Theme · Updated
What podcasters are saying about Cybersecurity
Summary
In the past 30 days, 39 speakers on 25 finance podcasts discussed Cybersecurity in 65 views. Chorus has followed Cybersecurity since October 2, 2026.
Who talks about it most
- Nikesh Arora · 8
- Alex Stamos · 6
- Thai Duong · 5
- George Kurtz · 5
- Jim Cramer · 4
- Bruce Dang · 2
- Sam Altman · 2
- Greg Brockman · 2
- Rob Sechan · 1
- Ev Randle · 1
The latest views
Newest first. Every quote is checked against the episode's transcript.
Thai Duong · Calif
The window between a vulnerability's disclosure and its exploitation is collapsing across all operating systems and software.
Previously attackers had to wait for a patch to be released and then needed a long time to develop an exploit, which gave users time to upgrade. Duong argues that AI is collapsing that window. Attackers, including companies watching PHP, Python, Java and critical software from Microsoft and Apple, now have AI agents that burn tokens to identify a new vulnerability, reproduce it and exploit it quickly. He says the collapse applies to Windows, Mac OS and anything else, not just PHP.
“Now that window is collapsing. ... It is collapsing everywhere, not just in PHP. Right? In Windows, in Mac OS, in anything.”at 39:28
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Thai Duong · Calif
Security products promised as simple fixes do not make enterprises safe, because the products themselves have flaws.
Duong says that enterprise security is very complicated, and that vendors who sell a single magic box to be installed on the network are misleading customers. He cites the security principle that product security is not the same as security product: even the firewalls people buy may have vulnerabilities, and they do. He argues that the fix is not a simple purchase.
“Vendors go out and tell people, just buy this box, this magic box and put it in your network and you'll be safe. No, it's not like that. Even that box has problems.”at 41:56
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Bruce Dang · Calif
AI has made Dang's reverse-engineering textbook obsolete, since one prompt now generates equivalent material.
Dang co-wrote a textbook on reverse engineering, a practice that used to require long manual work to understand binary software without source code. About nine months ago AI reached the point where one or two prompts could generate a comparable textbook, which he says is even better than the one his team spent a long time writing. He backs this with specialist friends who report that a few dollars of open-source model usage can reverse-engineer printer firmware, work that previously took months.
“With the advent of AI... nine months ago, that entire book is deprecating. Takes two prompts or one prompt and then bam, it would generate the textbook for you and it's even better.”at 44:57
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Bruce Dang · Calif
AI has cut the time to build a full iPhone exploit chain from a multi-person effort to a few days for one person.
Building a full exploit chain for an iPhone is hard and has often taken several people. Dang says his team built one within a few days as a single person, and that they have multiple such chains. He concludes that the time to build exploits is being compressed sharply.
“To build a full chain on the iPhone, it's not an easy task. Sometimes it takes several people to do this. ... our team was able to do this within a few days.”at 46:25
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Thai Duong · Calif
AI-driven intrusions now spread through bank networks in days rather than the month manual attackers needed.
Duong's firm was called in by two banking clients who had been hacked about two weeks earlier. Previously, once his team got into a network, it took about a month to spread through it. In this AI-assisted intrusion, the attackers got inside on Monday and were everywhere by Tuesday. He describes the spread as happening at machine speed, which he presents as evidence that AI has compressed attack timelines for enterprises.
“For the AI, it took... They came in. They brought inside the network on Monday. By Tuesday, they're everywhere.”at 48:20
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Thai Duong · Calif
Detection alone cannot keep up with AI attacks, so defensive architectures for banks must be redesigned.
Duong's past advice to clients was to invest in detection. That fails when the network is compromised by many attackers at once: detecting one hacker is not useful when there are a hundred, and banks cannot simply shut everything down. He concludes that the approach needs to be rethought from the ground up, and says that what organisations have right now is not working very well.
“If you see it, you can detect it, but there's a 100 of them. ... What we have right now is not working very well.”at 48:42
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Thai Duong · Calif
The strongest hackers now combine AI and human experts, but the human role may not last long.
Duong draws an analogy to chess and Go, where the best player was a human-computer combination for about ten years after Deep Blue and about three years after AlphaGo. He says the best hacker today is a combination of AI and humans. AI can hack anything, but it still needs a human expert. He is unsure how long that will last, from three months to three years. Once the human role disappears, he expects AI to do everything.
