Topic
Securing AWS, Azure and GCP estates at scale: posture, architecture, guardrails and the operating model that keeps cloud risk in check.
66 episodes · 6 questions answered
How do you stop treating compliance as a checklist?
Advait says treating compliance as a document checklist no longer works. Patching, visibility, logs and tracking who accessed or changed what need to be in place from day one, not added after something is found. With controls, guardrails and visibility from the start, you are not scrambling when auditors arrive, and engineers feel confident in the product and in passing any security or compliance review.
Advait Patel · Broadcom
How should just-in-time access change IAM in 2026?
Manual access requests — file a ticket, wait for IT security and manager approval — can take a day or several, frustrate developers and slow development. Advait says that has to go: developers should request just-in-time access that is checked against predefined controls and granted in seconds or minutes. Security is not locking everything; it is locking what needs to be locked and granting what needs to be granted.
Advait Patel · Broadcom
What KPIs should security leaders track once AI is part of security operations?
Advait says traditional KPIs — mean time to react, detect and resolve — are not wrong but are no longer enough. He adds signal quality (is AI improving existing workflows), engineer efficiency (is a problem fixed faster than before), decision quality (does AI recommend well enough that you are not deciding every low-risk task) and automation safety (how often AI-driven automations are correct).
Advait Patel · Broadcom
What IAM anti-patterns should organizations avoid?
What works for 100 engineers will not work for 10,000, so IAM has to fit your company. The anti-pattern Advait calls out is starting from the top — granting admin or power-user access and removing what goes unused after 30 days. Instead, start from zero trust and minimal permissions, assign roles by team (a database team needs services like DynamoDB or Cloud SQL, not VMs), and add permissions as needed.
Advait Patel · Broadcom
How can SREs use AI agents for root cause analysis?
Agents can track changes, collect logs, find patterns in production alerts, trace the root cause, check whether an incident has happened before, and write incident runbooks. But agents cost you visibility, so you need to know what they are doing and what they are capable of. Advait starts with low-risk tasks rather than handing an agent a production API key with no human intervention.
Advait Patel · Broadcom
Will AI agents become fully autonomous in production?
Advait sees the industry heading toward autonomous agents, but says you should never fully trust anything, especially AI, with a production system that touches customers and your company's reputation. Use autonomous AI for low-risk tasks where you are fine without visibility and confident in the results; if you are even 0.01% in doubt, he doubts people will use it in production.
Advait Patel · Broadcom
49 min Ep 103 ·
Advait Patel (Broadcom): automate just-in-time access, build IAM up from least privilege, and keep AI agents on low-risk tasks until you can trust them.
Ammar Ekbote, Cloud Security Engineer at Pinterest, on eBPF, MCP server adoption, and kernel-level AI security monitoring.
Nishant Modak, founder and CEO of Last9, on scaling engineering, go-to-market strategy, and the reality of building a startup.
Sneha Malshetti, Senior Security Engineer at Ethos, on IAM differences between AWS and GCP and balancing least privilege with velocity.
Dakota Riley on building a security culture, focusing on problems over solutions, and the impact of AI on security teams.
Dinis Cruz on Kubernetes security for ephemeral environments, enriching GenAI with quality data, and threat modelling AI stacks.
Lalit Khattar, Partner Solution Architect at AWS, on career growth, channel partnerships, and scaling through AWS Marketplace.
Shweta Thapa, Security Specialist Solutions Architect at AWS, on designing security controls for generative AI applications.
Faraz Khan on cracking enterprise deals, AWS Marketplace success, and go-to-market strategy for security startups.
Uttej Badwane, Senior Security Engineer at Carta, on zero-trust implementation challenges and the future role of AI in security.
Stephen Kuenzli on IAM, AI-driven cloud security, and using agents and MCPs to improve security decision-making at scale.
Lalit Kumar on building good and lasting cloud security, transforming AWS India Security, and advising CXOs on cloud posture.
Bonnie Viteri on building a security-champions programme from scratch, enablement vs empowerment, and measuring impact.
Rowan Udell on AWS IAM best practices for production environments, least-privilege strategies, and role-based access patterns.
Scott Weston, senior consultant at NetSPI, on cloud penetration testing, the GCPwn tool he created, and how to get started with cloud security testing.
Dr. Natalia Semenova on zero-trust architecture, the challenges of asset and identity discovery, and identity as the core of zero trust.
Richard Stiennon on the ultimate guide to cloud security, the evolving threat landscape, and building defence in depth.
Lily Chau on auto-remediation in AWS, overcoming stakeholder buy-in challenges, and prioritising security fixes.
John Giglio on demystifying IAM, the security-vs-compliance debate, and data-perimeter controls for read, write, and download.
Kushagra Sharma, Senior Platform Security Engineer at Booking.com, on security baselines, boundaries, and layered defences.
Sandeep Agarwal on trust and security as the cornerstones of organisational resilience, leadership alignment, and building durable programmes.
Jan Hertsens, Senior Security Consultant at AWS, on continuous security, the compliance debate, and incident-response segmentation.
