The 229 Podcast

A threat researcher at Sysdig was picking through the logs of a recent breach when something stopped him cold. The attacker moved too fast. No pauses, no fumbles, no fatigue. Over 600 payloads fired in sequence. When one failed, it read the error and adjusted. One time, from a failed login to a working fix in thirty-one seconds. No human does that.
Buried in the attacker's code were comments -- the kind a chatbot writes when it's reasoning through a problem. No person was at the keyboard. An AI agent had run the entire heist: reconnaissance, credential theft, lateral movement, persistence, and finally locking up 1,300 configurations before leaving a ransom note. Sysdig calls it Jade Puffer, and they believe it's the first ransomware attack ever run end-to-end by an AI.
The entry point was a vulnerable open-source AI tool sitting on the internet with cloud credentials right behind it. Health systems are bolting AI onto every workflow right now. Every one of those tools is a new door. The skill floor for running a full ransomware operation just dropped to the cost of an agent subscription. Drex has a few questions for your next leadership meeting.
Remember, Stay a Little Paranoid
X: This Week Health LinkedIn: This Week Health Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

July 10, 2026: Bill Reid, Healthcare and Life Sciences Lead in the Office of the CISO at Google, has spent his career working with health system security leaders, and he keeps running into the same blind spot: healthcare is underestimating the browser as an attack surface. Drex DeFord sits down with Bill to explore why the shift from thick client infrastructure to a secure, browser-first endpoint model is no longer theoretical. It is what resilient health systems are building. From managing transient clinical staff to simplifying a fractured endpoint environment, Bill makes the case for why the browser is the future of healthcare endpoint security.
Key Points:
01:21 Browser Attack Surface

03:39 Resilient Endpoint Posture

05:40 CISO-CIO Conversation

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

July 6, 2026: Bill Russell, Drex DeFord, and Sarah Richardson are back from four executive summits in Napa, covering CIOs, Chief Application Officers, Chief Analytics Officers, and CNIOs. The through-line across every room? AI pressure is intense, budget cuts are real, and a clear leadership vision is nearly impossible to find. From nurses being left out of decisions they should be driving, to analytics leaders managing a shadow IT explosion, to health systems already quietly building agents for referrals and claims, this is an unfiltered read on where health IT actually stands right now.

Key Points:
01:05 Napa Summit Themes
04:55 Nursing Wins and Workflow
07:22 IT Demand and AI Vision
13:20 Bright Spots and Agent Builds

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

Why the Browser Is Your Health System's Biggest Security Gap | Google Fridays with Andrew Rollo
July 3, 2026: Andrew Rollo, Sales Engineer at Google, has led browser deployments for organizations with 10,000-plus endpoints, with a dedicated focus on healthcare. Drex DeFord sits down with Andrew to unpack why the browser has become the most vulnerable and most overlooked tool in a health system's security stack. They cover how identity, update cadence, and extension governance define whether a deployment succeeds or fails, what a seamless day-one rollout looks like for clinical staff, and why blocking AI tools entirely is a losing strategy. Practical, specific, and built for CIOs who need answers, not theory.
Key Points:
01:54 Browser Security and Updates

05:25 Day One Success for Clinicians

07:23 CIO Checklist Identity EHR Network

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

Jul 2, 2026:
Sarah Richardson, Lisa Johnson, and Tamara Havenhill-Jacobs spent thirteen weeks completing an MIT AI strategy course on planes, evenings, and what Tamarah calls her "AI Sundays." What they brought back wasn't hype. It was clear. In this conversation with Sarah Richardson, recorded live from a 229 CIO Summit in Napa, the two leaders get honest about what actually changed: how one built the confidence to defend AI's role to her board through a theological lens, why "can AI fix that" is the wrong first question, and the real difficulty of proving ROI on work that doesn't show up as hard dollars. A candid look at what intentional AI adoption actually requires.
Key Points:
00:29 Podcast Welcome From Napa

01:09 MIT AI Course Takeaways

08:24 Intentional AI And Governance

15:47 Culture Shift And Safe Sandboxes

20:29 Future Of AI In Healthcare

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer