Exploited: The Cyber Truth

The episode contains solid working knowledge about autonomous vehicle security and compliance frameworks (ISO 21434, shift-left approaches, SAST/DAST, SBOM), but relies heavily on established industry concepts rather than novel claims. Most insights are competent restatements of existing best practices; few moments surprise or challenge a knowledgeable operator. The discussion of AI-accelerated attacks and defenses is surface-level, and concrete technical details are sparse.

“Computers on wheels, right. That's what autonomous vehicles and connected vehicles are. And I think the modern vehicle that contains hundreds of millions of lines of code, dozens of electronic, uh, control units, high speed networks, cloud connectivity.”

“compliance alone doesn't equal security. A lot of these frameworks are establishing a common language and what I would say, minimum expectations.”

The episode recycles standard industry frameworks and terminology (shift-left, secure-by-design, RASP, SBOM, SOC 2, ISO 27001) without fresh angles or contrarian perspectives. The flag football analogy about generational adoption of autonomous vehicles is conversational but not conceptually novel. The discussion of memory safety and Rust trade-offs touches on real tensions but doesn't develop original thinking.

“There's a reason there is SaaS solutions and dynamic application security testing software. Application security testing being done in real time on the compute.”

“shift left approach. Start security when you start development.”

Haymonth Tadapalli is a Senior Cybersecurity and Compliance Manager at May Mobility, a practitioner with direct operational responsibility in autonomous vehicle security - solid domain credibility. Joe Saunders is CEO/founder of RunSafe Security, giving him product and strategy perspective. Both have legitimate skin in the game, though neither is presented as having scaled multi-billion-dollar security operations or made market-defining decisions at the largest OEMs or infrastructure operators.

“Haymonth Tadapalli, who is senior cybersecurity and compliance Manager at at May Mobility”

“Joe Saunders, CEO and founder of Run Safe Security”

The episode is notably light on concrete evidence: no named breach case studies, no specific CVE examples, no quantified financial or operational metrics, and no client examples beyond vague references to 'attacks skyrocketing.' The Gabriel Gonzalez MQTT server anecdote is mentioned but not detailed. Most claims remain at the framework or principle level without supporting numbers, timelines, or named instances.

“We had Gabriel Gonzalez on the podcast. He's a well known hardware hacker. He said in a recent Red Team exercise that he was involved in, they didn't need to attack the vehicle at all. They found a bug in an MQTT server”

“the vulnerability discovery and the rewriting of code is only a portion of it. It might be 15, 20% of the overall economic cost to change.”

Paul Dudlin's hosting is competent but rarely pushes back or demands specifics. Most questions are open-ended invitations to explain established concepts rather than sharp probes. There are few follow-ups that challenge guest claims or drill into contradictions. The conversation flows pleasantly but misses opportunities to extract unique detail or surface genuine disagreement. The analogy about parking on driveways is acknowledged as tangential rather than redirected.

“So without further ado, hey Month, why don't you kick us off by talking a little bit about the difference between today's autonomous or even self driving vehicles and vehicles of the past.”

“That's a great question, Paul. No pressure, right? No pressure.”