TENEX Signal • Episode 1
Host: Tyler Moffitt
Guest: Sam Moss
Automation percentages don’t tell the whole story. What matters is what AI can do, when a human needs to step in, and who decides. In the first episode of TENEX.AI Signal Podcast, Tyler Moffitt and Sam Moss, TENEX.AI’s first employee, explore those boundaries and share three questions every CISO should ask their security team or MDR provider.
0:00–2:00 | Welcome and introductions
TYLER:
“Welcome to the very first episode of the TENEX Signal podcast. I’m your host, Tyler Moffitt. I’ve spent over 15 years in cybersecurity, researching malware, and how attackers operate. On this show, we’ll explore the threats, ideas, and decisions shaping cybersecurity, with practical insights you can take back to your team. ”
“Today, we’re talking about AI in the SOC: what it should be allowed to do, when a person needs to step in, and who makes that call.”
“I’m joined by Sam Moss, Founding Member and VP of Global Forward Deployed Engineering. But before we get into it, tell us a little about you, Sam, give us three things about yourself and what you do at TENEX.”
SAM | Suggested talking points:
A brief introduction in your own words: your role, the work you focus on, and what brought you to TENEX. Aim for 30–45 seconds.
TYLER | After the introduction:
“First episode, first employee. That feels like the right place to start. Glad to have you here.”
2:00–3:00 | 1. What are buyers getting wrong?
TYLER:
“When you hear security vendors talk about how much of their SOC is automated, what do you wish buyers would ask next?”
SAM | Suggested talking points:
Why the percentage alone can hide what is being automated. The distinction between gathering evidence and taking action. Your own view on what buyers should pay more attention to.
Tenex Differentiator: Did the right task get automated in the right way? Workflows? ML? Agents? Did they automate a documented process or the thinking and disposition? Why was it important? Give time back? Save money? Who QAs this?
TYLER | Optional follow-ups:
“What does an automation percentage leave out?”
“Do you have any strong opinions about this that other people in security might disagree with?”
3:00–6:00 | 2. Where should the line sit?
TYLER:
“Where do you draw the line between work an AI agent can handle and a decision an actual person needs to make?”
SAM | Suggested talking points:
How business impact and reversibility shape the decision. How that changes across customer environments. Who agrees to the permissions and responsibilities before deployment.
TYLER | Optional follow-ups:
“Expand on blast radius and reversibility. What do those mean in a real security decision?”
“Would you set that line differently for a hospital, a bank, and a software company?”
“Who should agree to those boundaries before anything goes live?”
6:00–10:00 | 3. Walk through one incident
TYLER | Transition:
“Let’s put that into a situation listeners can picture.”
TYLER:
“It’s two in the morning when your SOC flags a phishing campaign. Several employees have already clicked, and the same email is sitting in other inboxes. Walk me through what you’d want AI to handle immediately, and then where a human needs to make a call.”
SAM | Suggested talking points:
Is it bad. Pass or fail the typical checks? Headers, links, replyto, etc. If so, who received this exact version and are there any other variants? For the ones that clicked, what happened afterwards? I want context. Who are the users, what do they do, what can they access. What actions can we take and can we close the loop? As you can see this is time consuming and in this instance, there is real risk so time is important.
Walk through the evidence you would gather, the actions you would consider, and where approval matters. Explain how a critical account or system changes the decision. Distinguish an illustrative workflow from current TENEX capabilities.
TYLER | Optional follow-ups:
“What evidence would you want before taking action?”
“What changes if one of those accounts can access a critical production system?”
“If the person who needs to approve the response isn’t available at that hour, what should already be agreed?”
“How do you avoid replacing an investigation backlog with an approval backlog?”
10:00–13:00 | 4. How do you control the agent itself?
TYLER | Transition:
“We’ve talked about the decisions. What about the identity making them?”
TYLER:
“One of your other blogs frames an AI agent as a privileged account. What changes when we start treating it that way?”
SAM | Suggested talking points:
Permissions appropriate to the job, visibility into actions, and the ability to stop an agent. How you would limit the impact of misleading inputs or an incorrect decision. Reinforced learning is key.
TYLER | Optional follow-ups:
“What should an agent never have access to by default?”
“If someone feeds it misleading information, what limits the damage it can do?”
“Who can stop it, and what record should exist of what it did?”
13:00–16:00 | 5. What makes this a different way of operating?
TYLER:
“You described this as transformation rather than modernization. What actually has to change beyond adding AI to the tools a team already uses?”
SAM | Suggested talking points:
Modernization is just going from a legacy tech to a modern tech. The key word here is tech. Transformation is about outcomes. It’s about leveraging our expert people in newer, better ways, technology to accelerate and for multiply, and process to connect the two.
What changes in the way people work, make decisions, and take responsibility. Where forward deployed engineering helps adapt the approach to a customer. Your perspective on what teams can handle themselves and where support adds value.
TYLER | Optional follow-ups:
“What stays hard even when the technology gets faster?”
“Where does forward deployed engineering make a practical difference?”
“What should a capable internal security team build itself, and when does outside help make sense?”
16:00–19:00 | 6. What should listeners ask next?
TYLER:
“If a CISO takes three questions from this conversation to their security team or MDR provider tomorrow, what should those questions be?”
SAM | Suggested talking points:
Choose your three most useful questions. Your blog offers a starting point: authority to act, access to the audit trail, and ownership of the boundaries. Explain what a useful answer would actually contain.
TYLER | Prompts if useful:
“What can the AI do without asking a person?”
“Can we see what it actually did?”
“Who sets those boundaries, and when do we revisit them?”
TYLER | Optional follow-up:
“What would a convincing answer look like, and what answer would make you want to double click into it and push harder?”
19:00–20:00 | Takeaway and close
TYLER:
“So as we bring this to a close- What’s one thing you would want a security leader to check this week?”
SAM | Suggested talking points:
Cheeky but our TENEX Signal newsletter.
Seriously though, non-human identity.
One practical action the listener can take. Keep this brief and specific.
TYLER | Closing:
“Thanks for helping us kick this off, Sam - It was great to have you on.
SAM: Thanks for having me on
And thanks to everyone listening to our first TENEX Signal podcast.
“For more security news and the stories we didn’t get to, check out the TENEX Signal newsletter from the TENEX SOC team. You’ll find the newsletter and related reading in the episode notes. As always please follow, like, and subscribe to the show, and we’ll see you next time.”
