Risky Business Features Podcast

In this sort-of-solo episode, James Wilson is “joined” by one of his OpenClaw AI agents for a chat about whether or not an LLM can understand, modify or even create a sophisticated nation-state grade iOS exploit kit. Technically this podcast is James having a conversation with himself, but the exchange is illuminating. It turns out LLMs can really help with finding 0day, even in mature code repos like WebKit.

In this interview you’ll hear former NSA executive Rob Joyce and former CIA cyber intelligence leader Andy Boyd talk to host Patrick Gray about how AI is changing the state of art in offensive security.

Recorded in front of a live audience at the Decibel Oasis side event next door to the RSA Conference in San Francisco, the trio also talk about why a series of iOS exploit chain leaks don’t seem to be stirring up a scandal.

In this episode of Risky Business Features, James Wilson and Brad Arkin discuss the attack that devastated medtech company Stryker. It turns out the attackers used Microsoft’s inTune to wipe the company’s devices, but what else could they have weaponised?

This podcast basically turned into an incident review of the Stryker incident. Enjoy!

James Wilson delivers his take on the state of the Model Context Protocol (MCP) in this solo episode of Risky Business Features. Despite MCP being the technology that made Large Language Models useful and AI Agents possible, the models have shown us they want to use something else instead. They want to use the shell directly, and that is going to have serious cybersecurity consequences.

In this podcast James Wilson chats with Brad Arkin about how enterprises can better deal with attackers logging in with valid credentials. Stolen identities, weak special-use credentials, over-scoped API keys are the new zero-day and they’re abundantly available to attackers. Sadly, the solution here isn’t as simple as deploying phishing resistant MFA. Fixing this takes an enterprise identity strategy.

Join James Wilson in this solo podcast as he takes a (ridiculously) deep dive into the Coruna exploit kit. James was a software engineer and senior manager at Apple for many years, so he has an intimate knowledge of iOS internals. He even worked alongside the people who wrote the software that the Coruna kit exploits!

This long-form solo podcast follows the chain of exploits from watering-hole website right through to full device compromise with many incredible leaps over security boundaries along the way. You’ve heard Coruna described as a sophisticated, nation state-grade exploit kit, and James will explain to you why that description is fitting.

In this edition of Risky Business Features James Wilson chats with cohost Brad Arkin about what it’s like being a CISO for a global company when a war starts.

How do you deal with a branch office full of important key material being abandoned? What about cloud infrastructure that’s in a data centre that falls into enemy hands? And if your staff are okay, are any of your key suppliers going to face problems?

As you’ll hear, being a wartime CISO is less about adjusting your SIEM sensitivity because the Iranians are coming to get you, and more about figuring out how to deal with very real threats to life and infrastructure.

In this podcast James Wilson chats with Brad Arkin about North Korea’s sprawling fake IT worker ecosystem. From fake interviews, to stolen identities, basement laptop farms and IP-KVM tricks, the North Koreans are operating a whole employment fraud industry.

Brad and James discuss how the scheme works in practice and the technical detection challenges defenders now face, like dealing with stolen or borrowed identities, bribed verification checks and multi-person operational chains. They also dig into why enterprises are largely on the back foot, and why there’s no single product you can buy to solve this.

As the former CISO of Adobe, Cisco and Salesforce, Brad has some firsthand experience dealing with this stuff!

In this debut feature conversation in the Risky Business Features feed James Wilson sits down with Brad Arkin, the former CSO of Adobe, Cisco, and Salesforce, to talk all about AI pentesting.

Finding and fixing bugs is great, but does it materially improve the overall security of a product? What’s the point of a pentest if the tester can’t walk you through their findings when it’s over? Is “bugs per dollar spend” really the measure of value in security testing?

We hope you enjoy this podcast!

AI agents are being deployed with the same trust-by-default architecture the early internet had. Same mistakes, MUCH faster timeline.

OpenClaw has hit 180K+ GitHub stars. But in the past week:

• 341 malicious skills on ClawHub were distributing Atomic Stealer
• ZeroPath disclosed a Browser Relay vuln enabling cross-tab cookie theft
• CrowdStrike, Cisco, and Bitdefender all published enterprise advisories
• VirusTotal partnered with ClawHub to scan uploads
• Korean tech firms (Kakao, Naver, Karrot) banned it on corporate networks
• 1,000+ Open PRs, 250+ less than 24 hours old.

But how does this thing actually work? Join James Wilson as he explains why banning these types of agents doesn’t work, why browser sessions are now API surfaces, and why your organisation needs to think of these issues early or be condemned to decades of catch-up programs.