top 10.Wilson explains AI’s recent leap via transformer architecture, cloud scale, and GPUs, and describes Exabeam’s evolution from SIEM and behavior analytics to generative and agentic AI with multiple security agents. He summarizes his 2024 O’Reilly book expanding OWASP risks into case studies and secure development practices, emphasizing that AppSec alone is insufficient for autonomous agents, requiring monitoring and “agent behavior analytics.” The conversation highlights AI supply chain risks (models, plugins/MCP, OpenClaw skills, fake Chrome extensions), scoping/least privilege, and the practical impact of tools like Claude Code on AppSec and security operations.00:00 Welcome and Guest Intro02:35 Steve’s Cyber Journey04:13 OWASP LLM Top 10 Origins06:21 From LLMs to Agents06:59 Tron and AI History09:32 Why Transformers Changed Everything11:35 What Exabeam Actually Does16:08 Writing the LLM Security Book20:27 Agent Risks Beyond AppSec22:05 What Changed Since 202423:30 Reasoning Models and Strawberry26:18 Agentic Top 10 and Supply Chain27:11 Hallucinated Dependencies27:47 Model Supply Chain Trust28:57 Plugins And Agent Exploits29:58 MCP And Skills Risks31:01 Chrome Plugin Trap33:47 RAISE Framework Overview35:12 Monitoring Digital Workers38:40 Scoping And RAG41:44 Excessive Agency Controls43:02 Sandboxed Assistant Build45:16 AI Impact On Infosec49:15 Closing And Contact

In this episode of ConversingLabs Podcast, host Paul Roberts interviews ReversingLabs Chief Trust Officer Saša Zdjelar about the recent Notebook++ hack and what he thinks software supply chain security will look like in 2026. The two will also discuss the findings of RL’s fourth annual report on the subject, which offers six predictions for how threats will evolve, as well as how security teams will respond. Also, Saša will share his take that the technology industry needs to move away from a “move fast and break things” mindset in order to best secure software supply chains.Read Saša's commentary for Cyber Scoop here: https://cyberscoop.com/move-fast-break-things-cybersecurity-supply-chain-security-op-ed/ Read the 2026 Software Supply Chain Security Report here: https://www.reversinglabs.com/sscs-report

In this episode of ConversingLabs Podcast, host Carolynn van Arsdale welcomes North Carolina State University Professor Laurie Williams and Ph.D. student Sivana Hamer to discuss their team’s research on the effectiveness of software supply chain security (SSCS) frameworks. Their study, “Closing the Chain,” (PDF) found that software products would still be vulnerable to attacks like SolarWinds, Log4j and XZ Utils – even if they fully enforced 10 well-known SSCS frameworks published by government, industry, academia and open source.

In this episode of ConversingLabs, host Paul Roberts interviews Casey John Ellis, founder of Bugcrowd, about the state of vulnerability management and bug bounties in 2025. Casey shares his insights on current changes impacting both the threat landscape and the cybersecurity industry, such as matters at the federal level and increased AI usage. Looking at the future, Casey also mentions how important it is to welcome the next generation into cybersecurity.  

In this episode of ConversingLabs, host Paul Roberts interviews Abigail Cabunoc Mayes, who is responsible for Open Source Maintainer Programs at GitHub – the world’s leading development platform – about the uncertainty of open source’s future. This uncertainty is caused by a steady decline in Gen Z maintainers, which presents a major software supply chain security risk. Abigail will explain how in order to welcome and retain young maintainers, the OSS community must understand the perspectives of Gen Z, and ensure their needs are met. She will also walk through actions that the community can immediately take to address this growing uncertainty.Read Abigail's blog post on the topic here: https://github.blog/open-source/maintainers/who-will-maintain-the-future-rethinking-open-source-leadership-for-a-new-generation/

In this episode of ConversingLabs, host Carolynn van Arsdale interviews Kadi McKean, Community Manager at ReversingLabs, to discuss a new initiative aimed at securing the open source software supply chain: the Spectra Assure Community Badge. As a result of threat actors continuing to target open source software (OSS) platforms like PyPI and npm, it’s become increasingly difficult for developers to avoid malicious packages. Kadi explains how this new, free badging system can help the community quickly identify which open source projects meet the most rigorous security standards. If you're a maintainer and want to work with Kadi, email [email protected]. 

