Loris Degioanni: Why AI Is Breaking Cybersecurity, and What Comes Next
AI has fundamentally changed the cybersecurity threat landscape, not by inventing new attack types, but by collapsing the timeline. The same tools that make software developers more productive are now being used by attackers to move from vulnerability disclosure to active exploit in a matter of hours. That shift, argues Loris Degioanni, CTO and founder of Sysdig, changes everything about how defense needs to work.
In this episode, Craig Smith talks with Loris Degioanni about why human-centered security is becoming a structural liability, what "headless cloud security" means in practice, and why the coding agent (tools like Claude Code or Codex) may become the new operating system through which all enterprise security workflows run. It's a conversation about architecture, urgency, and what it actually means to fight a tank when you've been trained to use a baseball bat.
If this conversation made you think differently about AI and security, subscribe to Eye on A.I. for weekly conversations with the people building and defending the future.
The Current State of Cloud Security with Crystal Morin
Sysdig’s 2025 Cloud-Native and Security Usage Report is hot off the presses, and Corey has questions. On this episode, he’s joined by Crystal Morin, a Cybersecurity Strategist at Sysdig, to break down the trends of the past year. They discuss Sysdig’s approach to detecting and responding to security and the success the company has seen with the rollout of Sysdig Sage (an AI product that Corey thinks is actually useful). They also chat about what’s driving a spike in machine identities, practical hygiene in cloud environments, and the crucial importance of automated responses to maintain robust security in the face of increasingly sophisticated cyber threats.
Show Highlights
(0:00) Intro
(0:39) Sysdig sponsor read
(2:22) Explaining Sysdig's 5/5/5 Benchmark
(4:06) What does Sysdig's work entail?
(10:03) Cloud security trends that have changed over the last year
(14:30) Sysdig sponsor read
(15:16) How Sysdig is using AI in its security products
(19:09) How many users are adopting AI tools like Sysdig Sage
(25:51) The reality behind the recent spike of machine identities in security
(29:24) Handling the scaling of machine identities
(35:37) Where you can find Sysdig's 2025 Cloud-Native and Security Usage Report
About Crystal Morin
Crystal Morin is a Cybersecurity Strategist with more than 10 years of experience in threat analysis and research. Crystal started her career as both a Cryptologic Language Analyst and Intelligence Analyst in the United States Air Force and as a contractor for Booz Allen Hamilton, where she helped develop and evolve their cyber threat intelligence community and threat-hunting capabilities. In 2022, Crystal joined Sysdig as a Threat Research Engineer on the Sysdig Threat Research Team, where she worked to discover and analyze cyber threat actors taking advantage of the cloud. Today, Crystal bridges the gap between business and security through cloud-focused content for leaders and practitioners alike. Crystal’s thought leadership has been foundational for pieces such as the “2024 Cloud-Native Security and Usage Report” and “Cloud vs. On-Premises: Unraveling the Mystery of the Dwell Time Disparity,” among others.
Links
Sysdig’s 2025 Cloud-Native and Security Usage Report: https://sysdig.com/2025-cloud-native-security-and-usage-report/
Sysdig on LinkedIn: https://www.linkedin.com/company/sysdig/
Crystal’s LinkedIn: https://www.linkedin.com/in/crystal-morin/
Sponsor
Sysdig: https://sysdig.com/
How Falco Brought Real-Time Observability to Infrastructure
Falco, an open-source runtime observability and security tool, was created by Sysdig founder Loris Degioanni to collect real-time system events directly from the kernel. Leveraging eBPF technology for improved safety and performance, Falco gathers data like pod names and namespaces, correlating them with customizable rules. Unlike static analysis tools, it operates in real-time, monitoring events as they occur. In this episode of The New Stack Makers, TNS Editor-in-Chief, Heather Joslyn spoke with Thomas Labarussias, Senior Developer Advocate at Sysdig, Leonardo Grasso, Open Source Tech Lead Manager at Sysdig and Luca Guerra, Sr. Open Source Engineer at Sysdig to get the latest update on Falco.
Graduating from the Cloud Native Computing Foundation (CNCF) in February 2023 after entering its sandbox six years prior, Falco’s maintainers have focused on technical maturity and broad usability. This includes simplifying installations across diverse environments, thanks in part to advancements from the Linux Foundation.
Looking ahead, the team is enhancing core functionalities, including more customizable rules and alert formats. A key innovation is Falco Talon, introduced in September 2023, which provides a no-code response engine to link alerts with real-time remediation actions. Talon addresses a longstanding gap in automating responses within the Falco ecosystem, advancing its capabilities for runtime security.
