The Alldus Podcast - AI in Action

The episode contains a handful of genuinely useful practitioner framings - the kill-chain minimisation argument, the silent-failure risk of AI, and the 'must be excellent at basics' imperative - but a substantial portion of the runtime is spent explaining foundational cybersecurity concepts (phishing, zero-days, patching) at a near-introductory level, diluting overall density.

“before we had to be good at the basics now we must be excellent at the basics”

“AI fails differently than normal IT. If the online website stops working, you can't log in. It's obvious. But what happens if the AI fails by slowly making poor decisions? That doesn't get noticed.”

The 'key person risk' analogy for AI resilience and the observation that silent AI degradation is harder to detect than obvious IT outages are genuinely fresh framings; however, the broader narrative (arms race, defence-in-depth, patch faster) recycles widely-circulated security talking points without adding a distinctive new lens.

“we should think of AI the same way as we think of a key person risk”

“we won't need junior developers we'll only need senior ones but what happens when the senior ones hopefully grow old and retire how how do we get new senior developers”

Simon Collins is a genuine practitioner - DORA programme lead, expert forensic witness, and Head of Security & Resilience at a major global asset manager - giving him real operational credibility; the episode would score higher if he had revealed more scale-specific or uniquely hard-won insights rather than spending significant time on conceptual explainers.

“I led our dora efforts for three years”

“I've had that twice in my last eight years. It's very rare. I suspect that's going to happen a lot more.”

A few concrete numbers land well (55-day mean patch time, 15-20 day target, the Middle East flight-routing agent anecdote), but many claims float at abstraction - the '30 to 600 times more productive' range is enormous and goes unexplained, and named vendors, CVEs, or budget figures are absent throughout.

“the average I read the other day was 55 days is the mean time to patch for vulnerabilities. That needs to be down to closer to 15 or 20.”

“i regularly talk to people who are software developers who are 30 to 600 times more productive”

The host's questions are almost entirely open-ended scene-setters ('is this a new threat landscape,' 'what can be done about this') with no meaningful push-back; the implausibly wide '30 - 600x productivity' claim and the vague 'three and a half areas' structure both pass without a single probing follow-up, leaving the conversation as a largely uninterrupted monologue.

“is this a new threat landscape is this something we've seen before is it just fancy marketing”

“what can be done about this and is this like one cleanup exercise where you clean it up you're done or is this kind of going to be ongoing”