<![CDATA[Signal // Noise]]>Signal // Noise is an epistemic security podcast hosted by Chris Loehr and Bob Miller. Where the incident ends and the analysis begins. Two analysts. One signal.

Each episode selects a real-world cybersecurity incident and runs it through independent analysis across five AI systems, then synthesizes the findings into a single authoritative report. The goal is simple: separate what is true from what is loud, and deliver intelligence that security professionals and business leaders can act on.

Truth. Information integrity. Cognitive security. Resilience.

]]>signaltonoise.irgame.aiRiverside.fm (https://riverside.com)Sun, 05 Jul 2026 10:48:30 GMTFri, 08 May 2026 19:20:48 GMT60Chris Loehr & Bob Miller<p><b>Signal // Noise is an epistemic security podcast hosted by Chris Loehr and Bob Miller. Where the incident ends and the analysis begins. Two analysts. One signal.</b></p><p></p><p>Each episode selects a real-world cybersecurity incident and runs it through independent analysis across five AI systems, then synthesizes the findings into a single authoritative report. The goal is simple: separate what is true from what is loud, and deliver intelligence that security professionals and business leaders can act on.</p><p></p><p>Truth. Information integrity. Cognitive security. Resilience.</p>episodicChris Loehr & Bob Millerinfo@irgame.aiyes<![CDATA[Signal//Noise #023 - AI in the Workplace]]>95 percent of corporate AI pilots fail. The bigger problem is where your data goes when they do.

Companies poured tens of billions into generative AI, yet MIT found that 95 percent of enterprise pilots returned nothing measurable. On this episode of Signal // Noise, Chris Loehr and Bob Miller examine why most AI projects fail and the security problem hiding underneath. When sanctioned pilots stall, employees quietly route real business data through consumer tools, creating ungoverned shadow AI exposure. We run the same story through five AI engines, Claude, ChatGPT, Perplexity, Grok, and Gemini, then compare their analysis on air. Learn the failure pattern, the data governance root cause, and the controls that actually contain the risk.

WHAT WE COVER

- The MIT NANDA finding that 95 percent of GenAI pilots show no profit-and-loss impact

- The "learning gap" and why model quality is not the reason pilots fail

- How budget goes to sales and marketing while the real return sits in back-office work

- The build-versus-buy success gap, and the vendor bias to watch for in that claim

- The shadow AI economy, where over 90 percent of workers use unsanctioned tools

- How failed adoption becomes ungoverned data exposure

- Gartner's forecast that 40 percent of agentic AI projects get canceled by 2027

KEY TAKEAWAYS

- AI project failure and AI security exposure share one root cause, weak governance

- You cannot govern AI use you have not inventoried, so discovery comes first

- Banning consumer AI tools tends to push usage underground rather than stop it

- The fix for the failure rate and the fix for the risk are the same program of work

ABOUT THE SHOW

Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.

RESOURCES

- Original article: https://trullion.com/blog/why-95-of-ai-projects-fail-and-why-the-5-that-survive-matter/

- MIT NANDA, The GenAI Divide: State of AI in Business 2025 (via Fortune): https://fortune.com/2025/08/18/mit-report-95-percent-generative-ai-pilots-at-companies-failing-cfo

- Gartner, Over 40% of Agentic AI Projects Will Be Canceled by End of 2027: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027

- Supporting files: https://tinyurl.com/C-B-QuickPicks

TAGS

cybersecurity, infosec, shadow AI, AI governance, generative AI, AI security, MIT AI report, 95 percent AI fail, agentic AI, AI risk, data governance, enterprise AI, AI adoption, CISO, IT security, Claude AI, ChatGPT, Gemini, Perplexity, Grok, AI comparison, Signal Noise podcast

