RedCircle VERIFY_TOKEN_6b7e1fac-3398-4e95-a7ae-6b771a6ea3e3 -- Rendered At Tue, 15 Sep 2026 13:46:39 +0000 Reflections: Web Security Podcast https://redcircle.com/shows/reflections-web-security-podcast en-US All rights reserved. Reflectiz Reflections: The Web Security Podcast is produced by Reflectiz, the world's leading AI-powered web exposure platform. Built by world renowned ethical hackers, Reflectiz continuously monitors everything executing on your live website - detecting the threats that firewalls, WAFs, and traditional scanners were never designed to see. Each episode, we sit down with security practitioners, CISOs, privacy officers, and compliance experts to examine the threats reshaping the modern web and what organizations can actually do about them. What We Cover: Magecart attacks, web skimming, and checkout page security Third-party script risk and unauthorised data exfiltration PCI DSS 4.0.1 compliance for merchants and payment providers GDPR, CCPA, and HIPAA enforcement at the client-side layer AI-generated web attacks and evolving supply-chain compromises Fourth-party risk and what lives beyond your engineering control Real breach post-mortems and actionable takeaways for security teams Who It's For: Reflections is essential listening for CISOs, AppSec engineers, privacy and compliance managers, and security-conscious leaders across financial services, e-commerce, healthcare, and the public sector. Subscribe, reflect, and stay ahead of the web threats your current stack can't see. Keywords: web security podcast, Reflections Reflectiz, client-side security podcast, Magecart podcast, third-party script risk, PCI DSS 4.0 compliance podcast, web supply chain security, CISO podcast, cybersecurity podcast, web exposure, application security, website security podcast 6b7e1fac-3398-4e95-a7ae-6b771a6ea3e3 Reflections: The Web Security Podcast is produced by Reflectiz, the world's leading AI-powered web exposure platform. Built by world renowned ethical hackers, Reflectiz continuously monitors everything executing on your live website - detecting the threats that firewalls, WAFs, and traditional scanners were never designed to see.

Each episode, we sit down with security practitioners, CISOs, privacy officers, and compliance experts to examine the threats reshaping the modern web and what organizations can actually do about them.

What We Cover:

  • Magecart attacks, web skimming, and checkout page security
  • Third-party script risk and unauthorised data exfiltration
  • PCI DSS 4.0.1 compliance for merchants and payment providers
  • GDPR, CCPA, and HIPAA enforcement at the client-side layer
  • AI-generated web attacks and evolving supply-chain compromises
  • Fourth-party risk and what lives beyond your engineering control
  • Real breach post-mortems and actionable takeaways for security teams


Who It's For:

Reflections is essential listening for CISOs, AppSec engineers, privacy and compliance managers, and security-conscious leaders across financial services, e-commerce, healthcare, and the public sector.

Subscribe, reflect, and stay ahead of the web threats your current stack can't see.

Keywords: web security podcast, Reflections Reflectiz, client-side security podcast, Magecart podcast, third-party script risk, PCI DSS 4.0 compliance podcast, web supply chain security, CISO podcast, cybersecurity podcast, web exposure, application security, website security podcast

]]> episodic no Reflectiz marketing@reflectiz.com false full PCI DSS 4.0: Who Really Owns Payment Security Risk? PCI DSS 4.0: Who Really Owns Payment Security Risk? 3 Reflectiz When a payment page breach happens, who is actually accountable: the merchant, the processor, the PSP, or the vendor whose script got compromised? This episode brings together security leaders from across the payment chain to answer that question. What's covered: Where PCI DSS 4.0 succeeds and where it leaves gaps in payment security accountability. How requirements 6.4.3 and 11.6.1 apply to real third-party script monitoring. Why client-side vulnerabilities create cardholder data exposure that server-side controls miss. How global retail, e-commerce, and payment processing teams are dividing payment security responsibility in practice. What compliance teams should do differently once checking the PCI box is not enough. Speakers: Una Dillon, Regional Director Europe, PCI Security Standards Council; Deepak Kumar, CISO, APEXX Global; Pete Chenery, Global Head of Cyber Security, Naked Wines; Mark Barry, Senior Security Operations Manager, Domino's Pizza; Leor Eliashiv, UK Regional Manager, Reflectiz. Key terms: PCI DSS 4.0, payment security, client-side security, cardholder data protection, third-party risk, Magecart, checkout page security. Explore Reflectiz's payment security resources and PCI compliance guides at reflectiz.com/demo. A good next step if you're mapping out where your own payment risk ownership breaks down. When a payment page breach happens, who is actually accountable: the merchant, the processor, the PSP, or the vendor whose script got compromised? This episode brings together security leaders from across the payment chain to answer that question.


