PODCAST · technology
Software Engineering Institute (SEI) Podcast Series
by Members of Technical Staff at the Software Engineering Institute
The SEI Podcast Series presents conversations in software engineering, cybersecurity, and future technologies.
Episodes
-
Why Accuracy Isn't Enough: A New Quality Model for Real-World ML Components
AI components, whether traditional machine learning or generative AI, are embedded in many present-day systems. However, despite advances in automation, infrastructure, and tooling for developing AI components, many do not leave the prototype stage or reach production because they fail to meet...
-
Breaking Down Barriers: How LLMs Enable Software Analysis in Classified Environments
The recent explosion in large language model (LLM) technology has highlighted the challenges of using public generative artificial intelligence tools in classified environments, especially for software analysis. Currently, software analysis falls on the shoulders of static analysis tools and…
more -
Data-Driven Defense: Cyber Resilience in the Age of AI
Data breaches remind us of the importance of cyber resilience as an essential element of survivability and continuity of operations for all organizations, especially those operating mission-essential systems, high-value systems, and/or critical assets. Resilience is also critical to reducing the...
-
Software-Defined Warfare: Expanding the Frontier
Software-defined warfare is today's reality for national security, shifting the emphasis in military operations from hardware to software. In the latest podcast from the Carnegie Mellon University Software Engineering Institute, SEI director Paul Nielsen recently sat down with Matthew Butkovic,...
-
From Coordination Chaos to Mission Focus: The Waypoints Framework
In aviation, waypoints guide pilots through complex flight plans, providing some structure but maintaining flexibility. Kevin Dooley, a senior Agile transformation leader at the SEI, adopted this concept to solve one of defense acquisition's most persistent challenges: synchronizing dozens of...
-
An LLM Evaluation Framework for High-Stakes AI
Experimentation and validation of LLM performance is critical when building LLM-driven systems that must reliably deliver a service, from customer service chat bots to intelligence analysis tools. To help teams meet the need for rigorous evaluation methods, a research team in the SEI's AI…
more -
Protecting AI Systems Against Data Poisoning
Data poisoning—where adversaries tamper with training data to corrupt model behavior—poses significant risks as AI adoption expands across critical sectors. Organizations without mechanisms in place to detect or prevent data poisoning are open to an avenue of attack that, once exploited, is...
-
Goal-Line Defense: A Tool to Discover and Mitigate UEFI Vulnerabilities
As recently as December 2025, the Carnegie Mellon University Software Engineering Institute (SEI's) CERT Coordination Center (CERT/CC) documented a UEFI-related vulnerability in certain motherboard models, illustrating that early-boot firmware behavior continues to present security challenges...
-
Leadership, Legacy, and the Power of Mentors: Insights from Dr. Paul Nielsen
In February 2026, Paul Nielsen announced that he will transition out of his role as director and chief executive officer of the Software Engineering Institute (SEI) at Carnegie Mellon University. During Nielsen's tenure, the SEI has marked major institutional milestones that underscore its…
more -
With a Little Help from Our Civilian Friends: Cybersecurity Reserve Is Both Feasible and Advisable
Cybersecurity staffing shortages are a major concern in the government given the increasingly sophisticated cyber attacks on the nation's critical infrastructure. In the FY2023 National Defense Authorization Act (NDAA), Congress tasked the Pentagon with finding flexible options to address cyber...
-
Maturing AI Adoption: From Chaos to Consistency
While Stanford University found that AI investments, optimism, and accessibility are rising, a recent MIT report suggests that 95 percent of organizations are realizing no returns on their generative AI investments. Research from Accenture found that only 8 percent of companies are scaling AI at…
more -
Temporal Memory Safety in C and C++: An AI-Enhanced Pointer Ownership Model
In October 2025, CyberPress reported a critical security vulnerability in the Redis Server, an open-source in-memory database that allowed authenticated attackers to achieve remote code execution through a use-after-free flaw in the Lua scripting engine. In 2024, another prominent temporal memory...