Learn more from The New Stack about Falco:
Falco Is a CNCF Graduate. Now What?
Falco Plugins Bring New Data Sources to Real-Time Security
eBPF Tools: An Overview of Falco, Inspektor Gadget, Hubble and Cilium
Join our community of newsletter subscribers to stay on top of the news and at the top of your game.
Best Practices for Securing AWS Cloud with Eric Carter
Eric Carter of Sysdig joins Corey to tackle the evolving landscape of cloud security, particularly in AWS environments. As attackers leverage automation to strike within minutes, Sysdig focuses on real-time threat detection and rapid response. Tools like Runtime Insights and open-source Falco help teams identify and mitigate misconfigurations, excessive permissions, and stealthy attacks, while Kubernetes aids in limiting lateral movement. Eric introduced the “10-minute benchmark” for defense, combining automation and human oversight. Adapting to constant change, Sysdig integrates frameworks like MITRE ATT&CK to stay ahead of threats. Corey and Eric also discuss Sysdig’s conversational AI security analyst, which simplifies decision-making.
Show Highlights
(0:00) Intro
(0:32) Sysdig sponsor read
(0:51) What they do at Sysdig
(3:28) When you need a human in the loop vs when AI is useful
(5:12) How AI may affect career progression for cloud security analysts
(8:18) The importance of security for AI
(12:18) Sysdig sponsor read
(12:39) Security practices in AWS
(15:19) How Sysdig’s security reports have shaped Corey’s thinking
(18:10) Where the cloud security industry is headed
(20:03) Cloud security increasingly feeling like an arms race between attackers and defenders
(23:33) Frustrations with properly configuring leased permissions
(28:17) How to keep up with Eric and Sysdig
About Eric Carter
Eric is an AWS Cloud Partner Advocate focused on cultivating Sysdig’s technology cloud and container partner ecosystem. Eric has spearheaded marketing efforts for enterprise technology solutions across various domains, such as security, monitoring, storage, and backup. He is passionate about working with Sysdig's alliance partners, and outside of work, enjoys performing as a guitarist in local cover bands.
Links
Sysdig's website: https://sysdig.com/
Sysdig's AWS Cloud Security: https://sysdig.com/ecosystem/aws/
Sysdig’s 5 Steps to Securing AWS Cloud Infrastructure: https://sysdig.com/content/c/pf-5-steps-to-securing-aws-cloud-infrastructure?x=Xx8NSJ
Sponsor
Sysdig: https://www.sysdig.com
Battling Back Against Data Breaches with Maya Levine
Data breaches can throw countless lives into disarray. With massive leaks and compromises happening on what feels like a daily basis, what can be done to protect people and services? On this episode, Sysdig Product Manager Maya Levine joins us for a discussion on the current state of affairs in the world of cybersecurity. Why do these attacks keep happening? Are they becoming too frequent? What can we do to prevent them? Maya has all the answers as well as tips to help keep you and your organization safe.
Show Highlights:
(0:00) Intro
(0:37) Sysdig sponsor read
(0:58) Product management at Sysdig
(2:09) Are cyber attacks becoming more frequent in the cloud?
(5:58) Urgency (or lack thereof) while under attack
(10:37) Motives and methods in modern data breaches
(15:57) Sysdig sponsor read
(16:20) The cost (and necessity) of audit logging
(18:46) “If breach is inevitable, what can people do?”
(22:36) Maya’s “I am Confused” talk
(25:40) Stopping attacks before they spiral out of control
(32:32) Where can find more from Maya and Sysdig
About Maya Levine:
Maya Levine is a Product Manager for Sysdig. Previously she worked at Check Point Software Technologies as a Security Engineer and later a Technical Marketing Engineer, focusing on cloud security. Her earnest and concise communication style connects to both technical and business audiences. She has presented at many industry conferences, including AWS re:Invent and AnsibleFest. She has also been regularly interviewed on television news channels, written publications, and podcasts about cybersecurity.
Links:
Maya’s LinkedIn: https://www.linkedin.com/in/maya-levine/
Sysdig: https://sysdig.com/
Sponsor
Sysdig: https://sysdig.com/
Falco Graduation, with Mike Coleman
Mike Coleman is a developer advocate at Sysdig focused on open source software and spends a lot of time working on the Falco project. We'll explore how Falco enables runtime security, and celebrate its recent graduation!