What's covered:

Where PCI DSS 4.0 succeeds and where it leaves gaps in payment security accountability.

How requirements 6.4.3 and 11.6.1 apply to real third-party script monitoring.

Why client-side vulnerabilities create cardholder data exposure that server-side controls miss.

How global retail, e-commerce, and payment processing teams are dividing payment security responsibility in practice.

What compliance teams should do differently once checking the PCI box is not enough.


Speakers: Una Dillon, Regional Director Europe, PCI Security Standards Council; Deepak Kumar, CISO, APEXX Global; Pete Chenery, Global Head of Cyber Security, Naked Wines; Mark Barry, Senior Security Operations Manager, Domino's Pizza; Leor Eliashiv, UK Regional Manager, Reflectiz.


Key terms: PCI DSS 4.0, payment security, client-side security, cardholder data protection, third-party risk, Magecart, checkout page security.


Explore Reflectiz's payment security resources and PCI compliance guides at reflectiz.com/demo. A good next step if you're mapping out where your own payment risk ownership breaks down.

]]> <p>When a payment page breach happens, who is actually accountable: the merchant, the processor, the PSP, or the vendor whose script got compromised? This episode brings together security leaders from across the payment chain to answer that question.</p><p><br></p><p>What&#39;s covered:</p><p>Where PCI DSS 4.0 succeeds and where it leaves gaps in payment security accountability.</p><p>How requirements 6.4.3 and 11.6.1 apply to real third-party script monitoring.</p><p>Why client-side vulnerabilities create cardholder data exposure that server-side controls miss.</p><p>How global retail, e-commerce, and payment processing teams are dividing payment security responsibility in practice.</p><p>What compliance teams should do differently once checking the PCI box is not enough.</p><p><br></p><p>Speakers: Una Dillon, Regional Director Europe, PCI Security Standards Council; Deepak Kumar, CISO, APEXX Global; Pete Chenery, Global Head of Cyber Security, Naked Wines; Mark Barry, Senior Security Operations Manager, Domino&#39;s Pizza; Leor Eliashiv, UK Regional Manager, Reflectiz.</p><p><br></p><p>Key terms: PCI DSS 4.0, payment security, client-side security, cardholder data protection, third-party risk, Magecart, checkout page security.</p><p><br></p><p>Explore Reflectiz&#39;s payment security resources and PCI compliance guides at reflectiz.com/demo. A good next step if you&#39;re mapping out where your own payment risk ownership breaks down.</p> 50a49896-1b61-4cd5-8b3d-9b57acd799bf https://www.reflectiz.com/learning-hub/live-panel-discussion-2026/ Thu, 23 Jul 2026 12:03:00 +0000 3138 false full Magecart Detection: Can AI Code Review Tools Catch It? Magecart Detection: Can AI Code Review Tools Catch It? Reflectiz Can AI-powered code security tools like Claude Code Security catch a live Magecart attack? This episode puts that question to the test using a real-world Magecart campaign that compromised a payment processing system.


What's covered:

Why static code analysis tools miss client-side threats that exploit runtime behavior in third-party scripts.

What Claude Code Security and similar AI code review tools can and cannot detect.

How a real Magecart campaign evaded development-time security checks.

Why payment page protection needs runtime visibility that static analysis cannot provide.

How to combine static analysis and runtime monitoring in a defense-in-depth strategy.


Speakers: Elan Hershcovitz, VP R&D, Reflectiz.