-
AI for the Warfighter: Acquisition Challenges and Guidance
On November 7, the Department of War released an acquisition transformation strategy that seeks to remove bureaucratic hurdles and streamline acquisition processes to enable even more rapid adoption of technologies, including artificial intelligence. Getting AI into the hands of warfighters...
-
Visibility Through the Clouds with Network Flow Logs
Organizations, including the U.S. military, are increasingly adopting cloud deployments for their flexibility and cost savings. The shared security model utilized by cloud service providers removes some of the adopting organization's responsibility for system administration and security. But it...
-
Orchestrating the Chaos: Protecting Wireless Networks from Cyber Attacks
From early 2022 through late 2024, a group of threat actors publicly known as APT28 exploited known vulnerabilities, such as CVE-2022-38028, to remotely and wirelessly access sensitive information from a targeted company network. This attack did not require any hardware to be placed in the…
more -
From Data to Performance: Understanding and Improving Your AI Model
Modern data analytic methods and tools—including artificial intelligence (AI) and machine learning (ML) classifiers—are revolutionizing prediction capabilities and automation through their capacity to analyze and classify data. To produce such results, these methods depend on correlations.…
more -
What Could Possibly Go Wrong? Safety Analysis for AI Systems
How can you ever know whether an LLM is safe to use? Even self-hosted LLM systems are vulnerable to adversarial prompts left on the internet and waiting to be found by system search engines. These attacks and others exploit the complexity of even seemingly secure AI systems. In our latest podcast...
-
Getting Your Software Supply Chain In Tune with SBOM Harmonization
Software bills of materials or SBOMs are critical to software security and supply chain risk management. Ideally, regardless of the SBOM tool, the output should be consistent for a given piece of software. But that is not always the case. The divergence of results can undermine confidence in...
-
API Security: An Emerging Concern in Zero Trust Implementations
Application programing interfaces, more commonly known as APIs, are the engines behind the majority of internet traffic. The pervasive and public nature of APIs have increased the attack surface of the systems and applications they are used in. In this podcast from the Carnegie Mellon University...
-
Delivering Next-Generation AI Capabilities
Artificial intelligence (AI) is a transformational technology, but it has limitations in challenging operational settings. Researchers in the AI Division of the Carnegie Mellon University Software Engineering Institute (SEI) work to deliver reliable and secure AI capabilities to warfighters in...
-
The Benefits of Rust Adoption for Mission-and-Safety-Critical Systems
A recent Google survey found that many developers felt comfortable using the Rust programming language in two months or less. Yet barriers to Rust adoption remain, particularly in safety-critical systems, where features such as memory and processing power are in short supply and compliance with...
-
Threat Modeling: Protecting Our Nation's Complex Software-Intensive Systems
In response to Executive Order (EO) 14028, Improving the Nation's Cybersecurity, the National Institute of Standards and Technology (NIST) recommended 11 practices for software verification. Threat modeling is at the top of the list. In this podcast from the Carnegie Mellon University Software...
-
Understanding Container Reproducibility Challenges: Stopping the Next Solar Winds
Container images are increasingly being used as the main method for software deployment, so ensuring the reproducibility of container images is becoming a critical step in protecting the software supply chain. In practice, however, builds are often not reproducible due to elements of the build...
-
Mitigating Cyber Risk with Secure by Design
Software enables our way of life, but market forces have sidelined security concerns leaving systems vulnerable to attack. Fixing this problem will require the software industry to develop an initial standard for creating software that is secure by design. These are the findings of a recently...
-
The Magic in the Middle: Evolving Scaled Software Solutions for National Defense
A January 2025 Defense Innovation Board study on scaling nontraditional defense innovation stated, "We must act swiftly to ensure the DoD leads in global innovation and competition over AI and autonomous systems – and is a trendsetter for their responsible use in modern warfare." In this podcast...
-
Making Process Respectable Again: Advancing DevSecOps in the DoD Mission Space
Warfighters in the Department of Defense (DoD) operate in high-stakes environments where security, efficiency, and speed are critical. In such environments DevSecOps has become crucial in the drive toward modernization and overall mission success. A recent study led by researchers at the Carnegie...
