- 39 minutes 56 secondsAI in the Wrong Hands
AI is the most powerful tool defenders have ever had. It's also the most dangerous weapon attackers have ever had. Assaf Keren, CSO at Qualtrics and author of Lessons from the Frontlines, has seen AI reshape both sides of the threat equation. In this conversation, he gets specific about what happens when powerful tools fall into the wrong hands, and what leaders need to do before they get caught off-guard.
You'll learn:
-
How attackers are using AI to move faster, scale wider, and go deeper than ever before
-
Why the moment you deploy AI, your security posture fundamentally changes
-
What curiosity-driven leadership looks like when the threat landscape won't sit still
-
How to close the gap between the security team's understanding of AI and the rest of the organization
-
What Assaf learned from 25+ years on the frontlines that still applies in the AI era
#CyberSecurity #AIRisk
Related Episodes:
About Threat VectorThreat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
7 May 2026, 6:00 am -
- 37 minutes 17 secondsOperation Winter SHIELD: What the FBI Wants Industry to Do Now
The FBI sees every breach. You see yours.
Adam Maddock, Section Chief of the FBI's Cyber Technical Analytics and Operations Section, and Jarrod Schlenker, Assistant Section Chief leading the FBI Cyber Division's private-sector engagement, join David Moulton to walk through Operation Winter SHIELD, the FBI's public campaign built on what investigators see repeated across hundreds and thousands of cases. Ten defenses. All of them rooted in real intrusions. Most of them still missing from too many organizations.
You'll learn:
- Why SMS-based MFA is no longer enough, and what phishing-resistant authentication actually looks like in practice
- How end-of-life SOHO routers and IoT devices become obfuscation infrastructure for attacks against targets that never knew they were involved
- Why calling the FBI early in an incident changes what's possible, and what you lose if you wait
- What the FBI means when it says industry is a "critical ally," not a passive recipient of intelligence
- Why you don't need to have your act together before you call your local FBI field office, and why trying to might actually hurt the investigation
This episode is essential listening if you're: a CISO or security leader wondering what law enforcement actually needs from you, an executive who doesn't yet have a relationship with your local FBI field office, or a practitioner trying to understand which defensive investments move the needle most.
Resources:
Related Episodes:
- Lessons from the Underground with Keith Mularski, former FBI special agent and Chief Global Ambassador at Qintel
- Inside the Mind of State-Sponsored Cyberattackers with Lior Rochberger, Unit 42
- Risk, Resilience, and Real Talk with Sam Ainscow
#Cybersecurity #CriticalInfrastructure
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
30 April 2026, 6:00 am - 34 minutes 3 secondsBreach School
What does it take to go from staring at forensic images to sitting across from a CEO whose company is on fire?
Steve Elovitz has spent his entire career in the room when things go wrong. He started in forensics and eDiscovery at PwC, moved to Booz Allen doing government work, then spent a decade at Mandiant before joining Unit 42 to lead North America consulting and incident response. The throughline across all of it: empathy.
In this conversation, Steve reflects on what two decades of incident response actually teaches you about the people on the other side of a breach. The executives fighting for their jobs. The CISOs trying to communicate while everything's on fire. The analysts who need someone to have their backs.
You'll hear how Steve's understanding of the job evolved as he moved from technical analyst to executive advisor, what the shift from forensic imaging to real-time response felt like from inside it, why identity keeps showing up in nearly every postmortem, and what briefing a board looks like when you get 15 minutes instead of the hour you planned for.
Steve has advised Fortune 500 boards and C-suites through some of the most damaging breaches of the past two decades. His biggest lesson turned out to be the one no certification teaches.
This episode is essential listening if you're a security professional trying to grow from analyst to advisor, or a leader building a team that can sustain this kind of work over a career.
Related Episodes:
Speaking Security in Board Language
Cybersecurity Metrics and Reporting to the Board
Transform Your SOC and Get Ahead of the Threats
#IncidentResponse #Cybersecurity
About Threat VectorThreat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
23 April 2026, 6:00 am - 38 minutes 17 secondsHow Nations Hack, Spy, and Win
Most people think nation-state cyberattacks are unpredictable. Allie Mellen wrote the book that proves they’re not.
Allie Mellen is the author of Code War: How Nations Hack, Spy, and Shape the Digital Battlefield and a leading industry analyst and former hacker. She advises Global 2000 organizations on detecting and responding to nation-state attacks. Her research career began as a hacker with work featured at Black Hat USA. She has partnered with multiple government agencies on election security and regularly briefs the Wall Street Journal, NPR, and the Washington Post.
