Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. The focus is on operational reality, decision making under pressure, and the controls that truly reduce risk in production environments.

Episodes

  1. 4 HR AGO

    KEV-First Patch Ops: Defending the Exposed Control Plane

    In this brand new episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, Alex and Sarah tackle why traditional monthly patching cycles are failing modern enterprises. Prompted by actively exploited edge vulnerabilities, they argue for a radical shift toward a KEV-first operations strategy. This episode covers how to prioritize external exploitation signals over CVSS scores, enforce emergency change windows for internet-facing services, and apply rapid compensating controls to maintain NIS2 compliance when patches cannot be immediately deployed.

    38 min

  2. 2 DAYS AGO

    The Illusion of MFA: AiTM Phishing and Session Token Theft

    Welcome to a new episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons. If your security dashboard shows complete MFA adoption, you might still be compromised. Sarah and Alex break down the mechanics of Adversary-in-the-Middle (AiTM) attacks targeting the banking and insurance sectors. Discover why attackers are bypassing traditional authentication to steal session tokens, and learn the architectural pivots required—from implementing cryptographic session binding to meeting DORA's strict incident response and revocation mandates.

    33 min

  3. 4 DAYS AGO

    Automotive Extortion Goes Upstream: Protecting the New Vehicle Perimeter

    In this new episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, hosts Sarah and Alex dissect the structural shift in automotive cyber threats. Moving past the outdated CAN bus hacking narrative, they explore how extortion crews are now targeting cloud services, APIs, and CI/CD pipelines to hold fleets hostage. Listen in for a rigorous breakdown of how to secure the update chain with HSM-backed keys, and how to leverage ISO/SAE 21434 and UNECE R155/156 to enforce safety-grade supply chain defense.

    40 min

  4. 6 DAYS AGO

    Invisible Conduits: The Control Plane Siege

    This episode dissects the strategic shift toward control plane exploitation, using the recent Cisco SD-WAN bypass (CVE-2026-20127) to illustrate how attackers are rewriting network segmentation in real-time. We analyze the fallout of the Odido leak and why "availability" has become the primary risk factor for industrial and automotive supply chains. We wrap up with a "Tier 0" roadmap for hardening the remote access and maintenance paths that often exist outside your formal security models.

    34 min

  5. 27 FEB

    Hostile Time: When the Clock Lies in Critical OT

    We are back with another episode of Cybersecurity Under Pressure. Real Attacks, Real Lessons, diving into one of the most insidious vectors in operational technology: hostile time. At 06:05, a rail control room gets a burst of alarms, but the chronological sequence is physically impossible. The interlocking system reports an input changing after the command that supposedly triggered it. Time synchronization is a physical operational dependency, not a forensic luxury. Today, we unpack the physics of attacks that introduce asymmetric network delays to silently shift clocks. Join us as we discuss establishing hard drift limits that trigger deterministic safe modes, and how to protect safety-relevant sequences using causality and Byzantine fault-tolerant state machines.

    46 min

  6. 25 FEB

    The 18:45 Reflash: When Usability Friction Becomes a Threat

    In this new chapter of Cybersecurity Under Pressure. Real Attacks, Real Lessons, we tackle the dangerous intersection of operational friction and systems engineering. A dealership laptop starts a DoIP reflash at 18:45. The authentication portal lags, the technician forces a shared session to stay alive, and suddenly the trust chain is compromised by a manual workaround. This episode challenges the "IT vs. Workshop" divide, arguing that latency, token refresh rates, and bay throughput are strict security requirements. We discuss how to architect revocation as a safety-critical OT function using transactional flows and A/B partitions, and dive into formally verifying the backend-to-bootloader handshake as a robust state machine.

    23 min

  7. 23 FEB

    The Friday Night Patch & The Illusion of Segmentation

    Welcome to a new episode of Cybersecurity Under Pressure. Real Attacks, Real Lessons. It is Friday at 22:30, and a rail depot applies a minor network change to fix a flaky engineering link. By Monday morning, everything looks functional, but the security boundary has silently drifted. In this chapter, we break down why probabilistic defense and manual audits fundamentally fail in OT environments. We explore how to treat IEC 62443 zones and conduits as mathematical invariants, leveraging intent-based network verification to compute actual data plane behavior from configurations. Tune in to learn how to continuously attest your running state against a signed baseline and definitively prove your segmentation.

