A CISO answers the question everyone is avoiding, then flips it.

Has AI governance already failed, or are we just refusing to admit it? Alex Cunningham opens with the cynical answer, then spends the episode dismantling it. What is actually different about AI is not the technology. It is that AI went around the enterprise and straight to the consumer, and organizations have been scrambling ever since. He makes the case that AI governance is a gift to security leaders, argues culture beats people, process and technology combined, and explains why a policy without a technical control is just paper.

The season finale. What a defender changed his mind about, and what still keeps him up.

What is the first AI thing you said no to that you would say yes to today, and what changed: the technology or you? Marty Garvin on why traditional access models break the moment you point an agent at them, why agents are not malicious so much as relentlessly efficient, and the exposure problem nobody planned for: an innocent question surfacing a colleague’s salary. Plus the risk he thinks is underrated, which is not what AI can do but what it costs. Closing out season one, he leaves two questions on the table for whoever takes the chair next.

Regulation already arrived. The problem is who governments are asking.

Is AI regulation coming fast enough to matter, or will it arrive just in time to regulate yesterday's problem? Kirsty Kelly's answer: it is already here, it is fractured across every jurisdiction, and the fixation on speed misses the point. Twenty years in security and a former Group CISO twice over, she argues for rules built to survive to 2030 rather than describe 2026, and says lawmakers keep filling the room with the people who profit from the answer.

Told to use an AI tool he does not trust, a threat researcher explains exactly how he breaks it.

When you are told to use an AI tool you do not trust, what do you actually do? Joe Hall's answer is to start asking it questions it should not answer, and he walks through how, step by step. A career threat intelligence researcher on why sales teams' security claims collapse under five minutes of scrutiny, why agents escape the folders you assign them, and why decades of unpatched technical debt matter more right now than any zero day an LLM might find.

A vendor on what enterprises are quietly handing over when they buy AI.

Are enterprises outsourcing their AI ethics to the companies selling them the tools? Harry Wetherald argues most of it was already outsourced years ago. The real risk sits in the murky middle, where a tool makes consequential decisions and nobody quite knows how much AI is behind them. He predicts a Big Four of AI emerging on trust alone, explains why an answer that is right seven times out of ten is worse than no answer, and makes the case that the age of AI slop is about to correct hard.

When AI causes real harm, someone has to own it. She says it is the CEO, full stop.

When AI causes real harm inside a company, who makes the call on what to do next? Emily Choi-Greene's answer is unambiguous: the business owner, and ultimately the CEO. Drawing on a decade at Amazon running application security for Alexa AI, she makes the case for blameless post-mortems that interrogate systems rather than people, and tells the story of a shipped feature that drifted toward surveillance and never hit privacy review until it was already in beta.

Spill It is for the CISO who's tired of AI security theater. The practitioner who's been told to approve a tool they don't trust. The executive who is scrambling to balance AI risk and innovation. The policy expert watching regulation race to catch up and make a mess of a problem that's already moved on. 

If you work in AI security and you've ever wished someone would just say the quiet part out loud - this show is for you.

Every guest receives specialty coffee or tea before we record. And halfway through every episode, we stop to drink it together and compare notes. 

To keep guests on their toes, each episode ends with one guest handing a question forward specifically for the next guest. Nobody knows what's coming until the camera rolls!

Hosted by Mariana Padilla, Community Evangelist at Harmonic Security.