-
Deploying on the Edge
Deploying cloud-centric technologies such as Kubernetes in edge environments poses challenges, especially for mission-critical defense systems. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Patrick Earl, Doug Reynolds, and Jeffrey Hamed, all DevOps...
-
The Best and Brightest: 6 Years of Supporting the President's Cup Cybersecurity Competition
A strong cyber defense is vital to public- and private-sector activities in the United States. In 2019, in response to an executive order to strengthen America's cybersecurity workforce, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) partnered with…
more -
Updating Risk Assessment in the CERT Secure Coding Standard
Evaluating source code to ensure secure coding qualities costs time and effort and often involves static analysis. But those who are familiar with static analysis tools know that the alerts are not always reliable and produce false positives that must be detected and disregarded. This year, we…
more -
Delivering Next Generation Cyber Capabilities to the DoD Warfighter
In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Gregory Touhill, director of the SEI CERT Division, sits down with Matthew Butkovic, technical director of Cyber Risk and Resilience at CERT, to discuss ways in which CERT researchers and technologists are...
-
Getting the Most Out of Your Insider Risk Data with IIDES
Insider incidents cause around 35 percent of data breaches, creating financial and security risks for organizations. In this podcast from the Carnegie Mellon University Software Engineering Institute, Austin Whisnant and Dan Costa discuss the Insider Incident Data Expression Standard (IIDES), a…
more -
Grace Lewis Outlines Vision for IEEE Computer Society Presidency
Grace Lewis, a principal researcher at the Carnegie Mellon University Software Engineering Institute (SEI) and lead of the SEI's Tactical and AI-Enabled Systems Initiative, was elected the 2026 president of the IEEE Computer Society (CS), the largest community of computer scientists and…
more -
Improving Machine Learning Test and Evaluation with MLTE
Machine learning (ML) models commonly experience issues when integrated into production systems. In this podcast, researchers from the Carnegie Mellon University Software Engineering Institute and the U.S. Army AI Integration Center (AI2C) discuss Machine Learning Test and Evaluation (MLTE), a…
more -
DOD Software Modernization: SEI Impact and Innovation
As software size, complexity, and interconnectedness has grown, software modernization within the Department of Defense (DoD) has become more important than ever. In this discussion moderated by Matthew Butkovic, technical director of risk and resilience in the SEI CERT Division, SEI director…
more -
Securing Docker Containers: Techniques, Challenges, and Tools
Containerization allows developers to run individual software applications in an isolated, controlled, repeatable way. With the increasing prevalence of cloud computing environments, containers are providing more and more of their underlying architecture. In this podcast from the Carnegie Mellon...
-
An Introduction to Software Cost Estimation
Software cost estimation is an important first step when beginning a project. It addresses important questions regarding budget, staffing, scheduling, and determining if the current environment will support the project. In this podcast from the Carnegie Mellon University Software Engineering...
-
Cybersecurity Metrics: Protecting Data and Understanding Threats
One of the biggest challenges in collecting cybersecurity metrics is scoping down objectives and determining what kinds of data to gather. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Bill Nichols, who leads the SEI's Software Engineering Measurements...
-
3 Key Elements for Designing Secure Systems
To make secure software by design a reality, engineers must intentionally build security throughout the software development lifecycle. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Timothy A. Chick, technical manager of the Applied Systems Group in the...
-
Using Role-Playing Scenarios to Identify Bias in LLMs
Harmful biases in large language models (LLMs) make AI less trustworthy and secure. Auditing for biases can help identify potential solutions and develop better guardrails to make AI safer. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Katie Robinson…
more -
Best Practices and Lessons Learned in Standing Up an AISIRT
In the wake of widespread adoption of artificial intelligence (AI) in critical infrastructure, education, government, and national security entities, adversaries are working to disrupt these systems and attack AI-enabled assets. With nearly four decades in vulnerability management, the Carnegie...
-
3 API Security Risks (and How to Protect Against Them)
The exposed and public nature of application programming interfaces (APIs) come with risks including the increased network attack surface. Zero trust principles are helpful for mitigating these risks and making APIs more secure. In this podcast from the Carnegie Mellon University Software...
