Podcast
Episode Description:
In this month's episode of Alice in Supply Chains, Alexandre Sieira and Adrian Sanabria cut through the AI-hacking hype to focus on the vulnerabilities that are actually driving ransomware and cyber insurance claims: old, unpatched systems and forgotten assets. They also examine the growing dispute between Microsoft and security researchers, npm's new package provenance features as a partial defense against supply chain attacks, and the broader European push for digital sovereignty.
Show Notes:
This month, Adrian and Alexandre dig into a mix of vulnerability management fundamentals, supply chain security developments, and the accelerating push for European digital sovereignty. The episode opens with a reality check on AI-assisted hacking: despite the hype around tools like Anthropic's Mythos, the vulnerabilities actually causing damage are still the old, unpatched ones sitting on forgotten assets.
Cyber insurance claims data from Coalition, At-Bay, and Cowbell is increasingly backing this up with hard numbers — including an significant increase in ransomware risk for organizations running SonicWall devices. The guys also make the case that smart CISOs are using the AI security scare as political cover to finally get boards to fund the basics.
From there, the conversation turns to a brewing conflict between Microsoft and the security research community. After researcher Nightmare Eclipse alleged that Microsoft silently patched submitted vulnerabilities without credit or payment, other researchers piled on with similar stories. Microsoft's aggressive legal threats only made things worse — and now Nightmare Eclipse is dropping full disclosures on Patch Tuesday, with more promised. The episode includes practical guidance on what a healthy vulnerability disclosure program looks like, and what happens when organizations get it wrong.
The episode also covers npm's new package provenance features as a meaningful but incomplete step against supply chain attacks like the TeamPCP campaign, plus a look at the growing EU digital sovereignty movement — including one Dutch entrepreneur's experience moving his entire stack off US providers, and why subprocessor relationships mean you might not be as decoupled as you think.
Watch or listen to full episodes in English.
Recent episodes
Episode 22
Alice in Supply Chains Episode 22 explores AI security, exposed API keys, and third-party cyber risk with Adrian Sanabria and Alexandre Sieira.
Episode 21
In this episode of the Alice in Supply Chains Podcast, Adrian Sanabria and Alexandre Sieira discuss four stories shaping third-party cyber risk management - from a BGP hijacking that compromised software updates to emerging AI risks, the rise of inside-out scanning in financial institutions, and proposed UK restrictions on risky technology suppliers.
.avif)
Episode 20 | Recorded Live at Black Hat in Las Vegas!
On episode 20, Adrian and Alexandre discuss four recent stories shaping third-party and AI risk: SOC 2 commitments deferred by vendors, the lessons from Brazil’s PSTI security requirements, AI agents and security incidents involving Hugging Face, OpenAI and Anthropic, and a prompt injection case involving outside counsel in Brazil. The episode explores what these incidents mean for TPCRM, vendor assurance, regulatory compliance, AI governance, and third-party contracts.