Key Takeaways: 

• Trust is a human emotion, not a network concept — and treating it as one creates the vulnerabilities attackers exploit. 

• Focus on "protect surfaces," not everything at once. Defend your most critical assets individually, and Zero Trust becomes incremental and non-disruptive.

• All bad things happen inside of an allow rule. If something bad happened, a policy somewhere permitted it. 

• Stop buying products and start building policy. One consistent policy construct — who, what, when, where, why, and how — can apply across your entire environment. 

• Security won't improve until CEOs change how cybersecurity is incentivized. CISOs need real authority, not just accountability when things go wrong. 

The conversation turns to a fundamental problem: detection alone isn't closing the gap. Doug and Eric argue that the industry's default playbook — detect faster, patch faster — misses the point, and that security needs an architectural reset. They lay out three runtime control points where threats can actually be stopped in progress: identity, compute, and network. Eric closes with a prediction: follow the talent moving between hyperscalers and AI labs, and follow the capital behind them.

Key Takeaways

• AI security M&A is moving at unprecedented speed. A category that didn't exist two years ago jumped from 10 deals last year to a projected 50–60 by year-end, as companies like CrowdStrike, Palo Alto Networks, and Akamai spend hundreds of millions to fill AI roadmap gaps.
• The mega deal era is accelerating. Cybersecurity M&A is on pace to exceed last year by 10%, yet most deal values remain undisclosed, making the market harder to read than it appears.
• Detection without prevention is a dead end. The industry excels at seeing threats but struggles to stop them. Investors are responding, backing prevention-oriented companies with outsized funding rounds.
• Security needs to go back to first principles. Three runtime control points — identity, compute/endpoint, and network — are the foundational layers where organizations can stop attacks in progress.

Doug and Keith also dig into what separates organizations that handle breaches well from those that don't: preparation. Drawing on incidents like the Colonial Pipeline shutdown and the Stryker attack, they argue the real vulnerability isn't how attackers get in, but how fast and far they can move once inside. It's a conversation about treating cybersecurity as a business risk rather than a purely technical one, and why boards need answers to hard questions before, not during, a crisis. 

Key Takeaways 

• Cybercrime is organized like a business. Roles are specialized and clearly compensated, from malware developers to money launderers, making these networks resilient and hard for law enforcement to dismantle. 

• Ransomware economics are shifting. The cost of storing and servicing stolen data has led many groups to abandon encryption entirely in favor of extortion alone. 

• Lateral movement, not initial access, is the real threat. Incidents like Colonial Pipeline and Stryker show that how fast attackers spread internally matters more than how they got in. 

• Preparation is non-negotiable. Boards should know who's responsible for which decisions in the first 24 hours of an attack, well before one happens. 

• Why Nick argues the industry should shift from "assume breach" to "assume containment" — and what that changes about incident response 

• The guardrails-not-gates philosophy that lets developers move fast without becoming security experts 

• How Nick's team found a workable path through an "impossible" secure-SDLC mandate on SpaceX's Falcon codebase 

• Applying Elon Musk's first-principles reasoning to break security problems down to their core "whys" 

• Why Nick sees cloud security footholds as a societal and economic risk, not just a technical one

Key Takeaways:

• CVEs are exploding — over 40,000 in 2025, with 2026 projections near 60,000 (some estimates up to 100,000) — while AI makes vulnerabilities easier to find and exploit.
• Patching capacity has long lagged below 10% of the backlog; broken production risk and competing business priorities keep it there.
• Security should shift from trying to prevent every incident to containing and recovering from the ones that happen.
• "Human in the loop" doesn't scale against AI-driven attack volume — defenders need to fight AI with AI.
• Security teams that act as collaborators, not blockers, avoid the shadow-IT workarounds that punitive policies create.