“Basically, the best hacker right now is a combination of AI and humans. ... AI is powerful. It can hack anything, but it still require human expert to arrive at.”at 50:39
Odd Lots: PHP2Shell Won't Be the Last Big AI Cybersecurity Risk ·
Jim Cramer · CNBC
Cybersecurity demand is not slowing; Fortinet's weak quarter is company-specific, not a sector signal.
Cramer notes that enterprises are prioritizing cybersecurity spending above most other IT priorities because AI models keep uncovering new vulnerabilities. He concedes Fortinet's slowing growth looks like a warning, but argues the broader market is misreading it as a sector-wide slowdown. He says the sell-off also hit CrowdStrike and Palo Alto, which he thinks is unjustified because their businesses are much stronger.
“Enterprise customers are scrambling to keep up prioritizing cybersecurity spending over most other IT priorities. [...] Fortinet's weakness is not a tell about a slowdown in cybersecurity.”at 44:18
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/29/26 ·
Rob Sechan · NewEdge Wealth
Cybersecurity selloff is a one-off, not a rewrite, since security is not losing priority in the AI ecosystem.
Asked whether the reaction is the all-clear to short cyber, Sechen says he believes it is a one-off, not a full rewriting of the sector. Security cannot take a back seat to anything given what is happening in the AI ecosystem. But a rising tide does not lift every boat, so investors need to be selective. He says the software and cyber names should not be treated equally, and he is focused on specific names.
“I believe it is a one off. I don't believe that this is a full rewriting of the...”at 32:20
CNBC Halftime Report: Tech Earnings Weigh on the AI Trade 10/29/26 ·
Jack Altman · Benchmark
AI-driven cyber risk is imminent, so it is a good time to be a security company.
Jack says cyber risk is the most imminently expressed AI risk. Recent CEO conversations described pointing frontier models at their own systems and finding them breakable. He notes that attacking from inside has advantages an outside attacker lacks, since insiders have the data and code base. Still, he argues this is a good time for security companies and a scary first real exposure. He expects enterprises, governments and hospitals to move faster than the old 36-month software cycles, though not within three months. He hopes that in about twelve months people can do a lot.
“obviously, it's probably a good time to be a security company.”at 41:58
Uncapped with Jack Altman: Benchmark Breakfast #1 | Jack and Ev ·
Ev Randle · Benchmark
AI-enabled attacks now reach personal devices and critical systems; hardware can't be patched easily.
Ev says companies with strong engineering teams are finding company-ending vulnerabilities day after day when probed with AI. Cyberattacks used to mean a leaked password. Now AI makes them creepy and intrusive. He cites a researcher who used Claude to disable a webcam's recording light and access the microphone, and a French supermarket whose refrigeration controls were manipulated. Systems that were thought secure, such as decades-old open-source code, firmware and hardware, are now exposed. Software can be patched, but hardware largely can't, so smart devices may need to be disconnected. He says hardening will take a long time, possibly the biggest code modernization project in history, which is why the threat feels real now.
“you can patch the software, but can't really patch the hardware.”at 43:32
Uncapped with Jack Altman: Benchmark Breakfast #1 | Jack and Ev ·
Jason Lemkin · SaaStr
AI makes hacking near-instant; unpatched old sites and laid-off IT teams mean attacks worsen for a year or two.
Since the models got good, anyone can be hacked in seconds and attempts are accelerating. The PHP vulnerability is worse than it looks: PHP is still roughly 40% of the internet, much of it old sites that will never be patched. Government and nonprofit sites took their sites down, and IT teams were laid off years ago. He expects a year or two of worsening exposure as every threat vector is exposed almost in real time, with ransomware professionalizing. The only limit he sees is that few can pay large ransoms and few systems control dams or other natural resources, so hacking may decline for a while.
“Now anyone can be hacked in seconds. People attempt to hack faster every day. So everyone's going to get hacked.”at 35:11
20VC: 20VC: Anthropic Files S1 Ahead of $2TRN IPO | Instinct's Rumoured $30 Billion Fundraise | Microsoft Laysoff 27,000 While Meta Taps Equity Markets for $95 Billion Capex Spending Spree ·
Brett Winton · ARK Invest
AI-driven vulnerability discovery and patching will make the internet safer and generate tech revenue.
