Season 1 · Episode 268

EP268 Weaponizing the Administrative Fabric: Cloud Identity and SaaS Compromise in M Trends 2026

Cloud Security Podcast by Google · Anton A Chuvakin

March 23, 202633m 49s

Audio is streamed directly from the publisher (traffic.libsyn.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.

Original episode page

Show Notes

Guests:

Kelli Vanderlee, Senior Manager, Threat Analysis, Mandiant, Google Cloud
Scott Runnels, Mandiant Incident Response, Google Cloud

Topics:

Do we need to rethink "Mean Time to Respond" entirely, or are we just in deep trouble?
Why are threat groups collaborating so well, and are there actual lessons for defenders in their "business" model?
What is the scalable advice for teams worried about voice phishing and GenAI cloning?
What does "weaponizing the administrative fabric" actually mean in a world where identity is the perimeter?
Why is identity/SaaS compromise "news" in 2026 when cloud security folks have been shouting about it for years? What actually changed?
What's the latest in supply chain compromise, particularly regarding malicious open-source packages?
How do we defend against malware that is "lazy" enough to use the victim's own AI tools for reconnaissance?
What is the specific advice for Detection and Response (D&R) teams to handle "living off the land" (or "living off the cloud")?
How do you fix the situation when IT and Security departments genuinely hate each other?
Besides reading the report, what is the one book or piece of advice for a CISO to survive this year?

Resources:

← All episodes of Cloud Security Podcast by Google