The EACG Podcast
Dialogues, discussions, and interviews on digital products, regulation, and product security — straight from our consulting practice.
RSS feed ↗"The Release I Can Sign"
Nora Voss has signed off releases on thin evidence for years. Marcus and Tess look at an agent that does the unglamorous compliance work completely, hands back everything that needs a human, and turns delegation into a deliberate, written decision.
Episode 11"The Workshop That Always Happens"
Threat modeling is the homework that slips to next quarter. Marcus and Tess look at what changes when it simply happens every time, built from the real inventory, the real findings and the real deployment, with the judgment staying exactly where it belongs.
Episode 10"Now It's Yours"
Nora Voss needs her vulnerability platform inside the plant network, where no SaaS can reach. Marcus and Tess ask the honest question: is it fine to run it yourself? Yes, if you do it properly. If you can't, handing it to a professional is the better choice.
Episode 9"Compliant vs. Secure"
A company passes its SOC 2 renewal with zero findings and throws a small celebration. Ten weeks later they're breached through exactly the control the audit just certified. Marcus and Tess ask what a compliance snapshot can actually promise, and what it can't.
Episode 8"The 9.8 That Was Never About You"
A 9.8 CVSS score triggers a weekend fire drill for a vulnerability nobody can actually reach in this deployment, while a modest 5.3 sitting wide open gets ignored. Marcus and Tess ask why the only score anyone quotes was never computed about them.
Episode 7"It Just Sounded Urgent"
Priya is back with a problem that's evolved past what episode five described: the reports flooding her inbox aren't from people chasing a bounty anymore, and nobody can tell her who's responsible for what they say.
Episode 6"You Just... Swapped It?"
Tess brings something she didn't see coming: one of Marcus's clients swapped out their entire encryption scheme, cleanly, in a week, after she flagged a weakness. For once she's not the one with the answers.
Episode 5"It's Not My Code"
Priya Raman — sole, unpaid maintainer of a small library load-bearing for half the internet — confronts Marcus's incident response and Tess's attacker's-eye view with what happens when nobody can see three suppliers deep.
Episode 4"That's Not a Zero-Day"
Marcus and Tess build, from opposite sides of the fence, toward the same conclusion: that "zero-day" has become a word people reach for to manufacture urgency, not to report a fact — and that the antidote was never a sharper alarm, but the boring work done long before one goes off.
Episode 3"The Fix Is Available"
A conversation in which Nora — a product manager for connected industrial devices, and an EACG client — confronts Marcus's disclosure process and Tess's attacker's-eye view with the gap between publishing a fix and a fleet actually running it.
Episode 2"Likelihood Times Impact"
A dialectic conversation between Marcus and Tess on whether a risk matrix's likelihood-times-impact score means anything — and what's left once you stop trusting the arithmetic but still need the conversation it was standing in for.
Episode 1Local or Network? On the Temptation of a Simple Split
A dialectic conversation between Marcus and Tess on whether known vulnerabilities should be divided into those exploitable over the network and those exploitable only locally — and what such a division would do to the people who have to act on it.
Get notified by email
Never miss a new episode — we'll email you as soon as one drops.
- Reply within one business day
- No spam, we promise
- GDPR compliant
Thank you!
We'll reply within one business day.