MCP Security at Wiz with Rami McCarthy

Wiz is a cloud security platform that helps organizations identify and remediate risks across their cloud environments. The company's platform scans layers of the cloud stack, including virtual machines, containers, and serverless configurations to detect vulnerabilities and misconfigurations in context. The model context protocol or MCP is emerging as a potential standard for connecting LLM applications to external data sources and tools. It has rapidly gained traction across the industry with broad backing from companies such as OpenAI, Microsoft, and Google. While the protocol offers great opportunities, it also introduces certain security risks. Rami McCarthy is a principal security researcher at Wiz. He joins the podcast with Gregor Vann to talk about security research, AI and secrets leakage, MCP security, supply chain attacks, career advice, and more. Gregor Vand is a CTO and founder currently working at the intersection of communication, security, and AI and is based in Singapore. His latest venture, wintik.ai, reimagines what email can be in the AI era. For more on Gregor, find him at van.hk or on LinkedIn. Hello. Welcome to Software Engineering Daily. My guest today is Rami McCarthy from Wiz. So hi, Rami. Thanks for coming on. Thanks for having me. Excited to be here. Yeah. Very excited to have to have you here. And as I sort of just mentioned, you're here on effectively behalf of Wiz. We you joined fairly recently, but you definitely have quite a illustrious past in the security world, a lot of research that I'm sure a lot of our audience will be familiar with whether sort of directly or indirectly. So I think it'd be kind of just fun if you could just pretty much take us through kind of your kind of journey from whether it's, you know, high school or college through to through to where you are at the moment. Awesome. Yeah. You mentioned I joined Wiz recently, and I really feel like that is a logical culmination of a lot of what I've done in my career. I studied security in in university. Academically, I feel like I came up at a really good time where those programs were starting to pop up in The US. Specifically, the NSA was funding a lot of universities to have really good cybersecurity programs. And I stumbled my way into security consulting and pen testing, which gave me the chance to see hundreds of different security programs and also sort of sparked this pattern of research that has pulled forward into now being in a purely research role. In fact, at NCC group, where I was a consultant, Clint Gibler, who does TLDR sec was one of the research directors and was frankly, the person who got me going down this route and is someone I've had, you know, the joy to work with consistently since. After consulting, I moved in house to a small health tech where I got to help build a security program, sort of from not day zero, but from day …