Allie joined Threat Vector previously to break down the XDR landscape and what’s next for security operations. This time, the conversation goes somewhere different.
In this conversation with David Moulton, Allie breaks down the strategic logic behind attacks most defenders treat as random events.
You’ll learn:
-
Why nation-state attacks follow predictable strategic patterns, not chaos
-
How military doctrine and national history shape a country’s hacking behavior
-
What makes Stuxnet, WannaCry, NotPetya and the Sony Pictures hack so instructive
-
How to tell the difference between espionage, disruption and destruction campaigns
-
What defenders and executives can actually do with this knowledge
Allie has spent years studying threat actors from China, Russia, Iran, North Korea, Israel and the United States. Her analytical framework connects the dots between geopolitical objectives and the technical tradecraft security teams see on the wire every day.
This episode is essential listening if you’re a CISO translating threat intelligence into board-level strategy, a threat analyst trying to understand adversary intent, or a security leader who wants to think about the geopolitical forces shaping your threat landscape.
Related Episodes:
Mentioned in the Show:
Anthropic — "Disrupting the first reported AI-orchestrated cyber espionage campaign" https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf Published November 2025. Anthropic's Threat Intelligence team report on threat actor GTG-1002, a Chinese state-sponsored group that used Claude Code to execute 80-90% of a cyber espionage campaign autonomously — reconnaissance, exploitation, lateral movement, credential harvesting, and exfiltration — across roughly 30 global targets.
Allie Mellen — Code War: How Nations Hack, Spy, and Shape the Digital Battlefield Read Allie's book, Code War, now: https://bit.ly/m/codewar
#NationStateCyber #ThreatIntelligence
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
16 April 2026, 6:00 am -
- 44 minutes 14 secondsAttackers Have Agents. Do You?
What happens when your security analyst isn't a person?
Elad Koren, Vice President of Product Management for Cortex Cloud at Palo Alto Networks, returns to Threat Vector to pull back the curtain on what an agentic-first security experience actually looks like in practice. This isn't a vision deck. The agents are already running.
When Elad joined the show for Why Proactive Security Can't Wait, he made the case that reactive security can no longer keep up with adversaries who move from initial compromise to data theft in under five hours. This episode picks up where that conversation ended, with host David Moulton and Elad discussing the tools built to close that gap.
You'll learn:
-
What "agentic-first analyst experience" means and why it changes the SOC fundamentally
-
How Cortex is deploying autonomous agents across the platform and what they actually do
-
What XDL 2.0 is and why defenders need to understand it now
-
How product leaders are making security faster without making it reckless
Elad brings over two decades of experience in security, spanning RSA, PerimeterX, Salt Security, and now leading product for Cortex Cloud at Palo Alto Networks. He holds a CISSP and a patent in autonomous risk monitoring.
This episode is essential listening if you're: a security leader evaluating agentic AI tools, a product-minded practitioner curious how AI is reshaping cloud defense, or a CISO trying to figure out what's hype and what's already in production.
#AI #Cloud #autonomous
Related Episodes:
#AIAgents #CloudSecurity
About Threat VectorThreat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
9 April 2026, 6:00 am -
- 41 minutes 13 seconds39 Seconds to Breach
Can your organization survive a breach in 39 seconds? That's how fast attackers are moving now, and if your defenses are still running at human speed, you're already behind.
Wendi Whitmore, Chief Security Intelligence Officer at Palo Alto Networks, returns to Threat Vector for a candid conversation with David Moulton about what it actually takes to build resilience in an era where AI is accelerating both the threat and the defense. Wendi brings more than two decades of experience leading incident response and threat intelligence at organizations including Mandiant, CrowdStrike, IBM X-Force, and Unit 42. She's an inaugural member of the DHS Cyber Safety Review Board and serves on cybersecurity advisory boards at Duke University and the University of San Diego.
You'll learn:
-
Why fighting AI with AI is the only viable response to today's attack speeds, including exfiltration happening in under a minute
-
How Volt Typhoon and Salt Typhoon represent two fundamentally different threat objectives, and what that means for your defense posture
-
What "cybersecurity for AI" means versus "AI for cybersecurity," and why organizations need both
-
How the best incident response leaders translate between deep technical analysis and boardroom communication under pressure
-
Why curiosity, not certifications, is the trait that separates great security practitioners from the rest
Wendi is one of the most respected voices in national cybersecurity strategy, with a track record that spans major breaches, critical infrastructure defense, and the Paris Olympics. Her perspective on building teams, aligning talent to mission, and defending against nation-state actors at scale is grounded in real-world investigation, not theory.
