Learn Cloud Security in Public Cloud the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We can be honest because we are not owned by...
In this episode of the Cloud Security Podcast, host Ashish Rajan speaks to James Berthoty, founder of Latio.Tech and an engineer-driven analyst, for a discussion on cloud security tools. In this episode James breaks down CNAPP and what it really means for engineers, if kubernetes secuity is the new baseline for cloud security and runtime security vs vulnerability management.
Guest Socials: James's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
If you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity Podcast
Questions asked:
(00:00) Introduction
(02:26) A bit about James
(03:20) What in Cloud Security in 2025?
(04:51) What is CNAPP?
(07:01) Differentiating a vulnerability from misconfiguration
(11:51) Vulnerability Management in Cloud
(15:38) Is Kubernetes becoming the default?
(21:50) Is there a good way to do platformization?
(24:16) Should CNAPP include Kubernetes?
(28:07) What is AI Security in 2025?
(35:06) Tool Acronyms for 2025
(37:27) Fun Questions
--------
40:08
Cybersecurity Isn’t Crowded: Security Engineering and the 5,000 Vendor Problem
In this episode our host Ashish Rajan sat down with Ross Haleliuk, author of Cybersecurity for Builders and creator of the Venture in Security blog, to explore the current state and future of the cybersecurity industry. From understanding the challenges of building a cybersecurity startup to the dynamics of security engineering and market trends for 2025. Ross and Ashish explore why the cybersecurity industry isn’t as crowded as it seems and the divide between companies that build in-house security and those that rely on vendors.
Ross also unpacks why sales and marketing aren’t “dirty words” in cybersecurity, why security engineering is “the present,” and how practitioners can balance business needs with technical aspirations.
Guest Socials: Ross's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
If you are interested in AI Cybersecurity, you can check out our sister podcast - AI Cybersecurity Podcast
Questions asked:
(00:00) Introduction
(05:33) How Venture in Security started?
(09:33) Security Engineering in Cybersecurity
(18:18) Cybersecurity markets that will be top of mind in 2025
(24:15) GTM for Defender Tools
(30:09) Vulnerabilities vs Misconfiguration Tools
(37:56) How should product companies think about GTM?
(44:27) How to decide between different security tools?
(56:36) Cybersecurity for Builders book
(01:05:00) The Fun Section
Resources shared during the episode:
Venture in Security Blog
Cyber for Builders Book
Challenges in Security Engineering Programs - Rami McCarthy
Cybersecurity is not a market for lemons. It is a market for silver bullets
The Market for Silver Bullets
--------
1:10:13
Centralized VPC Endpoints - Why It Works for AWS Networking
In this episode, Meg Ashby, a senior cloud security engineer shares how her team tackled AWS’s centralized VPC interface endpoints, a design often seen as an anti-pattern. She explains how they turned this unconventional approach into a cost-efficient and scalable solution, all while maintaining granular controls and network visibility. She shares why centralized VPC endpoints are considered an AWS anti-pattern, how to implement granular IAM controls in a centralized model and the challenges of monitoring and detecting VPC endpoint traffic.
Guest Socials: Meg's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(02:48) A bit about Meg Ashby
(03:44) What is VPC interface endpoints?
(05:26) Egress and Ingress for Private Networks
(08:21) Reason for using VPC endpoints
(14:22) Limitations when using centralised endpoint VPCs
(19:01) Marrying VPC endpoint and IAM policy
(21:34) VPC endpoint specific conditions
(27:52) Is this solution for everyone?
(38:16) Does VPC endpoint have logging?
(41:24) Improvements for the next phase
Thank you to our episode sponsor Wiz. Cloud Security Podcast listeners can also get a free cloud security health scan by going to wiz.io/csp
--------
48:41
What is CADR?
In this episode, recorded at Kubecon NA in Salt Lake City, we spoke about about Kubernetes security with Shauli Rozen, co-founder and CEO of ARMO Security. From the challenges of runtime protection to the potential of CADR (Cloud Application Detection and Response), Shauli breaks down the gaps in traditional CSPM tools and how Kubernetes plays a central role in cloud security strategy. The episode gets into the "Four C's" of cloud security: Cloud, Cluster, Container, Code, why runtime data, powered by eBPF, is critical for modern security solutions, the rise of CADR and how Kubernetes is reshaping the landscape of DevOps and security collaboration.
Guest Socials: Shauli's Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:46) A bit about Shauli and ARMO
(02:26) Bit about open source project Kubescape
(03:59) What is Runtime Security in Kubernetes?
(06:50) CDR and Application Security
(08:57) What is ADR and CADR?
(09:55) How is CADR different to ASPM + DAST?
(12:18) Kubernetes Usage and eBPF
(15:35) Does your CSPM do coverage for Kubernetes?
(16:24) What to include in 2025 Cybersecurity Roadmap?
(19:09) Does everyone need CADR?
(21:35) Who is looking at the Kubernetes Security Logs?
(23:17) The future of Kubernetes Security
(25:26) The Fun Section
--------
29:04
Building Platforms in Regulated Industries
At HashiConf 2024 in Boston, our host Ashish Rajan had a great chat over some cannolis and a game of Jenga with AJ Oller, AVP of Engineering at The Hartford about how automation, mainframes, and compliance intersect to drive innovation in regulated industries like insurance. They spoke about why regulations aren't barriers but frameworks to prevent failure, the human side of engineering and how to manage change fatigue during transformations and how automation enhances security, disaster recovery, and operational efficiency.
Guest Socials: AJ' s Linkedin
Podcast Twitter - @CloudSecPod
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
- Cloud Security Podcast- Youtube
- Cloud Security Newsletter
- Cloud Security BootCamp
Questions asked:
(00:00) Introduction
(01:53) A bit about AJ Oller
(02:17) The Cannoli taste test
(04:38) Technology in the Insurance industry
(10:19)What is a platform?
(11:46) What skillsets do you need in platform team?
(14:19) Maturity for building platform teams
(19:5)8 Business case for investing in Automation
(24:49) Does Automation help with security regulations?
(28:10) Leaders communicating automation value to business
(30:37) Cheerleading for digital transformation
(32:32) The Fun Section
Learn Cloud Security in Public Cloud the unbiased way from CyberSecurity Experts solving challenges at Cloud Scale. We can be honest because we are not owned by Cloud Service Provider like AWS, Azure or Google Cloud.
We aim to make the community learn Cloud Security through community stories from small - Large organisations solving multi-cloud challenges to diving into specific topics of Cloud Security.
We LIVE STREAM interviews on Cloud Security Topics every weekend on Linkedin, YouTube, Facebook and Twitter with over 150 people watching and asking questions and interacting with the Guest.
México