Do you have something cool to share? Some questions? Let us know:
- web: kubernetespodcast.com
- mail: kubernetespodcast@google.com
- twitter: @kubernetespod
News of the week Falco Graduation announcement
Google Gemma Open Model
GitOps Associate Certification (CGOA)
Certified GitOps Associate (CGOA) Exam
Linkerd 2.15 announcement
Linkerd 2.15 stable release announcement
Crossplane 1.15 announcement
Open Source Summit North America Schedule
Cloud Native Security Con North American
Cloud Native Security Con America CFP
Links from the interview Mike Coleman
LinkedIn
Twitter
"Docker?!?! But, I'm a sysadmin" - Mike Coleman
Mike Colemane and Bill Gates in an Earthquake
Falco project
LinkedIn
Twitter
Slack
KubeCon NA 2019 CTF
Cryptomining Detection Using Falco
Navigating Open Source Project Hurdles to Achieve Community Enpowerments Aizhamal Nurmamat kyzy & Bob Killen
Wrangle your alerts with open source Falco and the gcpaudit plugin
Falcosidekick
Practical Cloud Native Security with Falco
Certified Kubernetes Security (CKS) exam
Exploring Advanced Cybersecurity with Michael Isbitski
Cybersecurity leader Mike Isbitski explores the intricacies of cloud-native security and vulnerability management in today's technological landscape. With over 25 years of experience, he provides valuable insights into the challenges and complexities organizations face in securing ephemeral infrastructure and machine identities in the cloud. This episode also explores the cautious adoption of AI in cybersecurity, emphasizing the need for a balanced approach that maintains operational functionality while addressing evolving security concerns.
Key Points with Timestamp
Security through Obscurity (00:00:00) - Mike discusses common security practices.
Cloud-Native Technology Explained (00:01:30) - Unpacking the meaning of cloud-native tech.
Evolving Vulnerability Management (00:03:38) - Insights on how vulnerability management has improved.
AI in Cybersecurity (00:21:20) - Discussion on the slow but growing adoption of AI in cybersecurity.
Challenges of Permissions and Identity (00:29:29) - The complexities of permissions in the cloud environment.
Future Trends in Cybersecurity (00:34:11) - Predictions for changes and advancements in the cybersecurity landscape.
About Michael
Michael Isbitski is a former Gartner analyst, cybersecurity leader, and practitioner with more than 25 years of experience, specializing in application, cloud, and container security. Michael learned many hard lessons on the front lines of IT working on application security, vulnerability management, enterprise architecture, and systems engineering. He's guided countless organizations globally in their security initiatives as they support their businesses.
Links Referenced:
Sysdig: https://sysdig.com/
Sysdig 2024 Cloud-Native Security and Usage Report: www.sysdig.com/SITC
Benchmarking Security Attack Response Times in the Age of Automation with Anna Belak
Anna Belak, Director of the Office of Cybersecurity Strategy at Sysdig, joins Corey on Screaming in the Cloud to discuss the newest benchmark for responding to security threats, 5/5/5. Anna describes why it was necessary to set a new benchmark for responding to security threats in a timely manner, and how the Sysdig team did research to determine the best practices for detecting, correlating, and responding to potential attacks. Corey and Anna discuss the importance of focusing on improving your own benchmarks towards a goal, as well as how prevention and threat detection are both essential parts of a solid security program.
About Anna
Anna has nearly ten years of experience researching and advising organizations on cloud adoption with a focus on security best practices. As a Gartner Analyst, Anna spent six years helping more than 500 enterprises with vulnerability management, security monitoring, and DevSecOps initiatives. Anna's research and talks have been used to transform organizations' IT strategies and her research agenda helped to shape markets. Anna is the Director of Thought Leadership at Sysdig, using her deep understanding of the security industry to help IT professionals succeed in their cloud-native journey.
Anna holds a PhD in Materials Engineering from the University of Michigan, where she developed computational methods to study solar cells and rechargeable batteries.
Links Referenced:
Sysdig: https://sysdig.com/
Sysdig 5/5/5 Benchmark: https://sysdig.com/555
An Open-Source Mindset in Cloud Security with Alex Lawrence
Alex Lawrence, Field CISO at Sysdig, joins Corey on Screaming in the Cloud to discuss how he went from studying bioluminescence and mycology to working in tech, and his stance on why open source is the future of cloud security. Alex draws an interesting parallel between the creative culture at companies like Pixar and the iterative and collaborative culture of open-source software development, and explains why iteration speed is crucial in cloud security. Corey and Alex also discuss the pros and cons of having so many specialized tools that tackle specific functions in cloud security, and the different postures companies take towards their cloud security practices.
