S7, E276 - Ransomware Doesn't Have to Hit Like a Hurricane (with Jonathan Sander)

Send us Fan Mail

Jonathan Sander is back on Privacy Please — and he's brought two blog posts worth arguing about.

Sander (42 Notions, now in an operational role at Myota) joins Cam and Gabe to dig into why ransomware resilience should work like New York City's storm surge infrastructure — building something that pays off before disaster strikes, not just a wall you wait behind. Then the conversation turns to AI agents: why Sander tried and failed to build a clean taxonomy for them, the six dimensions he landed on instead (authority, execution location, trigger, persistence, delegation, tool reach), and why the "hybrid agent" — switching between acting on your behalf and acting with power you never had — might be the hardest identity problem in security right now.

Also covered: why "back to basics" (secrets, resilience, identity) is Sander's answer for teams panicking about AI, and a real story about an AI agent that deleted a Postgres database and just... apologized.

Articles referenced:

• Ransomware Doesn't Have to Hit Like a Hurricane (Myota): https://www.myota.io/articles/ransomware-doesnt-have-to-hit-like-a-hurricane
• Why We Need an AI Agent Taxonomy Right Now But We Can't Have One (42 Notions): https://blog.42notions.com/why-we-need-an-ai-agent-taxonomy-right-now-but-we-cant-have-one/

Chapters:

• 00:00 – Catch-up with Sander
• 14:30 – The hurricane analogy: why Myota built resilience instead of a wall
• 20:30 – What actually makes Myota different from standard backup/cyberstorage
• 22:15 – Why you can't build a clean AI agent taxonomy (and the six dimensions Sander landed on instead)
• 28:50 – The hybrid agent problem: acting "on behalf of" vs. "for the benefit of"
• 45:10 – Sander's one takeaway: get the basics right before chasing the AI hype

Support the show