In this episode of ConversingLabs, host Paul Roberts interviews Jiwon Ma, Senior Policy Analyst at the Foundation for Defense of Democracies (FDD), about her recent report that addresses the urgent cybersecurity challenges facing the aviation industry. The report, "Turbulence Ahead: Navigating the Challenges of Aviation Cybersecurity" (PDF), analyzes a number of factors that are putting U.S. aviation infrastructure at increasing cyber risk, including how weaknesses in the software supply chain pose serious risks to the industry.

In this episode of ConversingLabs, host Paul Roberts interviews Major Joe Spracklen, a PhD student at the University of Texas at San Antonio, who recently published a paper with his peers regarding the threat posed to software supply chains caused by code-generating Large Language Models (LLMs). The paper, “We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs” (PDF), discusses how the rise of these LLMs can create package hallucinations that arise from fact-conflicting errors – representing a novel form of package confusion attack.

In this episode of ConversingLabs, host Paul Roberts interviews Chuck McWhirter, principal solutions architect at ReversingLabs, about the importance of sticking to basics when it comes to thwarting attacks from adversaries. Chuck recounts his experiences in both the public and private sectors, including his efforts in securing the 2002 Olympics – back when the Security Operations Center (SOC) had not yet evolved. The details of Chuck’s journey shed light on how enterprise security teams can better handle the cyber threats stemming from nation-state adversaries. By minimizing cybersecurity tool sprawl and alert fatigue, as well as assessing situational risk, Chuck argues that security teams stand a better chance against attackers.  

In this episode, host Carolynn van Arsdale interviews Tanya Janca (aka SheHacksPurple), a world-renowned application security (AppSec) leader, author, speaker and educator. In addition to having multiple bestselling books, such as ‘Alice and Bob Learn Secure Coding,’ Janca is the founder of We Hack Purple and leads education and community for Semgrep. In their conversation, they discuss how Janca’s career embodies AppSec Girl Power: Beginning from her start as a software developer, up to her current success as a prominent thought leader in AppSec and secure coding philosophy. Subscribe to Tanya's newsletter here, and if you're an AppSec professional, take her survey here. Find Tanya on social media:https://bsky.app/profile/shehackspurple.bsky.social https://twitter.com/shehackspurplehttps://www.linkedin.com/in/tanya-jancahttps://infosec.exchange/@SheHacksPurplehttps://www.tiktok.com/@shehackspurplehttps://www.youtube.com/shehackspurple  

In this episode of ConversingLabs, host Paul Roberts chats with Malcolm Harkins, Chief Security and Trust Officer at HiddenLayer, about cybersecurity’s double-edged sword: artificial intelligence (AI). Harkins will discuss what HiddenLayer has discovered in regards to AI-based threats to software supply chains, including research about DeepSeek R1. The two will also identify which enterprise security tools lack the means to spot these developing threats. Finally, they’ll consider whether or not AI itself can be a part of the solution in out-pacing threat actors’ utilization of these risks.

In this episode of ConversingLabs, host Paul Roberts chats with Jason Valenti, director of product at ReversingLabs, about the evolution of threat intelligence and the growing role it’s playing in cyber defense. A former IT specialist at the FBI and director of product management at the firm CrowdStrike, Jason will touch on his journey prior to his RL career and his work to promote the use of threat intelligence in both the public and private sectors. Jason will also talk about the epidemic of sophisticated cybercriminal and nation state hacking campaigns and how enterprise security teams can leverage threat intel to contextualize- and push back against these pressing threats.You can find Jason on LinkedIn here. 

