Cloud Security Podcast LIVE!

Cloud Security Podcast LIVE!

Speakers: Ashish Rajan, Jackie Bow, Kane Narraway

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch on YouTube

Reading time: ~7 minutes

TL;DR

A live recording of the Cloud Security Podcast brought together Jackie Bow (Anthropic's threat detection engineering lead) and Kane Narraway (Canva enterprise security lead) to debate how defenders should engage with AI — building with it, or hardening against it. The panel surfaced a sharp consensus: security teams that refuse to use AI as a force multiplier will fall irreversibly behind attackers who already do.

Introduction

The Cloud Security Podcast has been running for six years and commands an audience of 150,000 followers. At BSidesSF 2025, host Ashish Rajan brought the show to Theater 13 for a rare live recording, positioning two practitioners at opposite ends of the same question: is AI an ally defenders should wield, or a threat surface they should first contain?

The debate was framed around BSidesSF's "Here Be Dragons" theme — and the dragon, everyone agreed, is AI. What the panelists disagreed on was which side of the sword to pick up first. The resulting conversation moved across threat modeling, agentic workflows, vibe-coding, and the real-world infrastructure teams are building today to keep pace with an accelerating threat landscape.

The State of Traditional Security Operations

▶ Watch: Traditional SOC limitations and AI's entry (04:30)

Jackie Bow opened with a pointed critique of the tools that have defined detection and response for the past decade. SIEMs like Splunk were described as monolithic black boxes: alerts go in, something gets spit out, and no one really knows why. Vendors have spent at least ten years selling "AI-powered detection" — XDR, next-generation this and that — and in Bow's assessment that product category has largely delivered false positives and inflated subscription costs.

The irony is that this history has made security practitioners rightly skeptical of AI at exactly the moment when genuinely useful AI is arriving. The pre-LLM wave of "AI security" was, as Bow put it, "hot garbage." The current wave is different in a concrete way: practitioners can now see the prompts going in, tune them, run the same detection through an LLM multiple times and pick the best result, and trace exactly how a conclusion was reached. The black box is gone.

Building Detection with LLMs: Claude Code in Production

▶ Watch: Using Claude for detection engineering at Anthropic (14:10)

Bow described the actual production stack her team operates at Anthropic. The workflow uses Claude Code — Anthropic's coding agent — to write Terraform, manage infrastructure, and draft detection signatures. When AWS or GCP releases a new service, the detection life cycle now compresses dramatically: Bow can query Claude about what log fields to look for, prototype a signature, put up a pull request, and have a live detective control within five to ten minutes.

For investigations, Claude agents query a Postgres-backed data lake using custom tools the team built (with Claude's help). The architecture is deliberately SIEM-agnostic: it uses open standards like Sigma rules rather than proprietary formats, and it runs across GCP and AWS. The message for teams on tighter budgets was that none of this relies on secret Anthropic tooling. The components — open models, cloud databases, well-documented APIs — are available to anyone.

A particularly interesting design choice: Bow's team runs batches of Claude agents over non-alerting, lower-confidence detections to surface things that might otherwise be missed. In one memorable example, Claude autonomously flagged a detection that had been firing repeatedly and included a note in its report expressing concern about a program's security posture for not tuning it. "Are you working?" Bow recalled thinking. The anecdote illustrated both the emergent personality of modern LLMs and the genuine utility of using them for continuous retrospective review.

Threat Modeling AI Systems: Kane's Wizard Perspective

▶ Watch: Threat modeling AI tools and MCP security (22:45)

Kane Narraway's talk later in the day covered enterprise AI threat modeling, and he used the podcast to preview its core framework. He organizes risk around two axes: access (how users interact with AI systems — desktops, phones, which endpoints) and integrations (what the AI is talking to — Jira, Salesforce, customer data stores). These two dimensions drive the vast majority of exploitable surface area.

His assessment of MCP (Model Context Protocol) was nuanced. The spec includes an authorization layer that has attracted significant critical commentary in the security community, but Narraway pointed to vendors like Cloudflare and Merge who have built hosted MCP server infrastructure that shifts the model from thousands of open-source agents running on individual laptops to a single hardened server authenticating all employee interactions. From a threat-modeling standpoint, one thing is far easier to secure than a thousand.

On enterprise AI search tools — Glean, Atlassian Rovo, Slack AI, and similar products — the threat model converges on authorization failures. These tools layer on top of existing SaaS APIs that were not designed with AI-scale access in mind, and the result is often an expansion of privilege and a proliferation of service accounts. The risk profile is less exotic vulnerability research and more "classic problems amplified to eleven."

Controlled Hallucination and Identity in Agentic Workflows

▶ Watch: Hallucination as a feature, and identity tracing in agentic systems (31:00)

One of the more counterintuitive moments in the panel came when Bow defended a degree of deliberate hallucination in security LLMs. The concern is usually framed as: models making things up is dangerous. Her reframe: in open-ended investigations, rigid playbook thinking is the enemy. Encouraging a model to generate investigative hypotheses that a human analyst would not have considered independently is a feature, not a bug — as long as the model is not fabricating log events or evidence.

The guardrail, she argued, is tooling: models should be given structured tools to query real data rather than generating it from prior knowledge. Hallucinate the question, not the answer.

Both panelists converged on identity and traceability as the defining unsolved problem in agentic security. When an API call that brings down a server traces back to "Amazon Bedrock" or "a Claude agent," that attribution is useless for incident response. Organizations need to build identity systems that can trace agentic actions all the way back to a human principal — especially as AI agents begin performing actions on behalf of users across infrastructure they have not historically touched.

Notable Quotes

"We are not going to be able to keep up as defenders if we are not willing to use this technology." — Jackie Bow (▶ 38:20)

"If your engineers are doing it, then you are going to fall further and further behind. Learn the hard way." — Jackie Bow (▶ 39:05)

"At the moment a lot of [AI security] is through education, because there's not a lot of tooling out today that kind of helps this." — Kane Narraway (▶ 27:10)

Key Takeaways

• The black-box AI era is over. Modern LLMs give defenders visibility into reasoning, tuneable prompts, and the ability to verify outputs — a fundamental difference from legacy "AI-powered" vendor products.
• Vibe-coding is real and production-ready. Jackie Bow's team uses Claude Code to write Terraform, build tools, and prototype detections in minutes. Non-coders on security teams can now ship working tooling.
• MCP risk is primarily about authorization and identity. The exotic attacks get the coverage; the real risk is service account sprawl and authorization failures in enterprise AI search integrations.
• Controlled hallucination has a place in investigations. LLMs generating novel hypotheses during incident response is desirable — as long as models are using tools to query real data rather than inventing it.
• Agentic identity tracing is the next hard problem. Knowing that an action came from "an AI agent" is insufficient for incident response. Attribution chains must extend back to human principals.