-
Evaluating Large Language Models for Cybersecurity Tasks: Challenges and Best Practices
How can we effectively use large language models (LLMs) for cybersecurity tasks? In this Carnegie Mellon University Software Engineering Institute podcast, Jeff Gennari and Sam Perl discuss applications for LLMs in cybersecurity, potential challenges, and recommendations for evaluating LLMs.
-
Capability-based Planning for Early-Stage Software Development
Capability-Based Planning (CBP) defines a framework that has an all-encompassing view of existing abilities and future needs for strategically deciding what is needed and how to effectively achieve it. Both business and government acquisition domains use CBP for financial success or to design a...
-
Safeguarding Against Recent Vulnerabilities Related to Rust
What can the recently discovered vulnerabilities related to Rust tell us about the security of the language? In this podcast from the Carnegie Mellon University Software Engineering Institute, David Svoboda discusses two vulnerabilities, their sources, and how to mitigate them.
-
Developing a Global Network of Computer Security Incident Response Teams (CSIRTs)
Cybersecurity risks aren't just a national concern. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), the CERT division's Tracy Bills, senior cybersecurity operations researcher and team lead, and James Lord, security operations technical manager, discuss…
more -
Automated Repair of Static Analysis Alerts
Developers know that static analysis helps make code more secure. However, static analysis tools often produce a large number of false positives, hindering their usefulness. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), David Svoboda, a software…
more -
Developing and Using a Software Bill of Materials Framework
With the increasing complexity of software systems, the use of third-party components has become a widespread practice. Cyber disruptions, such as SolarWinds and Log4j, demonstrate the harm that can occur when organizations fail to manage third-party components in their software systems. In this...
-
Using Large Language Models in the National Security Realm
At the request of the White House, the Office of the Director of National Intelligence (ODNI) began exploring use cases for large language models (LLMs) within the Intelligence Community (IC). As part of this effort, ODNI sponsored the Mayflower Project at Carnegie Mellon University's Software...
-
Atypical Applications of Agile and DevSecOps Principles
Modern software engineering practices of Agile and DevSecOps have provided a foundation for producing working software products faster and more reliably than ever before. Far too often, however, these practices do not address the non-software concerns of business mission and capability delivery...
-
When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction
Increasingly in government acquisition of software-intensive systems, we are seeing programs using Agile development methodology and earned value management. While there are many benefits to using both Agile and EVM, there are important considerations that software program managers must first...
We're indexing this podcast's transcripts for the first time — this can take a minute or two. We'll show results as soon as they're ready.
No matches for "" in this podcast's transcripts.
No topics indexed yet for this podcast.
Loading reviews...
ABOUT THIS SHOW
The SEI Podcast Series presents conversations in software engineering, cybersecurity, and future technologies.
HOSTED BY
Members of Technical Staff at the Software Engineering Institute
CATEGORIES
Loading similar podcasts...
Frequently Asked Questions
How many episodes does Software Engineering Institute (SEI) Podcast Series have?
Software Engineering Institute (SEI) Podcast Series currently has 436 episodes available on PodParley. New episodes are automatically indexed when they're published to the podcast feed.
What is Software Engineering Institute (SEI) Podcast Series about?
The SEI Podcast Series presents conversations in software engineering, cybersecurity, and future technologies.
How often does Software Engineering Institute (SEI) Podcast Series release new episodes?
Software Engineering Institute (SEI) Podcast Series publishes regularly with 436 episodes available. Check the episode list for the typical release schedule.
Where can I listen to Software Engineering Institute (SEI) Podcast Series?
You can listen to Software Engineering Institute (SEI) Podcast Series on PodParley by clicking any episode. We provide an embedded audio player for direct listening, and you can also subscribe via your preferred podcast app using the RSS feed.
Who hosts Software Engineering Institute (SEI) Podcast Series?
Software Engineering Institute (SEI) Podcast Series is created and hosted by Members of Technical Staff at the Software Engineering Institute.
URL copied to clipboard!