In this episode, host Paul Roberts chats with Security Researcher Sam Curry about his own experience being hacked via the Internet of Things and how it led to a shocking discovery regarding modem security. More broadly, the conversation touches on how APIs can leave consumers vulnerable, the increasing popularity of IoT attacks, and how to mitigate such risks. Check out Sam's blog post about his modem getting hacked here: https://samcurry.net/hacking-millions-of-modemsLearn more about Sam and Ian Carroll's research on airport security here: https://ian.sh/tsa

In this episode, host Paul Roberts chats with Beau Woods, Founder & CEO of Stratigos Security, about the history of the software bill of materials (SBOM) – from its beginnings, to its modern-day use, to efforts underway to adapt it for the future. SBOMs have exploded in popularity within the past two years, and are oftentimes considered synonymous with software supply chain security. However, SBOMs are not a new tool, and while they’re important – they certainly aren’t the end-all-be-all for mitigating modern threats to software supply chains. Woods will explain in this conversation how SBOMs have taken center stage in 2024, and how they will continue to impact the future of cybersecurity.

In this episode, host Paul Roberts chats with Tarah Wheeler, CEO of Red Queen Dynamics, about her recent Council on Foreign Relations piece regarding what the U.S. SEC’s prosecution of SolarWinds and new disclosure rules mean for the cybersecurity industry at-large. Wheeler believes that these new moves from the Commission emphasize the concept of “materiality” in cyber - graduating the industry to a level of enterprise risk it has never experienced before.

In this episode of the ConversingLabs podcast, host Paul Roberts chats with Daniel Adamitis, a Principal Information Security Engineer at Lumen Technologies’ Black Lotus Labs. They discuss his team’s discovery of an impossible-to-kill botnet packed with end-of-life SOHO routers, which is being used by a Chinese nation-state backed APT group as a covert data transfer network. The group, known as Volt Typhoon, is also well known for targeting U.S. critical infrastructure. 

In this episode, host Paul Roberts chats with Kevin Fu, an Electrical & Computer Engineering Professor at Northeastern University, about the new federal standards for the cybersecurity of medical devices, which includes the submission of software bills of materials (SBOMs) to the FDA. The two will discuss the new mandates for medical device manufacturers, as well as key takeaways for how these organizations can improve their software supply chain security programs. 

In this episode, host Paul Roberts chats with Ali Khan, Field CISO at ReversingLabs, about the recent takedown of the LockBit ransomware group, which is considered to be one of the most prolific cybercrime groups globally.

In this episode, host Paul Roberts chats with Karlo Zanki, a Reverse Engineer at ReversingLabs, about the state of software supply chain security in 2024. The two will review key findings on the software supply chain threat landscape in 2023, as well as what security and development teams can expect from malicious actors in 2024. Zanki will also highlight several of the major software supply chain security incidents discovered by RL threat researchers in the past year.

In this episode, host Paul Roberts chats with Mikaël Barbero, Head of Security at the Eclipse Foundation, about the state of open source software security. Eclipse has been around for more than two decades and has for a long time prioritized the mitigation of threats to open source projects. In their conversation, Mikaël chats with Paul about where Eclipse stands today, what current threats are being posed to open source repositories, as well as how nation-states and international organizations are working to combat these threats.  

In this episode, host Paul Roberts chats with Devin Byrd, Director of Threat Intelligence at Kandji on the sidelines of the 2023 Black Hat USA conference. In their conversation, Byrd discusses how Kandji has grown into a major security provider for macOS users, and how the attack vector for macOS and iOS users has increased in recent years. He explains that only dealing with adware and junkware on these devices was a thing of the past, but now, macOS devices are being targeted with malicious back doors and even software supply chain attacks. 

In this episode, host Paul Roberts chats with Kelly Shortridge, a Senior Principal at Fastly, on the sidelines of the 2023 Black Hat USA Conference. In their conversation, they discuss her new book, Security Chaos Engineering: Sustaining Resilience in Software and Systems, as well as her Black Hat talk, “Fast, Ever-Evolving Defenders: The Resilience Revolution.”  

In this episode of ConversingLabs, host Paul Roberts chats with Thomas Pace, the CEO & co-founder of the firmware security firm NetRise. Thomas and Paul talk about the shifting ground of threats and attacks as the Internet of Things grows and works its way into homes, businesses and industries - including critical infrastructure. They also talk about the growing specter of software supply chain threats and attacks. 