    29 min

  8. 21 FEB

    Weekly Roundup: State Machine Breakdown & Engineering the Degraded Mode

    Welcome to a new weekly roundup episode of Cybersecurity Under Pressure. Real Attacks, Real Lessons. This week, we examine a cascade of high-impact events across multiple critical sectors: a massive DDoS wave knocking Deutsche Bahn’s passenger systems offline, ransomware forcing the University of Mississippi Medical Center to revert to manual workflows, a major data breach of France's FICOBA bank account registry, and a ransomware strike on the semiconductor supply chain at Advantest. While the attack vectors differ, the operational failure mode shares a common thread. In this chapter, we analyze an uncomfortable truth: when core services degrade, operators stop following verified workflows and invent new ones under pressure. We discuss how this human response fundamentally bypasses your defined state machine, introducing untestable variables like shared logins and undocumented remote access paths. Finally, we explore how to leverage IEC 62443 zones and conduits alongside NIS2 accountability mandates to engineer degraded modes exactly like safety functions. Tune in to learn how to design pre-approved fallbacks, time-bounded break-glass procedures, and resilient logging that survives when everything else is on fire.

    41 min

  9. 20 FEB

    Engineer the Path, Not Just the Perimeter

    A vendor fixes an alarm at 4 PM. At midnight, that same remote tunnel is used to push an unsafe setpoint. Different intent, identical path. How does your network know the difference? Spoiler: It doesn't. This is the synthesis. We connect the dots from the previous episodes, the Oldsmar attack and the break-glass dilemma, to deliver a final verdict: You cannot patch your way to safety. You have to design it. We explore how to move from abstract frameworks like IEC 62443 to a concrete "abuse-resistant" architecture. Tune in to learn why the most critical firewall in your plant isn't a device, it’s a design philosophy.

    33 min

  10. 18 FEB

    02:00 AM Panic: Does "Break-Glass" Mean "Break-Security"?

    The packaging line stalls at 01:40 AM. Scrap is rising. The IAM server is down. Do you wait for IT to wake up, or do you reach for the "emergency" admin password kept in a drawer? That split-second decision is where security dies. In this episode, we tackle the uncomfortable friction between production pressure and cybersecurity. We explain why "temporary" bypasses often become permanent backdoors and how to engineer a "Break-Glass" protocol that saves the plant without handing the keys to an attacker. The question is: Do your emergency paths reduce risk, or quietly store it?

    28 min

  11. 16 FEB

    When Maintenance Becomes the Weapon: The Oldsmar Incident

    February 2021. An operator in Florida watches his cursor move across the screen on its own. It wasn’t a glitch; it was an active attempt to poison the water supply by changing sodium hydroxide levels. But here is the terrifying part: The attackers didn’t use a zero-day exploit. They used the plant’s own maintenance tools. In this episode, we dissect the Oldsmar incident to uncover a harsh reality: in OT, your "authorized" engineering path is often the attacker’s favorite backdoor. We break down how legitimate tools—like TeamViewer and shared credentials—get weaponized, and how to stop hoping for the best by designing for abuse using IEC 62443. Listen to find out: Could you prove who changed a setpoint within one hour?

    29 min
  12. When the Hypervisor Becomes the Attack Surface: The OT Signal Behind CVE-2025-22225

    7 FEB

    When the Hypervisor Becomes the Attack Surface: The OT Signal Behind CVE-2025-22225

    Picture a control room where HMIs work, but historians freeze and jump servers vanish. Nothing “OT” was hacked, but the digital floor beneath them just crumbled. This article analyzes why CVE-2025-22225 in VMware ESXi is not just another IT vulnerability, but a systemic risk to industrial safety. We explore the mechanics of the “Guest-to-Host” escape, why the hypervisor must now be treated with the same rigor as a PLC, and the recoverability engineering actions—beyond patching—you need to take in the next 72 hours to secure your operational substrate.

    32 min
  • 12 Episodes

About

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. The focus is on operational reality, decision making under pressure, and the controls that truly reduce risk in production environments.

Information