Your organisation has 143 security tools and still doesn’t know what to fix first. Sound familiar?
In this episode, host Jeroen Prinse sits down with Anuj Kumar, co-founder and CEO of Gambit Cyber. Anuj spent over 12 years in threat intelligence at iSight, FireEye, Mandiant, and Intel 471, and kept running into the same problem: the intelligence was good, but nobody could operationalize it. That gap is what Gambit Cyber was built to close.
They dig into Continuous Threat Exposure Management (CTEM), why it’s a program and not a tool, what AI-native really means in security and the uncomfortable question of who is accountable when an autonomous system gets it wrong.
In this episode:
- Why 12 years in threat intel led Anuj to found Gambit Cyber
- What intelligence actually means and why most teams can’t act on it
- CTEM as a program vs. a product: why the distinction matters
- How Gambit Cyber maps business risk to attack paths and prioritizes what to fix
- Difference between bolting AI onto existing workflows vs. building AI-native from day one
- Why Gambit Cyber lets customers choose their own LLM
- Who is accountable when an autonomous security system gets it wrong?
Timestamps:
- 00:00 Opening hook: intelligence without action
- 00:43 Welcome and introduction to Anuj Kumar and Gambit Cyber
- 00:55 12 years in threat intel: what the industry kept getting wrong
- 02:54 What intelligence actually means
- 05:14 CTEM: program vs. product
- 07:36 Why tool sprawl created the CTEM category
- 10:45 How Gambit Cyber runs a gap analysis and builds a security program
- 13:54 Mapping business context to attack paths
- 16:36 Infrastructure intelligence and prioritization at scale
- 17:19 Business email compromise as a live example
- 18:37 Can CTEM actually prove it reduces breaches? (Gartner’s 3x claim)
- 20:15 What evidence should a CISO demand?
- 21:40 How validation works inside the platform
- 24:09 What AI can do that conventional automation cannot
- 26:58 Directed graph vs. goal-oriented AI agents
- 30:35 How to tell if a platform is truly AI-native
- 33:00 Why Gambit Cyber doesn’t bet on one LLM
- 35:43 When do we start delegating security judgment to AI?
- 38:00 Who is accountable when autonomous security gets it wrong?
- 41:14 Final question: what should listeners do differently tomorrow?
- 43:25 Signal message to all CISOs
- 44:07 Book recommendation: The AI-Driven Leader
Connect with the guest:
Anuj Kumar: https://www.linkedin.com/in/anuj-kumar-77b7909/
Website: https://gambitcyber.org/
Follow Cyber Security District:
Laurens Jagt on LinkedIn:https://www.linkedin.com/in/laurensjagt/
Jeroen Prinse on LinkedIn:https://www.linkedin.com/in/jprinse/
Website:https://www.cybersecuritydistrict.com/
All channels & newsletter:https://beacons.ai/cybersecuritydistrict