This episode is essential listening if you're: a security leader trying to align your AI strategy with your risk posture, a practitioner wondering how to make the case for faster detection and response investment, or someone building or managing a threat intelligence or incident response team.
Related Episodes:
-
Confronting China's Expanding Cyber Threats with Wendi Whitmore — Wendi's first appearance on Threat Vector, focused on Chinese nation-state activity and critical infrastructure targeting.
-
Transform Your SOC and Get Ahead of the Threats — A deep dive on SOC transformation, AI-driven detection, and what it means to modernize your security operations center.
-
The Art of Threat Hunting — How human analysts and AI work together to find what attackers are trying to hide.
#CyberResilience #AIinCybersecurity
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
2 April 2026, 6:00 am -
- 36 minutes 58 secondsThe Four Horsemen of Agentic Risk
Your AI agent just wiped an entire email inbox and said sorry. That's not a hypothetical. It already happened.
Sailesh Mishra, Product Marketing at Palo Alto Networks and founder of SydeLabs (acquired by Protect AI), has spent years at the frontier of AI security, from scaling autonomous vehicle programs at Uber's Advanced Technologies Group to building and selling an AI red-teaming startup. He has a clear-eyed view of what autonomous agents can do, what they can be made to do, and what organizations are dangerously unprepared for.
You'll learn:
- Why the "lethal trifecta" of AI risk gains a fourth, more dangerous dimension when agents have persistent memory
- How attackers can plant a logic bomb inside an agent's memory using entirely benign inputs, then trigger it later
- What "identity" means for a piece of software, and why scoping agent behavior is the single most impactful security control
- Why indirect prompt injection is already happening in the wild, not just in research papers
- The two questions every CISO must answer before authorizing an autonomous agent deployment
This episode is essential listening if you're a CISO evaluating your first autonomous agent deployment, a developer building agentic systems today, or a security practitioner trying to get ahead of a threat landscape that is moving faster than anyone expected.
Related Reading:
- OpenClaw (formerly Moltbot, Clawdbot) May Signal the Next AI Security Crisis
- The Moltbook Case and How We Need to Think about Agent Security
Related Episodes:- Securing the Future of AI Agents
- Securing AI in the Enterprise
#AIAgents #AISecurity
About Threat VectorThreat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
26 March 2026, 6:00 am - 30 minutes 16 secondsInside Ransomware Negotiations: Trust Criminals or Walk Away?
What happens when you're face-to-face with a ransomware gang demanding millions—and every decision could determine whether your company survives?
Jeremy D. Brown, Consulting Director at Palo Alto Networks Unit 42 with nearly seven years negotiating with cyber criminals, reveals the hidden world of ransomware negotiations. With hundreds of negotiations under his belt, Jeremy knows which groups honor their promises, which ones to never pay, and exactly what mistakes can cost you everything.
You'll learn:
- Why contacting a threat actor doesn't mean you have to pay (the #1 misconception that paralyzes victims)
- How to extract critical forensic intelligence from attackers during initial contact
- The fatal mistakes organizations make that destroy their negotiation leverage
- Which ransomware groups are sanctioned entities that will land you in legal trouble if you pay
- Why being polite to criminals actually gets you better outcomes than hostility
Jeremy has negotiated with everyone from aggressive groups who email your executives to methodical operators following strict playbooks. He's seen organizations with backups walk away and others pay millions for decryption keys. Managing over 100 incidents, Jeremy has tracked how double extortion evolved from rare to standard practice, and now watches single extortion (data theft without encryption) surge again.
This episode is essential for CISOs who need a negotiation plan before the crisis hits, incident responders building their skillset, and executives who must understand that ransomware response is about far more than just paying or not paying. #IncidentResponse #Ransomware
Related Episodes:
- Mastering the Basics: Cyber Hygiene and Risk Management
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
19 March 2026, 6:00 am - 39 minutes 41 secondsWho Holds Power When AI Compresses Decision Time?
What if the choices we make about AI security today determine who holds power tomorrow?
Erica L. Shoemate brings over a decade of experience from the FBI and U.S. Intelligence Community, followed by senior leadership roles at Twitter, Amazon, and Meta shaping AI policy, cyber strategy, and regulatory readiness. As founder of The EN Strategy Group, she operates at the intersection where national security, emerging technology, and human-centered design collide.
In this episode, David Moulton and Erica explore how AI is fundamentally reshaping the security landscape, from compressed decision-making timelines and asymmetric threat capabilities to the erosion of trust that creates strategic vulnerabilities.