About Alex
Alex Lawrence is a Field CISO at Sysdig. Alex has an extensive history working in the datacenter as well as with the world of DevOps. Prior to moving into a solutions role, Alex spent a majority of his time working in the world of OSS on identity, authentication, user management and security. Alex's educational background has nothing to do with his day-to-day career; however, if you'd like to have a spirited conversation on bioluminescence or fungus, he'd be happy to oblige.
Links Referenced:
Sysdig: https://sysdig.com/
sysdig.com/opensource: https://sysdig.com/opensource
falco.org: https://falco.org
Exposing the Latest Cloud Threats with Anna Belak
Anna Belak, Director of The Office of Cybersecurity Strategy at Sysdig, joins Corey on Screaming in the Cloud to discuss the findings in this year’s newly-released Sysdig Global Cloud Threat Report. Anna explains the challenges that teams face in ensuring their cloud is truly secure, including quantity of data versus quality, automation, and more. Corey and Anna also discuss how much faster attacks are able to occur, and Anna gives practical insights into what can be done to make your cloud environment more secure.
About Anna
Anna has nearly ten years of experience researching and advising organizations on cloud adoption with a focus on security best practices. As a Gartner Analyst, Anna spent six years helping more than 500 enterprises with vulnerability management, security monitoring, and DevSecOps initiatives. Anna's research and talks have been used to transform organizations' IT strategies and her research agenda helped to shape markets. Anna is the Director of The Office of Cybersecurity Strategy at Sysdig, using her deep understanding of the security industry to help IT professionals succeed in their cloud-native journey.
Anna holds a PhD in Materials Engineering from the University of Michigan, where she developed computational methods to study solar cells and rechargeable batteries.
Links Referenced:
Sysdig: https://sysdig.com/
Sysdig Global Cloud Threat Report: https://www.sysdig.com/2023threatreport
duckbillgroup.com: https://duckbillgroup.com
Sysdig and Solving for Strategic Challenges in Cybersecurity with Michael Isbitski
Michael Isbitski, Director of Cybersecurity Strategy at Sysdig, joins Corey on Screaming in the Cloud to discuss the nuances of an effective cybersecurity strategy. Michael explains that many companies are caught between creating a strategy that’s truly secure and one that’s merely compliant and within the bounds of cost-effectiveness, and what can be done to help balance the two aims more effectively. Corey and Michael also explore what it means to hire for transferrable skills in the realm of cybersecurity and tech, and Michael reveals that while there’s no such thing as a silver-bullet solution for cybersecurity, Sysdig can help bridge many gaps in a company’s strategy.
About Michael
Mike has researched and advised on cybersecurity for over 5 years. He's versed in cloud security, container security, Kubernetes security, API security, security testing, mobile security, application protection, and secure continuous delivery. He's guided countless organizations globally in their security initiatives and supporting their business.
Prior to his research and advisory experience, Mike learned many hard lessons on the front lines of IT with over twenty years of practitioner and leadership experience focused on application security, vulnerability management, enterprise architecture, and systems engineering.
Links Referenced:
Sysdig: https://sysdig.com/
LinkedIn: https://www.linkedin.com/in/michael-isbitski/
Making Sense of Data with Harry Perks
About Harry
Harry has worked at Sysdig for over 6 years, helping organizations mature their journey to cloud native. He’s witnessed the evolution of bare metal, VMs, and finally Kubernetes establish itself as the de-facto for container orchestration. He is part of the product team building Sysdig’s troubleshooting and cost offering, helping customers increase their confidence operating and managing Kubernetes.
Previously, Harry ran, and later sold, a cloud hosting provider where he was working hands on with systems administration. He studied information security and lives in the UK.
Links Referenced:
Sysdig: https://sysdig.com/
Raising Awareness on Cloud-Native Threats with Michael Clark
About Michael
Michael is the Director of Threat Research at Sysdig, managing a team of experts tasked with discovering and defending against novel security threats. Michael has more than 20 years of industry experience in many different roles, including incident response, threat intelligence, offensive security research, and software development at companies like Rapid7, ThreatQuotient, and Mantech. Prior to joining Sysdig, Michael worked as a Gartner analyst, advising enterprise clients on security operations topics.