Key terms: Magecart, client-side security, runtime monitoring, static code analysis, third-party script risk, web supply chain security, payment page protection.


Download the CISO guide referenced in this episode at reflectiz.com/learning-hub/claude-code-security-guide. A useful companion if you're evaluating where AI code review fits in your security stack.

]]> <p>Can AI-powered code security tools like Claude Code Security catch a live Magecart attack? This episode puts that question to the test using a real-world Magecart campaign that compromised a payment processing system.</p><p><br></p><p>What&#39;s covered:</p><p>Why static code analysis tools miss client-side threats that exploit runtime behavior in third-party scripts.</p><p>What Claude Code Security and similar AI code review tools can and cannot detect.</p><p>How a real Magecart campaign evaded development-time security checks.</p><p>Why payment page protection needs runtime visibility that static analysis cannot provide.</p><p>How to combine static analysis and runtime monitoring in a defense-in-depth strategy.</p><p><br></p><p>Speakers: Elan Hershcovitz, VP R&amp;D, Reflectiz.</p><p><br></p><p>Key terms: Magecart, client-side security, runtime monitoring, static code analysis, third-party script risk, web supply chain security, payment page protection.</p><p><br></p><p>Download the CISO guide referenced in this episode at reflectiz.com/learning-hub/claude-code-security-guide. A useful companion if you&#39;re evaluating where AI code review fits in your security stack.</p> 07cca2e8-6c73-4d87-8b71-479496848ddd https://www.reflectiz.com/ Thu, 23 Jul 2026 12:02:23 +0000 1536 false full AI Supply Chain Attacks: The New Threat to Retail Security AI Supply Chain Attacks: The New Threat to Retail Security Reflectiz Retailers are rolling out AI agents for procurement, inventory forecasting, and customer service, but few security teams have asked what happens when those agents get manipulated. This episode breaks down how attackers are already exploiting AI supply chains in retail.


What's covered:

How prompt injection lets attackers manipulate procurement AI systems without touching your codebase.

Why rogue suppliers can manipulate inventory forecasts through AI-driven procurement tools.

How attackers hijack trusted supplier identities to coordinate cartel-style attacks.

What it means when AI agents sit on payment pages and are trusted by default.

Practical steps for retail security teams to evaluate whether their AI systems are actually ready for this threat.


Speakers: Simon Arazi, VP Product, Reflectiz.


Key terms: client-side security, AI supply chain risk, third-party script risk, agentic AI security, payment page security, retail cybersecurity.


Watch the full webinar recording and explore Reflectiz's approach to AI-era retail security at reflectiz.com/demo. Worth a look if your team is rolling out AI procurement or forecasting tools without a clear security review process.

]]> <p>Retailers are rolling out AI agents for procurement, inventory forecasting, and customer service, but few security teams have asked what happens when those agents get manipulated. This episode breaks down how attackers are already exploiting AI supply chains in retail.</p><p><br></p><p>What&#39;s covered:</p><p>How prompt injection lets attackers manipulate procurement AI systems without touching your codebase.</p><p>Why rogue suppliers can manipulate inventory forecasts through AI-driven procurement tools.</p><p>How attackers hijack trusted supplier identities to coordinate cartel-style attacks.</p><p>What it means when AI agents sit on payment pages and are trusted by default.</p><p>Practical steps for retail security teams to evaluate whether their AI systems are actually ready for this threat.</p><p><br></p><p>Speakers: Simon Arazi, VP Product, Reflectiz.</p><p><br></p><p>Key terms: client-side security, AI supply chain risk, third-party script risk, agentic AI security, payment page security, retail cybersecurity.</p><p><br></p><p>Watch the full webinar recording and explore Reflectiz&#39;s approach to AI-era retail security at reflectiz.com/demo. Worth a look if your team is rolling out AI procurement or forecasting tools without a clear security review process.</p> 443102e6-e800-475f-b600-8b3e1751cc8c https://www.reflectiz.com/ Thu, 23 Jul 2026 12:01:53 +0000 1386 false