In this episode, host Paul Roberts chats with Daniel Woods, a Cybersecurity Lecturer at The University of Edinburgh on the sidelines of the 2023 Black Hat USA conference about his briefing: “Lemons and Liability: Cyber Warranties as an Experiment in Software Regulation.” 

In this episode, host Paul Roberts chats with Robert Martin of MITRE and Cassie Crossley of Schneider Electric about their session at this year’s RSA Conference. They explained how MITRE’s System of Trust can serve as a standard for software supply chain risk. The two also chatted with Paul about the greater issues facing software supply chains today, such as standardization and transparency. 

In this episode, host Paul Roberts chats with Naveen Srinivasan, an OpenSSF Scorecard Maintainer, about his talk at this year’s RSA Conference on how to better trust open source software. In their conversation, Naveen explains how the OpenSSF Scorecard tool can help developers understand the security posture of open source dependencies.

In this episode, we interview Chris Romeo, CEO of Kerr Ventures and long-time application security (app sec) practitioner on the sidelines of the 2023 RSA Conference. He gives a rundown on the state of app sec and comments on other software threats posed to organizations today. 

In this episode of ConversingLabs, host Paul Roberts chats with John Jackson, a security researcher, about the work he and research group Sakura Samurai did in looking at exposed secrets and other threats on Indian government websites. 

In this special Café edition of ConversingLabs, host Paul Roberts interviews Joshua Corman, the Vice President of Cyber Safety Strategy at Claroty and the Founder of I Am The Cavalry on the sidelines of the RSA Conference 2023 in San Francisco. Josh speaks with Paul about his RSAC track session, The Opposite of Transparency, which takes on skepticism of software bill of materials (SBOMs) and makes an argument for greater transparency around software supply chain risk. 

In this special edition episode of ConversingLabs, host Paul Roberts interviews ReversingLabs Director of Product Management, Charlie Jones, on the sidelines of the 2023 RSA Conference in San Francisco. Charlie speaks with Paul about his RSAC track session: The Rise of Malware Within the Software Supply Chain.

In this episode, host Paul Roberts chats with Devin Lynch, Director of Supply Chain and Technology Security for the Office of the National Cyber Director, about the National Cybersecurity Strategy released by the White House last month. They discuss the motivations behind this policy move, what its impact will be in the short and long term, as well as what else the federal government plans to prioritize in this area. Lynch also details upcoming plans the federal government has to better secure open source software as a part of the greater effort to secure software supply chains.  

In this episode, host Paul Roberts chats with Katie Mousourris, CEO and Founder of Luta Security. Mousourris has a robust background in creating and running bug bounty programs as well as professional hacking. In their conversation, she discusses the evolution of professional hacking and how important bug bounty programs have become to the cybersecurity field. She also highlights the problems these programs have faced as well as how they can help identify risks in other spaces like software supply chains. Finally, Mousourris paints a picture of what the future holds for bug bounties and the place of professional hackers.

In this episode, host Paul Roberts chats with Steve Lasker, a former Azure Program Manager with over 20 years of experience at Microsoft. Lasker touched on his industry experience to explain how the effort to secure software has evolved into what it is today. He then explained how government standards for software supply chain security globally will benefit the industry, and will cause a great shift in the market. He points out that the software providers who meet the greatest possible compliance in this area will succeed, given the concern that companies now hold over software supply chain attacks, as well as being held liable for them. 

Online fraud is among the most pernicious and devastating forms of cybercrime- measured by the financial and psychological toll it takes on victims. Phony tech support, online romance and business email compromise scams drain billions from our economy annually and take a huge toll on families, businesses and communities. And yet, it is often overlooked by cybersecurity experts and the larger information security industry. Scams, which frequently hinge on human frailty rather than the manipulation of software, are deemed unworthy of the attention of cybersecurity experts. Victim blaming is rife. But that dismissive attitude misses the point of these attacks and their impact. In this episode of ConversingLabs, we’re going to go deep on scams with Ronnie Tokazowski. Ronnie is a Principal Threat Advisor at the firm Cofense and widely recognized as “That BEC guy” - an expert in Business Email Compromise scams. Ronnie also hosts a YouTube channel, RonnieRants, where he explores some of the issues related to cybercrime, online scams and more. 

