David Spark

speaker

5,929 appearances 23 recordings 1 series first heard Apr 2026 last heard 22 Sep

David Spark’s voice in public audio — every appearance, attributed to the second.

Trend

recordings per month · last 12 months

Recordings per month over the last 12 months — 23 in all, peaking in Sep 2026 with 5.

Appearances

newest first · ▶ plays the moment

CISO Series Podcast · Our AI Agents Are So Safe and Reliable You Can't Buy Insurance for Them · 22 Sep 2026 podcast

Yeah. podcast-host

That have gone after this very issue about stealing intellectual property. podcast-host

Right. podcast-host

This just in, half the exposures on your remediation list may not be reachable by anyone. podcast-host

Hand a team a rank lift of exposures and tell them to work top down. podcast-host

By next quarter, a big share of what they fix turns out to have been unreachable all along, sitting behind controls or network segmentation no outside attacker could cross. podcast-host

The months of invested real effort yielded almost no change in actual risk because nobody asked the prior question. podcast-host

Could an attacker even reach this and could they exploit it here? podcast-host

Security testing needs to be rooted in reachability. podcast-host

NIST's Guide to Security Testing, SP 800-115, separates finding a weakness from proving it. podcast-host

Its penetration testing methodology moves beyond discovery into an attack phase where a tester reaches the asset and exploits it, rather than trusting a scanner's say-so. podcast-host

Adversary emulation extends that to a real attacker's full path. podcast-host

And MITRE's Center for Threat-Informed Defense publishes open, runnable emulation plans. podcast-host

Policy is catching up too. podcast-host

FedRAMP's 2026 vulnerability rules now require providers to evaluate whether a flaw is internet reachable and genuinely exploitable before treating it as urgent. podcast-host

So validate reachability before you invest in remediation. podcast-host

Confirm whether an attacker could get to the exposure and use it in your environment. podcast-host

Then let that, not a severity sort on a spreadsheet, drive the queue. podcast-host

Quote, sovereign cloud on the slides looks like control. podcast-host

In the contracts, service matrices, and AI agent deployments, it often looks more like a very expensive illusion, end quote. podcast-host

Showing 221–240 of 5,929 · page 12 of 297