Deep dives into relevant cybersecurity topics, focusing especially on cloud and application security
pulse.latio.tech (https://pulse.latio.tech?utm_medium=podcast)
Jonathan Rau, VP and Distinguished Engineer at Query.ai, discusses the evolving landscape of security operations and data management with the host, highlighting the shift towards data lakes and the importance of data engineers.
12 Aug 2025
LotR Episode 8: What is Reachability?
Omer Yair and Martin Torp discuss how reachability technologies aid vulnerability management, offering insights into static versus runtime analysis for prioritizing cybersecurity risks.
22 Jul 2025
LotR Episode 7: Securing AI Applications
Dor Sarig and Vrajesh Bhavsar, co-founders of Pillar Security and Operant AI, discuss the unique challenges and emerging threats in AI security, emphasizing data control, compliance, and robust testing strategies in this interview episode.
26 Jun 2025
What is a SOC in 2025?
Industry experts James Berthoty, Kyle Polley, and Ariful Huq examine the future of Security Operations Centers, emphasizing AI's role in improving threat detection and reducing alert fatigue in this interview.
17 Jun 2025
LotR Episode 5 - Lessons from Shutting Down a Startup
Yoad Fekete, former CEO of Mirror Security, shares lessons learned from shutting down a startup, including recognizing market signals and managing the shutdown process, in an interview with James Berthoty and Charrah.
3 Jun 2025
Latio on the Record Episode 4 - What's the Deal with Hardened Containers
James Berthoty, Charrah Hardamon, Alex Zenla, and Ariadne Conill examine container security, software distribution's evolution, and runtime protection, revealing the necessity of a comprehensive security strategy in this interview.
12 May 2025
LotR Episode 3 - Digging into eBPF for Security
Date: May 12, 2025Guest: Daniel Pacak (Software Engineer, Miggo)Hosts: James Berthoty, Charrah HardamonTopic: Building Real Runtime Security with eBPF
In this episode, we go deep on eBPF and what it actually takes to build reliable, performant runtime detection, beyond the buzzwords. James and Charrah are joined by Daniel Pacak, a longtime engineer in the cloud security space whose work spans Aqua Security, Cycode, RAD Security, and now Miggo. Daniel brings years of firsthand experience building eBPF sensors and walking the line between kernel-level complexity and practical detection coverage.
We open with Daniel’s journey into runtime security, beginning with his early work on Aqua’s Tracee project and continuing through multiple startup roles where he helped shape eBPF-based detection systems. He shares candid insights about the challenges of kernel instrumentation, the tradeoffs of performance versus visibility, and why function-level detection is so difficult but increasingly important.
Key discussion points include:
* Why runtime protection historically underperformed on Linux
* How vendors differ in their approaches to eBPF integration
* The technical realities behind stack unwinding, kernel hooks, and symbolization
* What ADR (and CADR) really means from a backend detection perspective
* Common misconceptions around eBPF and what it can (and can’t) do
* Why the industry lacks a common SDK or standard framework for building sensors
* Practical advice for evaluating vendors’ claims and assessing impact in real-world clusters
Daniel also walks through his thinking on why some tools overload the node with too much local processing, and what a healthier architecture looks like, particularly for teams focused on tuning alerts and scaling reliably.
The episode closes with a reminder that learning eBPF is a long road, but one with real payoffs for engineers interested in modern detection systems. And for security teams trying to figure out if eBPF tooling fits into their environment, Daniel gives straightforward guidance: test it in a real cluster, give it time to run, and measure both what it detects and how it performs.
Follow Daniel’s work on GitHub (https://github.com/danielpacak) or LinkedIn (https://www.linkedin.com/in/pacakdaniel/).
Get full access to Latio Pulse at pulse.latio.tech/subscribe (https://pulse.latio.tech/subscribe?utm_medium=podcast&utm_campaign=CTA_4)
2 Apr 2025
LotR - Episode 2: tj-actions and the Supply Chain Scaries
Featuring:
* Rami McCarthy (https://www.linkedin.com/in/ramimac/) @ Wiz (https://www.wiz.io/)
* Shay Berkovich (https://www.linkedin.com/in/shay-berkovich-0a09975/) @ Wiz (https://www.wiz.io/)
* Charrah Hardamon (https://www.linkedin.com/in/hardamoncharrah/) @ Miggo (https://www.miggo.io/)
* James Berthoty (https://www.linkedin.com/in/james-berthoty/) @ Latio (https://latio.tech/)
In this conversation, we discuss the TJ Actions incident, a significant supply chain vulnerability affecting GitHub Actions. They explore the implications of a single maintainer's code being widely used, the community's response to the incident, and the challenges of disclosure and communication. The discussion also delves into the broader impact of such vulnerabilities on the open-source ecosystem and the responsibilities of platforms like GitHub in ensuring security. In this conversation, the speakers discuss the complexities of incident management and communication strategies in the context of a significant security incident involving GitHub actions, Coinbase, and ReviewDog. They analyze the attack patterns, payloads used, and the importance of supply chain security awareness. The discussion also emphasizes the need for effective remediation strategies and best practices to enhance security in open source projects.