In September 2022, Microsoft released a report on a group they track as ZINC (also known as Lazarus), which is a state-sponsored group out of North Korea. The report details how ZINC has been using a set of trojanized, open source software implants dubbed ZetaNile (also known as BLINDINCAN) to attack a number of organizations since June 2022.The ReversingLabs Research Team decided to investigate ZINC’s use of ZetaNile, which yielded several helpful results. In this conversation, host Paul Roberts chats with Joseph Edwards, a ReversingLabs Malware Researcher, about what their investigation yielded. They discuss how the malicious actors pulled off these attacks, where the malicious code resides in the open source software, and how these implants serve the criminals’ malicious goals.

Supply chain attacks are not limited to SaaS (software-as-a-service) applications. Specific kinds of software, such as firmware, are also at risk of suffering supply chain attacks. Firmware is typically used to control hardware devices, and sits at a lower level, connecting high-level software with an operating system. It is important for the cybersecurity and application security industries to pay attention to this area of potential risk, and come up with mitigation strategies. That is why in this episode, Alex Matrosov, founder and CEO of Binarly.io, joined us to tell us more about the risks to firmware, and how we can better secure it from supply chain attacks.

The U.S. Federal Government's Enduring Security Framework (ESF) Working Panel released a guidance on "Securing The Software Supply Chain" in September, 2022. The ESF is made up of both government officials and industry practitioners, and this guidance with the intention of it being a "practical guide" for software developers. In this episode, host Paul Roberts chats with ReversingLabs Field CISO Matt Rose about the ESF's guidance: what it entails, whether or not it serves as helpful to software developers, as well as who should be paying attention to this guidance. 

Software Bills of Materials (SBOMs) are a helpful first step for an organization looking to secure its software supply chain. SBOMs serve as an ingredients list, pointing out all of the components that make up a software product, such as open source software packages, third party software and more. Federal guidance in the U.S. now strongly recommends the use of an SBOM by both software publishers and consumers. In this episode, host Paul Roberts chats with ReversingLabs Software Assurance Evangelist Charlie Jones on all things SBOM: what it is, how they are beneficial, who needs one, and more. 

The exploit known as Follina resurfaced in late May 2022 as researchers discovered its use in a phishing document campaign. ReversingLabs Malware Researcher Joseph Edwards hunted for Follina exploitation samples to observe what final payloads are being delivered in-the-wild. He joins host Paul Roberts for this episode of ConversingLabs to share his findings and key takeaways. He also shares how your organization can defend itself against the exploit.

YARA rules have been a proven tool for threat detection and hunting. Organizations who want to be mindful of today’s most serious threats, such as wiper malware and ransomware, should be leveraging this tool however they can. For this episode of ConversingLabs, we invited ReversingLabs Malware Researcher Hrvoje Samardžić plus Roman Hüssy of Abuse.ch, who told us about his company’s platform: YARAify. These two experts will also show how organizations can deploy YARA rules to benefit their threat analysis operations. 

In this special edition episode, ConversingLabs host Paul Roberts interviewed researchers Iain Smart and Viktor Gazdag of NCC Group from the showroom floor at Black Hat 2022. Paul chatted with the researchers about their Black Hat session on compromises to CI/CD pipelines, being an integral part of software supply chain security. 

A systemic issue impacting the cybersecurity community is the theft and unauthorized use of algorithms by corporate entities. This is an issue that Patrick Wardle, Founder of the Objective-See Foundation, has brought to the forefront as a speaker at this year’s Black Hat USA Conference. His talk at Black Hat presented the techniques to spot unauthorized use, and he referenced these techniques in real-world examples. We chatted with Wardle about this systemic problem at large, and how the industry should move forward to minimize this issue. 

At this year’s Black Hat Conference in Las Vegas, software supply chain security was top of mind for the InfoSec community. One of the biggest obstacles to improving the security of organizations and critical infrastructure is the poor state of software security. Alas: training developers to produce secure code is expensive, and time intensive. Or is it? At this year’s conference, Adam Shostack, President of Shostack & Associates, described a new approach to scale secure development training and educate a developer workforce, keeping time and financial restraints in mind. We chatted with him one-on-one to learn his insights in this special edition episode.

