Interview with Karen Heart
Rethinking Security from the OS Up in the Age of AI
Karen Heart discusses a file-system–first approach to security, arguing that most modern attacks—including ransomware and supply chain compromises—succeed because they inherit user permissions and operate inside overly trusted system structures.
She explains how limiting file access, socket (network) access, and privilege escalation at the operating system level can reduce entire classes of attacks. Rather than relying on reactive detection, her approach emphasizes immutable, allowlisted controls embedded close to the kernel layer, designed to prevent both data exfiltration and malicious code execution at the source.
The conversation also explores how AI agents and contractors expand the attack surface, reinforcing the need for strict isolation, backup protection, and deterministic system boundaries.
Segment Resources:
Karen's product, including a link to Github, is at https://heartsecsuite.com/ You can contact Karen at [email protected]
RSAC Executive Interviews, Part 1
The New Era of DNS Resilience: Breaking down the newly finalized NIST SP 800-81
Craig Sanderson from Infoblox will dive into the newly finalized NIST SP 800-81 as it marks a pivotal shift in DNS security, emphasizing resilience through modernized practices tailored for today’s distributed, cloud-driven, and threat-laden environments. This update provides actionable guidance for organizations to strengthen DNS infrastructure against evolving threats like ransomware and data exfiltration, while prioritizing initiatives like DNSSEC, encryption, and protective DNS for immediate risk reduction.
This segment is sponsored by Infoblox. Visit https://securityweekly.com/infobloxrsac to learn more about them!
Agentic AI and the Future of Threat Intelligence Operations
Security teams collect large volumes of threat intelligence but often struggle to translate that information into coordinated operational response. This discussion explores how organizations are embedding intelligence directly into security workflows and introducing AI agents to support investigation, enrichment and response. Sachin will discuss Cyware’s Agentic Fabric approach and the evolution toward an agent-centric model, where a portfolio of specialized agents assists analysts across threat intelligence, detection engineering and response workflows. The conversation will focus on how AI can support security teams while maintaining human oversight and operational control.
This segment is sponsored by Cyware. Visit https://securityweekly.com/cywarersac to learn more about them!
RSAC Executive Interviews, Part 2
Beyond the Audit: Making Cyber Risk Continuous, Quantified, and Actionable
Most companies assess cyber risk once a year and call it done — but for organizations managing dozens of subsidiaries or portfolio companies, that's a costly blind spot. In this RSA interview, Resilience's VP of Customer Engagement explores why measuring risk in dollars (not color-coded charts) changes the conversation at the board level, and why the organizations best positioned to prevent losses are the ones treating cyber risk as a continuous discipline rather than an annual exercise.
See it in action. Request a demo at https://securityweekly.com/resiliencersac.
Delinea: Redefining Identity Security for the Agentic AI Era
As enterprises scale agentic AI and automation, privileged access is increasingly required by non-human identities (NHIs) that operate autonomously across hybrid and cloud-native environments, introducing risks that static, credential-based models were never designed to govern. Delinea's recent of acquisition of StrongDM.
This segment is sponsored by Delinea. Visit https://securityweekly.com/delinearsac to learn more about them!
Craig Sanderson is the Principal Cyber Security Strategist at Infoblox. Craig has over 25 years of experience in the CyberSecurity industry with a broad array of roles ranging from consultancy, security architecture, business development and product management. Over the last seven years, Craig has been responsible for creating the vision, strategy and delivered the execution of the Infoblox BloxOne Threat Defense solution. He continues to be passionate about the role that DNS can play in delivering world class cyber security with a particular emphasis on how DNS can become the foundation for national and governmental Protective DNS solutions.
Sachin Jade is Chief Product Officer at Cyware, where he leads product strategy for the company’s threat intelligence and security operations platform. His work focuses on helping organizations operationalize threat intelligence by integrating intelligence workflows directly into detection and response environments.
Sachin works with enterprises, government organizations and information sharing communities to advance automation, intelligence collaboration and the practical application of AI within security operations.
Travis Wong is the VP of Customer Engagement at Resilience. He leads the Security and Risk Services and Customer Success teams and brings over 15 years of experience in risk management consulting, helping clients assess, measure, and manage their risk effectively.
Phil Calvin brings more than 25 years of software development, technical leadership and entrepreneurial experience to Delinea. His areas of expertise include technical strategy, cloud architecture, and engineering executive management. Prior to Delinea, Phil spent nearly a decade at Salesforce in a variety of architectural and engineering leadership roles, most recently leading the Platform Engineering organization and focusing on making the Salesforce platform trusted, accessible, and scalable.
Karen is a teacher, software developer, and attorney with many years of experience in both fields. Currently, she teaches computer science at DePaul University and has done so for several years. From standalone end user applications to middleware to architecting distributed systems, Karen has created a wide range of software products and tools for a variety of industries, including among others publishing, banking, insurance, and logistics. As an attorney, Karen has concentrated her work in intellectual property, civil and criminal litigation, including some appellate work. She holds an MS in Computer Science from DePaul University, a JD from the University of Texas, and has completed the PhD coursework in Computer Science at UIC. Karen is licensed to practice law in Illinois. Her current research interests include system security, forensics, and cybersecurity regulation and liability.