Brett cites a PHP vulnerability found by frontier-lab models that was leaked and then patched in a worldwide scramble. PHP runs a large share of websites, and the flaw had existed for years. He sees frontier models' ability to find bugs before attackers as good for the internet and the labs. He expects this to make the internet safer over time and to generate revenue for the tech sector fixing problems. Attacks that intentionally break things are within the normal range, as long as they are not rogue agents.
“This is something that both should happen, will make us safer over time, will generate lots of revenue into the tech space to fix all of the problems”at 4:20
ARK Invest (FYI podcast, In the Know video): Anthropic’s S-1, Meta’s $90B, And Elon’s Warning Call | The Brainstorm 155 ·
Sam Altman · OpenAI
Companies should urgently map the AI-driven security threat; AI systems are finding alarming numbers of vulnerabilities.
Altman says that if he could recommend just one thing to a company now for AI, in the very short term, it would be to understand the security threat landscape from AI and mitigate it. He says he is shocked by how many vulnerabilities AI systems are finding. He thinks getting ahead of this will take a herculean effort. He adds that fixing bugs one by one across the entire supply chain may be too difficult, so new approaches to cyber defense are needed.
“If I could recommend, like, only one thing to a company right now to do with AI in the very short term... it would be to really understand the security threat landscape from AI and mitigate against that. I find myself shocked at just how many vulnerabilities these AI systems are finding.”at 3:25
Squawk Pod (CNBC Squawk Box): California’s Billionaire Tax & Global Hot Spots 10/28/26 ·
Ethan Mollick · Wharton School, University of Pennsylvania
AI-driven cyber threats are definitely coming, even though feared negative impacts have been fewer so far.
Mollick says he has predicted more negative impacts from AI than have happened so far. Data leakage and deepfakes have been less severe than expected, and people with AI tools have not yet caused a major incident inside companies. He still expects cyber threats to arrive, and he says so directly. He does not give a specific mechanism or timeline in this passage.
“I think I predicted more negative impacts than we've had, which doesn't mean they're not coming, by way. I think cyber definitely is coming.”at 48:36
Big Technology Podcast: This AI Expert Argues We're Underestimating AI's Productivity Impact — With Ethan Mollick ·
Jim Cramer · CNBC
Frontier AI models make software vulnerabilities easier to find and exploit, so cyber defense is harder.
Cramer argues protecting against cyber attacks has become harder this year because frontier AI models are very good at finding and, more importantly, exploiting software vulnerabilities. He cites the PHP case, where security researchers used AI to identify a flaw in the programming language's code, leading to a scramble to patch systems. He says the risk concerns him and he wants to highlight it, and he links the threat to the need for identity-focused security firms such as Okta.
“The challenge of protecting against cyber attacks get increasingly difficult this year because Frontier AI models have proven to be quite good at identifying and, more importantly, exploiting vulnerabilities of software.”at 31:43
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/27/26 ·
Todd McKinnon · Okta
AI cyber models drove a vulnerability and patch wave; basic defenses still protect most firms.
McKinnon explains the current cyber wave as two changes. First, about six months ago, frontier AI models from Anthropic and OpenAI released cyber models that helped identify vulnerabilities in software, and those vulnerabilities are now being disclosed, creating a rush of patches. Second, the AI tools for exploiting vulnerabilities, such as probing networks and chaining attacks, are much more powerful, and the same models or open-source equivalents can use them. What has not changed is that most people are still hacked in basic ways. Companies with phishing-resistant multifactor authentication and timely patching can still be protected.
“about six months ago, the big AI models, Anthropic and OpenAI released their cyber models that helped software companies and open source projects identify vulnerabilities”at 33:17
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/27/26 ·
Sam Altman · OpenAI
Companies should first understand and mitigate the security threats that AI creates; this is the top priority.
Altman says that if he could recommend only one thing to a company right now to do with AI in the very short term, it would be to understand the security threat landscape from AI and mitigate against it. He puts this ahead of becoming more productive with AI coding tools like Codex, saying security is a huge risk companies need to take seriously.
“If I could recommend, like, only one thing to a company right now to do with AI in the very short term, It... Even more than, like, become super productive with Codex, it would be to really understand the security threat landscape from AI.”at 12:16
CNBC Fast Money: All Clear For Markets?... And What To Expect Out Of Fed Rate Decision Tomorrow 10/27/26 ·
Michael Landsberg · Landsberg Bennett Private Wealth Management
He prefers cybersecurity over AI, since smarter AI means cybersecurity needs to be better.