Links Referenced:
Sysdig: https://sysdig.com/
“2022 Sysdig Cloud-Native Threat Report”: https://sysdig.com/threatreport
Commanding the Council of the Lords of Thought with Anna Belak
About Anna
Anna has nearly ten years of experience researching and advising organizations on cloud adoption with a focus on security best practices. As a Gartner Analyst, Anna spent six years helping more than 500 enterprises with vulnerability management, security monitoring, and DevSecOps initiatives. Anna's research and talks have been used to transform organizations' IT strategies and her research agenda helped to shape markets. Anna is the Director of Thought Leadership at Sysdig, using her deep understanding of the security industry to help IT professionals succeed in their cloud-native journey.
Anna holds a PhD in Materials Engineering from the University of Michigan, where she developed computational methods to study solar cells and rechargeable batteries.
How do I adapt my security practices for the cloud-native world?
How do I select and deploy appropriate tools and processes to address business needs?
How do I make sense of new technology trends like threat deception, machine learning, and containers?
Links:
Sysdig: https://sysdig.com/
“2022 Cloud-Native Security and Usage Report”: https://sysdig.com/2022-cloud-native-security-and-usage-report/
Twitter: https://twitter.com/aabelak
LinkedIn: https://www.linkedin.com/in/aabelak/
Email: anna.belak@sysdig.com
Sysdig Cloud Native Security and Usage Report, with Anna Belak
Anna Belak learned about containers and security as a Gartner industry analyst. She is now the Director of Thought Leadership at Sysdig, who have just published their latest annual Cloud Native Security and Usage Report. Anna joins Craig to dicuss the report's findings.
Do you have something cool to share? Some questions? Let us know:
web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod
News of the week Chaos Mesh moves to Incubation in CNCF Episode 121, with Ed Huang
Google raises payouts for Kubernetes vulnerabilities 2021 VRP roundup
Sysdig teams up with Snyk, Snyk teams up with Sysdig
$25m investment in KubeCost Episode 124, with Webb Brown
Links from the interview Sysdig Cloud Native Security and Usage Report 2022
The last time we had a materials engineer on the show
Tricking a rock into thinking
Why Software is Eating The World
Can analysis be worthwhile? Is the theater really dead?
Industry analysts
Anna Belak at Gartner
Doge. Much wow
Sysdig $2.5 billion valuation
Beginnings
Source code
Episode 91, with Leonardo Di Donato
Tectonic Summit, 2015
Loris Degioanni
Episode 137, with Michael Gerstenhaber
Sysdig's changing reports: 2017
2018
2019
2020
2021
GKE Autopilot
Are we human, or are we dancer?
Anna Belak on Twitter
eBPF and Falco, with Leonardo Di Donato
We dive into the Linux kernel this week with guest Leonardo Di Donato, Open Source engineer at Sysdig. Leonardo works full-time on the Falco project, a runtime security engine that listens to the Linux kernel using eBPF - the extended Berkeley Packet Filter. Leonardo tells the hosts about the architecture of eBPF, how he has used it before and now, and what's coming up for Falco.
Do you have something cool to share? Some questions? Let us know:
web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod
Chatter of the week University Challenge: can you guess the computer?
Golf Peaks (Google Play, App Store) Desert Golfing
News of the week Apache Flink v1.10
Linkerd v2.7
Azure Container Registry to require TLS 1.2
CPU limits and aggressive throttling in Kubernetes - Omio Engineering by Fayiz Musthafa from Omio
Kiosk Reddit thread with Lukas Gentele
Docker donates the cnab-to-oci library to cnab.io
How-to Guide: Debugging a Kubernetes Application
Nutanix Karbon 2.0
Childcare and COVID-19 at KubeCon EU That discount code again again: KCEUGKP15
Red Hat OpenShift is now available for IBM Z and LinuxONE
Why Kubernetes on VMs? by Chip Zoller
Securely Access AWS Services from Google Kubernetes Engine (GKE)
Carbon Relay raises $63 million
Links from the interview Traditional Linux tracing tools: perf and strace
BPF and eBPF BPF paper by Steven McCanne and Van Jacobson
eBPF: Alexei Starovoitov added the 'e'
Express Data Path (XDP)
bpftrace
InfluxDB Cloud
kubectl-trace
The IO Visor project
Sysdig Loris Degioanni, co-founder, CTO, and author of Wireshark
Falco Sysdig and Falco now powered by eBPF
Falco joins CNCF Sandbox and moves to incubation
Upcoming KubeCon EU talks by Leonardo: Going beyond CI/CD with Prow
Designing a gRPC interface for kernel tracing with eBPF
Falco community: GitHub
Docs
Mailing list
Notes about community calls
Community call recordings
Slack
Leonardo Di Donato on Twitter