Takeaways
* TJ Actions is a supply chain issue primarily around GitHub Actions.
* The incident highlights the risks of relying on a single maintainer.
* Community response was crucial in addressing the vulnerability.
* Disclosure practices need to be responsible and timely.
* Fear-mongering can lead to misinformation about the impact of vulnerabilities.
* The attack surface for open-source projects is vast and complex.
* Investigating incidents requires collaboration and sharing of information.
* Open-source security practices need to be scrutinized and improved.
* Maintainers should be aware of the risks associated with access and contributions.
* Platforms like GitHub have a responsibility to enhance security measures. We have been consistently making sure to communicate with GitHub.
* It's important to empower maintainers to manage incidents.
* This incident spans the shared responsibility model.
* GitHub gives people a lot of tools for security.
* Hash pinning actions is crucial for security.
* There is a balance between usability and security in ecosystems.
* The complexity of incidents can confound attempts to tell a clean story.
* Proper visibility is needed to understand the attack landscape.
* Organizations need to prioritize security measures effectively.
* The open source community plays a vital role in security.
Chapters
* 00:00 Introduction to TJ Actions Incident
* 01:53 Understanding the Supply Chain Vulnerability
* 05:37 Community Response and Research Efforts
* 09:30 Disclosure and Communication Challenges
* 13:56 Impact Assessment and Fear-Mongering
* 17:35 Digging Deeper: The ReviewDog Connection
* 22:24 Open Source Security Concerns
* 28:39 The Attack Surface and Future Mitigations
* 32:32 Incident Management and Communication Strategies
* 35:46 Understanding the Attack: Coinbase and ReviewDog
* 38:40 Payload Analysis and Attack Patterns
* 44:09 The Need for Supply Chain Security Awareness
* 49:13 Remediation Strategies and Best Practices
Get full access to Latio Pulse at pulse.latio.tech/subscribe (https://pulse.latio.tech/subscribe?utm_medium=podcast&utm_campaign=CTA_4)
25 Mar 2025
Latio: On the Record, Episode 1
In this episode of Latio: on the Record, experts discuss the critical aspects of cloud security, focusing on runtime security, its challenges, and the evolving threat landscape. The conversation highlights the importance of collaboration between security and DevOps teams, the need for effective incident response strategies, and the integration of AI in security practices. The panelists share insights on prioritizing security measures, addressing supply chain vulnerabilities, and the necessity of building trust in security tools and processes.
Featuring:
* Gal Elbaz (https://www.linkedin.com/in/gal-elbaz/) from Oligo Security (https://www.oligo.security/)
* Sergej Epp (https://www.linkedin.com/in/sergejepp/) from Sysdig (https://sysdig.com/)
* Casey Lems (https://www.linkedin.com/in/caseylems/) from PagerDuty (https://www.pagerduty.com/)
* Crystal Poenisch (https://www.linkedin.com/in/pmmcrystal/) from Frequency Labs
* James Berthoty (https://www.linkedin.com/in/james-berthoty/) from Latio Tech (https://www.latio.tech/)
Takeaways
* Runtime security has been historically overlooked in cloud security.
* Prioritizing security measures involves balancing guardrails, posture management, and runtime security.
* The threat landscape is evolving, with supply chain attacks becoming more prevalent.
* Collaboration between security and DevOps teams is essential for effective runtime security.
* Operationalizing runtime security presents unique challenges for security teams.
* AI can enhance security practices but also introduces new risks.
* Building trust in security tools is crucial for adoption and effectiveness.
* Security must adapt to the fast-paced changes in technology and threats.
* Understanding the motivations of different teams can improve collaboration.
* The future of security lies in a collaborative effort across all teams.
Chapters
* 00:00 Introduction to Cloud Security and Runtime Challenges
* 00:04 New Chapter
* 02:13 Prioritizing Cloud Security Components
* 03:40 Evolution of Cloud Security Practices
* 06:28 Application Security and Runtime Defense
* 10:15 Communicating the Importance of Runtime Security
* 12:27 Integrating Runtime Security into Cloud Programs
* 14:31 Operationalizing Runtime Security in SOCs
* 18:46 Navigating the Complexities of Cloud Security
* 23:10 Future Directions in Cloud Security
* 25:44 Understanding Runtime Security Challenges
* 27:32 The Evolution of User Roles in Security
* 30:10 Collaboration Between Security and Development Teams
* 32:55 The Impact of AI on Security Practices
* 37:33 Navigating the Complexities of Security in Modern Development
* 44:21 The Human Element in Security Collaboration
Get full access to Latio Pulse at pulse.latio.tech/subscribe (https://pulse.latio.tech/subscribe?utm_medium=podcast&utm_campaign=CTA_4)
Who has been a guest on Latio: On the Record
Names identified in recent episode analyses. Showing up to five guests.
Jonathan Rau
Dor Sarig
Vrajesh Bhavsar
James Berthoty
Kyle Polley
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
34,448
Score snapshot 15 Sept 2025
Apple Podcasts (US)
5.0 / 5
1 ratings
Podcast Authority Score: 38 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
42
Social presence
0
YouTube
85
Engagement
0
Contact Latio: On the Record
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Latio: On the Record?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