Landsberg is a big cybersecurity investor and would rather own cybersecurity than all of AI. His reasoning is that the smarter AI gets, the more cybersecurity has to improve to defend against it. CrowdStrike is one of his firm's biggest positions.
“I'm a big cybersecurity guy, and I'd rather own cybersecurity than I would all AI because the smarter AI gets, the better cybersecurity has to be.”at 28:01
CNBC Power Lunch: Energy Secretary Interview, Low-Beta Stock Picks, Nucor CEO Exclusive 10/27/26 ·
Joe Terranova · Virtus Investment Partners
Cybersecurity stocks have been remarkably strong and the rally is broad across large and smaller names.
Terranova says cybersecurity has been remarkably powerful and the strength is broad. He cites well-known names like CrowdStrike and Palo Alto, and lesser-known companies with strong balance sheets like Fortinet. He also flags Okta as a takeover candidate, though he gives no support for that call.
“Cyber has been remarkably powerful, and I think it's broad based. It is companies that are well known like your CrowdStrike, your Palo Alto. It's lesser known companies with great balance sheets like Fortinet.”at 39:35
CNBC Halftime Report: The AI Correction, Tech Earnings and the Rally 10/27/26 ·
Paul Hsiao · UBS Chief Investment Office, Global Wealth Management
Cybersecurity is underpriced given AI-enabled attacks on large institutions and the need for defenses.
Over the summer, concerns emerged that models from OpenAI and Google's Gemini could exploit vulnerabilities at large institutions. Paul argues that this security risk is underpriced in the market. He points to two questions for 2027: whether a more robust federal AI framework will address security, and whether cybersecurity companies can design defenses that other companies can use to mitigate AI-driven exposure.
“I think the underpriced in the market really is security... I think over the summer, we've heard some concerns that OpenAI and Gemini, we've had some of these models being able to take advantage of some vulnerabilities in some large institutions.”at 8:52
UBS On-Air: Top of the Morning: The AI Economy 4Q26 update - Part 1 ·
Larry McDonald · The Bear Traps Report
Cybersecurity stocks are running hot but Larry plans to build a basket and buy on dips.
If quantum computing threatens Bitcoin's cryptography, companies solving that problem become the area to play. Cybersecurity stocks are currently crazy high, but Larry plans to build a basket of them and buy on dips.
“Are you looking at anybody who's solving... That's an area. And now the cybersecurity stocks are all, you know, crazy right now. But, yeah, on the dips, absolutely. We gotta create a basket of those.”at 46:50
Wealthion: Larry McDonald: S&P 500 Could Crash 30% Over the Next Year ·
Jim Cramer · CNBC
AI-driven exploitation of the PHP flaw looks far worse than expected and is not encouraging.
Cramer cites Cloudflare's Matthew Prince on attacks against the PHP vulnerability. Exploit attempts rose from thousands in the ten hours before public disclosure to tens of thousands in 45 minutes after, to hundreds of thousands within two hours, and to millions by the time Cramer spoke. He says frontier AI models are a new, unprecedented cyber risk because they can find vulnerabilities that were previously almost impossible for hackers to identify. He says this moment is not encouraging.
“He says in the ten hours before it was publicly announced... we saw thousands of attempts to exploit it. That jumped to tens of thousands in the forty five minutes post announcement... millions now... George, that's not encouraging.”at 30:19
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/26/26 ·
George Kurtz · CrowdStrike
Leading banks are well defended and vigilant; smaller financial firms are the vulnerable ones.
Kurtz says CrowdStrike protects 16 of the top 20 banks in the world, and that these banks take security very seriously. They have great teams, can address vulnerabilities and patch them, and are spending heavily on security. He says the have-nots are smaller companies that lack expertise and money to find all their vulnerable systems. Those are the systems he would worry about, but he is very confident in the financial services industry.
“we protect, I think, 16 of the top 20 banks in the world, They take security very seriously. They've got great teams. They're very thoughtful about it.”at 31:59
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/26/26 ·
George Kurtz · CrowdStrike
Patch fatigue and unupgradeable legacy systems will sustain a long tail of attacks after the PHP vulnerabilities.
