Fortinet Cybersecurity Podcast · Fortinet Cybersecurity Podcast

Brass Tacks S1E03 - Exploring Software Supply Chain Security: Debunking GenAI and LLMs Hype

·22 min·1 clip

Ricardo Ferreira says generative AI will be transformational but is not the “silver bullet” many organizations expect.

1. Fortinet Cybersecurity Podcast's Brass Tacks S1E03 examines software supply-chain security and the security implications of generative AI and LLMs. 2. Joe Robertson hosts Ricardo Ferreira, Fortinet's European field CISO, whose work with executives and technical teams informs the discussion of organizational cyber risk. 3. The episode asks whether generative AI's business value justifies adoption while software and data supply-chain risks remain difficult to track. 4. Ricardo Ferreira cites SolarWinds in 2021 as a software-supply-chain event with repercussions beyond a single victim. 5. Ferreira describes a later open-source attack in which an account was created in 2021 and trust was built over several years. 6. The attackers reportedly exploited a single-maintainer project after the maintainer disclosed health issues. 7. Ferreira says hidden code could trigger during software assembly and expose SSH, which he estimates is used by 80 to 90 percent of devices. 8. Joe Robertson and Ferreira compare open-source components to Lego blocks and contaminated flour entering a bread supply chain. 9. Ferreira identifies remote code execution as the offensive-security objective that can compromise a device without user interaction. 10. The AI discussion names DORA, NIST regulations, Europe's AI Act, OpenAI, Google Gemini, Bloomberg GDP, and Fortinet's FortiAI. 11. Ferreira divides generative-AI risk into availability, integrity, and privacy. 12. He says data poisoning can alter a model's outputs and denial-of-service techniques can consume resources or increase costs. 13. Ferreira states that privacy attacks can extract data that should not be exposed from models. 14. He recommends DevSecOps, MLOps, and LLM Ops frameworks with security underpinning development and operations. 15. Ferreira calls data lineage a key control because it records how data flows, changes, and is altered by whom. 16. He defines red teaming as internal security testing that attacks systems before external attackers do. 17. Joe Robertson and Ricardo Ferreira use a structured interview format with technical terms translated through business and everyday analogies. 18. The exchange remains educational and pragmatic, moving from SolarWinds and open-source attacks to generative-AI governance and controls. 19. Fortinet executives and security leaders evaluating generative-AI projects. 20. Listeners seeking entertainment without cybersecurity or technology detail.

As heard by us

A sober look at supply chain risk, with GenAI kept away from the hype.

This episode keeps supply chain security at the center and treats generative AI as part of that problem, not a shiny side note. It works best when it ties third-party risk, regulation, and data quality to the decisions boards and security leaders have to make now.

Read the full review in PlayNext →

Why you'd press play

You want a straight answer on GenAI hype and third-party software risk.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Fortinet Cybersecurity Podcast