ReversingLabs recently discovered a software supply chain attack known as IconBurst. This incident is a widespread campaign, consisting of the installation of malicious NPM modules that are harvesting sensitive data from forms embedded in mobile applications and websites. Karlo Zanki, a Reverse Engineer at ReversingLabs, was the first to discover the attack. We invited him to join us for the second episode of ConversingLabs Season 2 to discuss his findings. Learn more about IconBurst here: https://blog.reversinglabs.com/blog/iconburst-npm-software-supply-chain-attack-grabs-data-from-apps-websites

AstraLocker is a fork of the Babuk ransomware family. Babuk is a past Ransomware-as-a-Service (RaaS) threat group, selling ransomware tools to affiliate cybercriminals. AstraLocker 2.0 was first seen in March 2022, but new research has surfaced about its capabilities. ReversingLabs Malware Researcher Joseph Edwards joined us for the first episode of ConversingLabs Season 2 to share his findings on AstraLocker. He also shared what organizations need to know to stay vigilant of this active cyber threat. 

Bryson Bort of Scythe.io spoke with host Paul Roberts about the May 2021 Colonial Pipeline hack that caused a fuel shortage on America's southeastern coast. Bort tackles the question: “What the hell happened?” He mentions that the incident truly was a “watershed moment” for the industry, since this ransomware attack directly impacted the lives of everyday Americans. But the bigger picture on Colonial also includes years of ignored warnings about the possibility of just such an attack. Now that the attack has happened, however, Bort worries that the cybersecurity industry is stuck in their echochamber trying to understand it, rather than conversing with other key players to get a better picture of this incident. 

In this conversation, Steve Lipner of SAFECODE explains what secure software is, and recounts his own experiences on Microsoft’s Software Security Development Lifecycle Team as the point of the spear in Microsoft’s Trustworthy Computing Initiative. Lipner stresses that secure software must come from within (so to speak). Outside consultants may be able to promote best practices, but they will never be able to grasp what needs fixing. That’s why an organization’s developers need to be trained and motivated to write secure code, which means seeing mistakes as they write code and throughout the entire development process. Lipner also talks about the Biden Administration’s Executive Order (EO) on Improving the Nation’s Cybersecurity, released in May 2021. Lipner believes that the impact of the EO is still a work in progress. He’s particularly a “fan” of Section 4 of the EO, which lists the requirements for a robust software security program. 

In this conversation, Robert Martin of MITRE talks about how the software supply chain is highly complicated, due to an increasing number of things in society becoming cyber-enabled. He and MITRE created the System of Trust (SoT) so that organizations can consider the most important aspects of the software supply chain, giving a more holistic context into the chain’s subsets. The SoT’s goal is to promote transparency, allowing developers to see all of the players in the supply chain. Martin explained how software is not written neatly end to end, but rather is built with drivers, dependencies, and frameworks that give the supply chain depth and magnitude. If software practitioners are not given visibility into this complicated picture, they will miss the software supply chain risks that pose a threat to their organizations. He stresses that Software Bills of Materials (SBOMs) should be included in this effort, but that practitioners should refer to the SoT in order to best utilize an SBOM, giving them the best chance of mitigating software supply chain risks. 

NPM dependency confusion has emerged as a potent software supply chain attack vector via platforms like npm, with malicious packages surreptitiously added to these repositories, maintained by leading firms. In this episode, we're joined by ReversingLabs Reverse Engineer Karlo Zanki to dig into some of our recent findings that show dependency confusion attacks are being used to advance what appear to be targeted supply chain attacks. We will also talk about how development organizations can monitor for and prevent these kinds of attacks. 

Even small organizations are sitting on top of a wealth of threat intel: their own IT environment. It’s essential for enterprises of all kinds to understand how to tap into this intelligence to better protect their operations. In this episode, we chatted with ReversingLabs’ very own Hrvoje Samardžić and Independent Malware Hunter Luigi De Mori/JAMESWT (@JAMESWT_MHT) about what kinds of internal threat intelligence are the most useful, where to find it, and how to leverage this data to improve your organization’s defenses.