]]>907c5730-23a6-4eee-aa81-cba0607e7166Sun, 14 Jun 2026 15:16:56 GMT<p><b>95 percent of corporate AI pilots fail. The bigger problem is where your data goes when they do.</b></p><p></p><p>Companies poured tens of billions into generative AI, yet MIT found that 95 percent of enterprise pilots returned nothing measurable. On this episode of Signal // Noise, Chris Loehr and Bob Miller examine why most AI projects fail and the security problem hiding underneath. When sanctioned pilots stall, employees quietly route real business data through consumer tools, creating ungoverned shadow AI exposure. We run the same story through five AI engines, Claude, ChatGPT, Perplexity, Grok, and Gemini, then compare their analysis on air. Learn the failure pattern, the data governance root cause, and the controls that actually contain the risk.</p><p></p><p><b>WHAT WE COVER</b></p><p></p><p>- The MIT NANDA finding that 95 percent of GenAI pilots show no profit-and-loss impact</p><p>- The "learning gap" and why model quality is not the reason pilots fail</p><p>- How budget goes to sales and marketing while the real return sits in back-office work</p><p>- The build-versus-buy success gap, and the vendor bias to watch for in that claim</p><p>- The shadow AI economy, where over 90 percent of workers use unsanctioned tools</p><p>- How failed adoption becomes ungoverned data exposure</p><p>- Gartner's forecast that 40 percent of agentic AI projects get canceled by 2027</p><p></p><p><b>KEY TAKEAWAYS</b></p><p></p><p>- AI project failure and AI security exposure share one root cause, weak governance</p><p>- You cannot govern AI use you have not inventoried, so discovery comes first</p><p>- Banning consumer AI tools tends to push usage underground rather than stop it</p><p>- The fix for the failure rate and the fix for the risk are the same program of work</p><p></p><p><b>ABOUT THE SHOW</b></p><p></p><p>Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.</p><p></p><p><b>RESOURCES</b></p><p></p><p>- Original article: <a rel="noopener noreferrer nofollow" href="https://trullion.com/blog/why-95-of-ai-projects-fail-and-why-the-5-that-survive-matter/" target="_blank">https://trullion.com/blog/why-95-of-ai-projects-fail-and-why-the-5-that-survive-matter/</a></p><p>- MIT NANDA, The GenAI Divide: State of AI in Business 2025 (via Fortune): <a rel="noopener noreferrer nofollow" href="https://fortune.com/2025/08/18/mit-report-95-percent-generative-ai-pilots-at-companies-failing-cfo" target="_blank">https://fortune.com/2025/08/18/mit-report-95-percent-generative-ai-pilots-at-companies-failing-cfo</a></p><p>- Gartner, Over 40% of Agentic AI Projects Will Be Canceled by End of 2027: <a rel="noopener noreferrer nofollow" href="https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027" target="_blank">https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027</a></p><p>- Supporting files: <a rel="noopener noreferrer nofollow" href="https://tinyurl.com/C-B-QuickPicks" target="_blank">https://tinyurl.com/C-B-QuickPicks</a></p><p></p><p><b>TAGS</b> </p><p></p><p>cybersecurity, infosec, shadow AI, AI governance, generative AI, AI security, MIT AI report, 95 percent AI fail, agentic AI, AI risk, data governance, enterprise AI, AI adoption, CISO, IT security, Claude AI, ChatGPT, Gemini, Perplexity, Grok, AI comparison, Signal Noise podcast</p>yes00:37:18123Signal//Noise #023 - AI in the Workplacefull<![CDATA[Signal//Noise #022 - Another Day, Another Shai-Hulud]]>637 malicious npm packages in 22 minutes. Here is what happened, who is at risk, and what to do right now.

On May 19, 2026, the Shai-Hulud supply chain poisoning campaign hit the npm ecosystem again. A single automated publisher account poisoned 317 package names including high-download AntV and echarts-for-react dependencies, deploying a complete credential theft and self-propagation kill chain against developer workstations and CI/CD pipelines worldwide.

WHAT WE COVER

- How 637 malicious package versions were published in 22 minutes via automated npm pipeline

- Three payload variants: lightweight external-ref (defeats static scanning), full-featured embedded credential stealer, and enhanced worm with self-propagation

- Why the Python Dead-drop C2 hiding in GitHub commit search traffic is nearly undetectable

- GitHub's response: 640 packages removed and 61,274 npm tokens invalidated

- Attribution: why SlowMist calls this a probable copycat and why that matters more than the actor identity

KEY TAKEAWAYS

- npm lifecycle hooks execute with user privileges on install with no sandbox and no confirmation prompt

- AI coding assistant configuration files are now a viable attacker persistence vector most security programs do not cover

- Stolen npm OIDC tokens enable self-propagation: your own packages can become infection vectors for your downstream users

ABOUT THE SHOW

Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.