You'll learn:
- Why AI governance can't be an afterthought—and how building policy alongside innovation creates competitive advantage, not friction
- How the "new security order" is lowering disruption costs while amplifying ambiguity, enabling smaller actors to generate outsized impact
- Why human-centered design isn't about empathy as a value—it's about operational clarity that prevents cognitive overload from becoming a security risk
- The framework for balancing innovation and restraint: treating policy as guardrails, not brakes, while red-teaming AI systems before deployment
- How trust functions as a national security asset—and why overconfidence is the fastest way to lose it
Erica brings rare perspective from both classified intelligence operations and private sector AI deployment at scale. She challenges the assumption that speed and security are trade-offs, arguing instead that ethical AI systems are more durable, more resilient, and ultimately more profitable than those built without accountability.
With AI compressing the timeline from detection to decision to response, the margin for error has never been smaller. This conversation reveals why the choices security leaders make right now—about governance, diversity, transparency, and human oversight—will define who is protected, who is exposed, and who maintains strategic advantage in an AI-driven future.
This episode is essential listening if you're:
- A CISO or security leader deploying AI-enabled systems who needs to balance innovation velocity with governance rigor
- A policy professional struggling to keep pace with AI deployment timelines and seeking frameworks that enable rather than block
- Anyone responsible for building trust in AI systems—whether with users, regulators, or boards—who recognizes transparency as competitive advantage
Related Episodes:
- Securing AI in the Enterprise with Tanya Shastri - Deep dive into AI governance frameworks and platformization strategies
- How to Scale Responsible AI in the Enterprise with Noelle Russell - Building AI systems with fairness, accuracy, and security as foundational design choices
- From Policy to Cyber Interference with Tom Bossert - Bridging national security policy and operational cybersecurity
#AISecurity #CyberGovernance
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
12 March 2026, 6:00 am - 29 minutes 39 secondsZero Trust Without the Hype
In this episode of Threat Vector, host David Moulton speaks with LeeAnne Pelzer, Senior Consulting Director, and Brandon Hogle, Consulting Director, both with Palo Alto Networks Unit 42. Together, they explore how organizations can move from Zero Trust theory to practice.Zero Trust is the foundation of modern cybersecurity, but turning principles into measurable outcomes remains a challenge for many enterprises. Pelzer and Hogle share how Unit 42’s Zero Trust Advisory helps organizations assess their cybersecurity maturity, identify visibility gaps, and create tailored roadmaps that connect security architecture with business outcomes.The conversation dives into the common pitfalls that derail Zero Trust, including visibility gaps, operational complexity, and misalignment, and explores how to overcome them with clarity, collaboration, and continuous verification. For security leaders driving transformation, this episode offers a pragmatic look at how to cut through complexity and make Zero Trust achievable.
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
5 March 2026, 7:00 am - 33 minutes 54 secondsUnit 42's Iran Threat Brief: What We're Seeing
Unit 42 is tracking more than 60 active hacktivist groups and Iran-linked threat actors right now. What are they actually doing, what should you believe, and what should you do about it?
In this episode of Threat Vector, David Moulton sits down with Justin Moore, Senior Manager of Threat Intelligence Research at Unit 42, and Andy Piazza, Senior Director of Threat Intelligence at Unit 42, to walk through the Unit 42 Iran Threat Brief and what the observed activity means for defenders.
You'll learn:
- What Unit 42 is actually observing from groups like Handala Hack, FAD Team, and Dark Storm, and what claims remain unverified
- Why Iran's reduced internet connectivity changes the threat picture in ways that aren't obvious
- What dispersed operators and proxy groups mean for organizations far outside the Middle East
- Which defensive actions matter most against the TTPs and IOCs Unit 42 has documented
- How to handle hacktivist claims that may be exaggerated or false
Justin Moore brings nine years of intelligence officer experience plus senior threat intel roles at Mandiant, Google, and TikTok before joining Unit 42. Andy Piazza has more than 20 years in security operations and threat intelligence, including leading IBM X-Force's global threat intel team.
Read the threat brief from Unit 42:
- Escalation of Cyber Risk Related to Iran (March 2026)
- Escalation of Cyber Risk Related to Iran (June 2025)
This episode is essential listening if you're: a CISO assessing current exposure, a threat analyst tracking Iran-linked groups, or a security leader who needs to explain the actual observed risk to your board.
Related Episodes:
- Inside the Mind of State-Sponsored Cyberattackers
- From Policy to Cyber Interference
#Cybersecurity #ThreatIntelligence
About Threat Vector
Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.
The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.
Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.
Palo Alto Networks
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com.
4 March 2026, 9:10 pm - More Episodes? Get the App