Kurtz says the current wave is the result of AI tools for finding and weaponizing vulnerabilities, which started months ago with Mythos. The speed and scale of attacks make it a bad case. Over 10 critical vulnerabilities landed this month. Industry can now find flaws and create patches quickly, but companies lack the time and operational resources to deploy them, which he calls patch fatigue and says worries him. Home routers and firewalls will never be upgraded, so a long tail of attacks will hit enterprises, SMBs and consumers.
“there's more than 10 critical vulnerabilities that sort of just landed. And it's this patch fatigue, which has me worried... The problem is they just don't have enough time or operational resources to get them rolled out.”at 34:49
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/26/26 ·
George Kurtz · CrowdStrike
Attacks exploiting PHP vulnerabilities will hit enterprises, SMBs and consumers in a long tail; threat is worse than expected.
Kurtz argues that adversaries are exploiting PHP vulnerabilities, and he expects a long tail of attacks spanning enterprise, SMB and consumer targets. He says the situation is much worse than he had thought. He gives no quantified data, and his tie to CrowdStrike is not stated in this exchange.
“So there's going to be a long tail of attacks across both enterprise as well as SMB and consumers where the adversary is taking advantage of these PHP vulnerabilities.”at 36:35
Mad Money with Jim Cramer: Mad Money w/ Jim Cramer 10/26/26 ·
George Kurtz · CrowdStrike
Agentic cyberattacks are rising exponentially, letting low-skill actors match nation-state attacks.
Kurtz cites CrowdStrike research showing an exponential increase in agentic attacks. He says the old pyramid of pain, with nation-states at the top and hacktivists at the base, has collapsed into an 'agent state'. Low-skill actors can use off-the-shelf AI skills, and nation-state actors split tasks across an ensemble of models so no single model sees the goal, with an executor agent assembling the results. Open-weight models with guardrails removed serve as that executor, and they may be less capable than frontier models but are good enough. The attacks are cheap, costing a few dollars, so the bottom of the pyramid, with the most actors, can now run sophisticated operations.
“it is an exponential increase in what we're seeing with agentic attacks.”at 13:36
The Compound and Friends: How CrowdStrike Could Double ARR by 2030 with George Kurtz ·
George Kurtz · CrowdStrike
AI agents given broad privileges and unchecked internet downloads create a serious supply-chain threat.
Kurtz says concentration in software providers and open-source tools creates supply-chain risk. Coding agents such as Claude Code fetch open-source packages from the internet, and attackers have compromised those packages, so agents running them execute the malicious code. He says the security model of not running untrusted code and focusing on identity has been reversed: companies give agents privileged identity, let them download anything, and do not check it. He says this undoes thirty years of security controls and requires a different level of technology to keep it safe. Josh Brown adds that a single compromised source can expose hundreds of databases through shared architecture.
“we're going give agents incredible identity in terms of its privilege. And then we're going to allow it to download anything from the Internet and we're not going to check it.”at 19:52
The Compound and Friends: How CrowdStrike Could Double ARR by 2030 with George Kurtz ·
Josh Brown · Ritholtz Wealth Management
Cybersecurity has been one of the only guaranteed bull markets on earth for about six years.
Brown says he has described cybersecurity as a guaranteed bull market for most of the last six years. He frames the sector's demand as structurally secure, so the only open question has been which company to own. He supports the view mainly by pointing to CrowdStrike's strong performance, which is a historical result rather than an argument about future demand.
“for most of the last six years, I've been referring to cybersecurity as one of the only guaranteed bull markets on earth.”at 37:54
The Compound and Friends: How CrowdStrike Could Double ARR by 2030 with George Kurtz ·
Ted Mortonson · Baird
Agentic AI security has not kept pace with adoption, a near-term inhibitor to enterprise rollout.
Agentic or agent AI is such new technology that security has not kept up with where the market is going. He calls that a near-term inhibitor to adoption. He expects security to be a big part of the cycle and a driver of M&A, with small security point solutions becoming parts of larger companies with free cash flow.
“Security is going to be a big part of it... the security has not kept up with where the market's going. That's a near term inhibitor.”at 22:14
Excess Returns: Baird's Tech Strategist Says This Isn't 2000. So Why Is He Warning Against Buying the Dip? ·
35 older views on Cybersecurity are on the episode pages, and all of them are a question away in your AI with Chorus.
Ask your AI about Cybersecurity
Chorus gives Claude, ChatGPT and other assistants every view on Cybersecurity from the market's podcasts. Ask who's worried, who isn't, who changed their mind, and why.
Chorus reports what speakers said. It isn't investment advice.