RESOURCES

- Original article: https://slowmist.medium.com/threat-intelligence-shai-hulud-supply-chain-poisoning-cloud-credential-theft-and-1b8a3a4edd12

- Microsoft Security Blog (Mini Shai Hulud): https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/

- SlowMist MistEye IOC Platform: https://enterprise.misteye.io/threat-intelligence/SM-2026-650212

- SafeDep analysis: https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/

- Endor Labs SLSA forgery: https://www.endorlabs.com/learn/mini-shai-hulud-returns-42-malicious-npm-packages-fake-sigstore-badges-in-antv-ecosystem-attack

- StepSecurity durabletask: https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack

TAGS

Mini Shai-Hulud, Shai-Hulud npm, supply chain attack, npm malware,

]]>ee4077a0-6a3f-4381-acde-e72332811832Sun, 14 Jun 2026 04:00:32 GMT<p><b>637 malicious npm packages in 22 minutes. Here is what happened, who is at risk, and what to do right now.</b></p><p></p><p>On May 19, 2026, the Shai-Hulud supply chain poisoning campaign hit the npm ecosystem again. A single automated publisher account poisoned 317 package names including high-download AntV and echarts-for-react dependencies, deploying a complete credential theft and self-propagation kill chain against developer workstations and CI/CD pipelines worldwide. </p><p></p><p><b>WHAT WE COVER</b></p><p>- How 637 malicious package versions were published in 22 minutes via automated npm pipeline</p><p>- Three payload variants: lightweight external-ref (defeats static scanning), full-featured embedded credential stealer, and enhanced worm with self-propagation</p><p>- Why the Python Dead-drop C2 hiding in GitHub commit search traffic is nearly undetectable</p><p>- GitHub's response: 640 packages removed and 61,274 npm tokens invalidated</p><p>- Attribution: why SlowMist calls this a probable copycat and why that matters more than the actor identity</p><p></p><p><b>KEY TAKEAWAYS</b></p><p>- npm lifecycle hooks execute with user privileges on install with no sandbox and no confirmation prompt</p><p>- AI coding assistant configuration files are now a viable attacker persistence vector most security programs do not cover</p><p>- Stolen npm OIDC tokens enable self-propagation: your own packages can become infection vectors for your downstream users</p><p></p><p><b>ABOUT THE SHOW</b></p><p>Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.</p><p></p><p><b>RESOURCES</b></p><p>- Original article: <a rel="noopener noreferrer nofollow" href="https://slowmist.medium.com/threat-intelligence-shai-hulud-supply-chain-poisoning-cloud-credential-theft-and-1b8a3a4edd12" target="_blank">https://slowmist.medium.com/threat-intelligence-shai-hulud-supply-chain-poisoning-cloud-credential-theft-and-1b8a3a4edd12</a></p><p>- Microsoft Security Blog (Mini Shai Hulud): <a rel="noopener noreferrer nofollow" href="https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/" target="_blank">https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/</a></p><p>- SlowMist MistEye IOC Platform: <a rel="noopener noreferrer nofollow" href="https://enterprise.misteye.io/threat-intelligence/SM-2026-650212" target="_blank">https://enterprise.misteye.io/threat-intelligence/SM-2026-650212</a></p><p>- SafeDep analysis: <a rel="noopener noreferrer nofollow" href="https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/" target="_blank">https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/</a></p><p>- Endor Labs SLSA forgery: <a rel="noopener noreferrer nofollow" href="https://www.endorlabs.com/learn/mini-shai-hulud-returns-42-malicious-npm-packages-fake-sigstore-badges-in-antv-ecosystem-attack" target="_blank">https://www.endorlabs.com/learn/mini-shai-hulud-returns-42-malicious-npm-packages-fake-sigstore-badges-in-antv-ecosystem-attack</a></p><p>- StepSecurity durabletask: <a rel="noopener noreferrer nofollow" href="https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack" target="_blank">https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack</a></p><p></p><p><b>TAGS</b></p><p>Mini Shai-Hulud, Shai-Hulud npm, supply chain attack, npm malware, </p>yes00:25:51122Signal//Noise #022 - Another Day, Another Shai-Huludfull<![CDATA[Signal // Noise #021 - 3rd Party Risk with Eric Tilds]]>MSPs are absorbing liability they didn't agree to take on — because their vendor contracts let it happen. Here's what to do about it.

EPISODE OVERVIEW
Signal // Noise #021 brings in a special guest: Eric Tilds, an attorney whose practice represents approximately 500 MSPs and MSSPs worldwide. With third-party software compromises happening weekly, Bob Miller and Chris Loehr sit down with Eric to break down what MSP vendor contracts actually say, why that language is costing service providers, and what a properly negotiated agreement looks like. This is not a legal theory episode. It's a practical session on what needs to change in your document stack right now.

