S7, E276 - Ransomware Doesn't Have to Hit Like a Hurricane (with Jonathan Sander) — Privacy Please

Jonathan Sander is back on Privacy Please — and he's brought two blog posts worth arguing about.

Sander (42 Notions, now in an operational role at Myota) joins Cam and Gabe to dig into why ransomware resilience should work like New York City's storm surge infrastructure — building something that pays off before disaster strikes, not just a wall you wait behind. Then the conversation turns to AI agents: why Sander tried and failed to build a clean taxonomy for them, the six dimensions he landed on instead (authority, execution location, trigger, persistence, delegation, tool reach), and why the "hybrid agent" — switching between acting on your behalf and acting with power you never had — might be the hardest identity problem in security right now.

Also covered: why "back to basics" (secrets, resilience, identity) is Sander's answer for teams panicking about AI, and a real story about an AI agent that deleted a Postgres database and just... apologized.

Articles referenced:

Ransomware Doesn't Have to Hit Like a Hurricane (Myota): https://www.myota.io/articles/ransomware-doesnt-have-to-hit-like-a-hurricane
Why We Need an AI Agent Taxonomy Right Now But We Can't Have One (42 Notions): https://blog.42notions.com/why-we-need-an-ai-agent-taxonomy-right-now-but-we-cant-have-one/

Chapters:

00:00 – Catch-up with Sander
14:30 – The hurricane analogy: why Myota built resilience instead of a wall
20:30 – What actually makes Myota different from standard backup/cyberstorage
22:15 – Why you can't build a clean AI agent taxonomy (and the six dimensions Sander landed on instead)
28:50 – The hybrid agent problem: acting "on behalf of" vs. "for the benefit of"
45:10 – Sander's one takeaway: get the basics right before chasing the AI hype

Support the show