Tom Adamski on network segmentation, risk assessment before design, and layering AWS security tools for defence in depth.
Kailash Havildar on logging, monitoring, and detective controls in cloud security — what to capture and how to act on it.
Amit Subhanje on enterprise risk management, balancing proactive and reactive strategies, and shared security responsibility.
Pablo Vidal on incident response and detection, cross-team collaboration, and hiring for mutual fit in security roles.
Jesse Miller on building cybersecurity teams, creating a virtuous cycle with clients, and taking a risk-centric approach.
Josh Pyorre on threat hunting, creative security research, and the role of GenAI in uncovering new attack vectors.
Rich Mogull on cloud security maturity models, the mindset shift from on-prem, and setting realistic expectations with leadership.
Joseph South on the cloud security journey, starting with common misconfigurations, and using the Cloud Controls Matrix.
Htet Naing Aung on supply-chain security, container-image signing, SBOMs, and using SCA tools in CI/CD pipelines.
Joseph South on the cloud IAM landscape, why IAM is the new perimeter, and getting leadership buy-in for security practices.
Andre Rall on the secrets to successful cloud security, building strong foundations, and aligning security with cloud strategy.
Chad Lorenc, Security Practice Manager at AWS, on cloud IAM beyond access control, showing value to leadership, and production-account security.
Kayra Otaner on DevSecOps, cloud-native security, and unleashing security capabilities without slowing engineering teams.
Matt Tesauro on revolutionising the SDLC with DevSecOps, automation for team velocity, and training security professionals.
Kesten Broughton on asset management, Kubernetes in the cloud, and why visibility is the foundation of cloud security.
Divyanshu Shukla on practical strategies for defending Kubernetes clusters, detection techniques, and open-source defence tools.
Michele Chubirka on restorative justice as a new framework for resolving cybersecurity conflict and restoring team trust.
Divyanshu Shukla on red-teaming Kubernetes clusters, understanding attacker mindset, and exploiting common cluster weaknesses.
Gerard Johansen on incident response, digital forensics, threat intelligence, and training engineers on evidence collection.
Divyanshu Shukla on attacking and defending Kubernetes clusters in a hands-on workshop-style session.
Steve Giguere on Kubernetes security, when monoliths beat containers, and vetting open-source dependencies with SBOMs.
Kyle Fossum on DevOps and DevSecOps practices, self-serve security tooling, and why hardware security keys beat SMS-based MFA.
Ashwin Patil on security applications of Jupyter notebooks, data analysis for threat detection, and interactive investigation workflows.
Jeevan Singh on threat modelling, integrating security into the development workflow, and scaling with limited resources.
Brett Johnson on the dark web, credential-stuffing attacks, MFA bypass techniques, and why humans are the weakest link.
Emily Zakkak, cybersecurity specialist at Senowit, on defending against social engineering, phishing, and MFA best practices.
Alyssa Ahmann on GRC setup, data privacy, and why documentation and training underpin successful security programmes.
Rodrigo Montoro on AWS security monitoring, threat modelling for new services, and restricting high-impact IAM permissions.
Jim Bugwadia on Kubernetes governance, workload security responsibilities, and image-signing best practices with Sigstore.
Nader Zaveri on organisational security culture, planning and budgeting for security, and incident-response preparedness.
Jimmy Mesta on Kubernetes misconfigurations, continuous security checks, and when to choose managed K8s over self-hosting.
Syed Shareef, Senior Security Engineer at AWS, on data perimeters, combining SCP and IAM policies, and use-case-driven security.
Trupti Shiralkar on organisational security culture, joint backlog reviews for security debt, and supply-chain security standards.
Charles Mendoza on setting the line of defence in cloud security, layered controls, and incident-response readiness.
Aakash Yadav on security debt, risk prioritisation, and building a pragmatic approach to reducing organisational risk.
Mel Reyes on the biggest mistakes in cybersecurity, top-down security mandates, and setting up foundations for startups.
Vincent Romney, Head of Global Security Architecture at Nu Skin, on zero-trust architecture, programme design, and security planning.
Aseem Shrey, security engineer at Rippling, on responding to ethical hacker reports, preparing for data breaches, and building a security career.
Chris Neggel, Regional CSO at Okta, on the roadblocks teams face in cloud security and strategies to overcome them.
Ski on building a security-centric culture, improving cross-team relationships, and aligning certifications with controls.
Gary Dylina of Narvar on preparing for large-scale events, SOC2, IAM setup, and when to make a first security hire.
Gaurav Batra, founder and CEO of CyberFrat, on surprising cloud security facts and building security awareness culture.
Swati Anuj Arya, CISO Office leader at Amazon Pay, on simplifying cloud security and responding to data breaches.
Aseem Rastogi, Head of Cybersecurity and Compliance at Meesho, on building cybersecurity and compliance programmes from the ground up.
New episodes twice a month
Follow Scale To Zero wherever you listen, or send us the question your team is stuck on and we will put it to an expert.