WHAT WE COVER
- Why fewer than 5 of Eric's 500 MSP clients have their vendor contracts reviewed before signing
- How standard vendor liability caps (typically one year of fees paid) leave MSPs exposed when a third-party compromise causes real damage
- The three contract clauses that matter most: required security controls, mandatory breach notification, and indemnification
- How the IDEsaster supply chain attack pattern connects directly to current third-party compromise risk
- The GitHub repository breach carried out by Team PCP — and what it cost downstream
- Why "they don't allow contract negotiation" is almost always false, and how to push back
- What a vendor management program looks like for a 10-person MSP versus an enterprise shop

KEY TAKEAWAYS
- Your customer agreement and your vendor agreement need to work together — a gap in either one becomes your liability
- If you haven't negotiated security control obligations into your vendor contracts, you likely cannot recover your actual losses
- Documenting your vendor vetting process (including SOC reports) is as important as the vetting itself
- Small MSPs are not exempt from this exposure — limiting your tool stack is a practical starting point
- The community-wide answer is a unified front: MSPs collectively pushing vendors toward responsible contract language

ABOUT THE SHOW
Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Each incident episode runs the same event through five leading AI analysis tools (Claude, ChatGPT, Perplexity, Grok, and Gemini) and compares results live on air. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.

RESOURCES
- Cyber Constitution (free download): https://cyberconstitution.org
- IRGame: https://irgame.ai

TAGS
third-party risk, MSP security, supply chain attack, vendor contracts, cybersecurity law, MSP liability, third-party compromise, Team PCP, GitHub breach, IDEsaster, vendor management, cybersecurity podcast, Chris Loehr, Bob Miller, Eric Tilds, Signal to Noise podcast, MSSP, infosec, IT security, contract negotiation

]]>5b107d32-0f5e-4d5a-90ef-0ab3379f7f0dFri, 22 May 2026 23:09:16 GMT<p>MSPs are absorbing liability they didn't agree to take on — because their vendor contracts let it happen. Here's what to do about it.<br /><br />EPISODE OVERVIEW<br />Signal // Noise #021 brings in a special guest: Eric Tilds, an attorney whose practice represents approximately 500 MSPs and MSSPs worldwide. With third-party software compromises happening weekly, Bob Miller and Chris Loehr sit down with Eric to break down what MSP vendor contracts actually say, why that language is costing service providers, and what a properly negotiated agreement looks like. This is not a legal theory episode. It's a practical session on what needs to change in your document stack right now.<br /><br />WHAT WE COVER<br />- Why fewer than 5 of Eric's 500 MSP clients have their vendor contracts reviewed before signing<br />- How standard vendor liability caps (typically one year of fees paid) leave MSPs exposed when a third-party compromise causes real damage<br />- The three contract clauses that matter most: required security controls, mandatory breach notification, and indemnification<br />- How the IDEsaster supply chain attack pattern connects directly to current third-party compromise risk<br />- The GitHub repository breach carried out by Team PCP — and what it cost downstream<br />- Why "they don't allow contract negotiation" is almost always false, and how to push back<br />- What a vendor management program looks like for a 10-person MSP versus an enterprise shop<br /><br />KEY TAKEAWAYS<br />- Your customer agreement and your vendor agreement need to work together — a gap in either one becomes your liability<br />- If you haven't negotiated security control obligations into your vendor contracts, you likely cannot recover your actual losses<br />- Documenting your vendor vetting process (including SOC reports) is as important as the vetting itself<br />- Small MSPs are not exempt from this exposure — limiting your tool stack is a practical starting point<br />- The community-wide answer is a unified front: MSPs collectively pushing vendors toward responsible contract language<br /><br />ABOUT THE SHOW<br />Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Each incident episode runs the same event through five leading AI analysis tools (Claude, ChatGPT, Perplexity, Grok, and Gemini) and compares results live on air. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats.<br /><br />RESOURCES<br />- Cyber Constitution (free download): <a rel="noopener noreferrer nofollow" href="https://cyberconstitution.org" target="_blank">https://cyberconstitution.org</a><br />- IRGame: <a rel="noopener noreferrer nofollow" href="https://irgame.ai" target="_blank">https://irgame.ai</a><br /><br />TAGS<br />third-party risk, MSP security, supply chain attack, vendor contracts, cybersecurity law, MSP liability, third-party compromise, Team PCP, GitHub breach, IDEsaster, vendor management, cybersecurity podcast, Chris Loehr, Bob Miller, Eric Tilds, Signal to Noise podcast, MSSP, infosec, IT security, contract negotiation</p>no00:30:34Signal // Noise #021 - 3rd Party Risk with Eric Tildsfull