Threat Talks - Your Gateway to Cybersecurity Insights

Threat Talks
  • 5.0 (1)
  • Tech News
  • Updated Weekly

Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!

  1. 3d ago

    JADEPUFFER: The AI Malware With No Human in the loop

    What if AI stopped being the assistant to cybercriminals and became the attacker itself? That's no longer hypothetical. JADEPUFFER is the first documented case of ransomware run entirely by an AI agent: it broke into a production database, hit a wall mid-attack, then found another way in within 31 seconds, faster than most human penetration testers can react. Rob Maas, Field CTO at ON2IT, sits down with Yuri Wit, SOC DevOps Engineer at ON2IT, to trace how agentic malware evolved out of AI-assisted attacks into a threat that plans, executes, and pivots entirely on its own. 🔗 Episode resources, transcript and show notes: https://threat-talks.com 📝 Read the companion blog post: 🎙️ Subscribe on Spotify and Apple Podcasts, links below. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. #ThreatTalks #ZeroTrust #firewallsecurity  #NetworkSecurity #CyberSecurity #infosec  Charpters: 00:00:00 Cold open: can AI become the attacker?00:01:42 PromptLock and PromptSteal: proof of concept to real world00:04:24 The agentic malware trend and the local LLM question00:07:24 JADEPUFFER: ransomware run entirely by an AI agent00:09:58 Proof of concept, or a live-fire test?00:11:30 Intent-driven attacks and shrinking detection windows00:16:34 Zero Trust: what to do about it starting now 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

    JADEPUFFER: The AI Malware With No Human in the loop

  2. Jul 21

    Four Firewall Mistakes Still Wrecking Networks in 2026

    Three out of four firewall rule sets ON2IT’s SOC inherits from new customers share the same blind spots, and none of the fixes cost extra licensing. In this episode, Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Jelle Konings, security optimization specialist in ON2IT’s Security Operations Center, to walk through the mistakes his team finds on almost every inherited network: no logging enabled, no identity tied to traffic, no default deny rule at the bottom of the rule base, and port-based rules standing in for real application control. Most environments he inherits sit around 30 to 40 percent application-based policy coverage against a 60 to 80 percent target. You will hear what to check first when you inherit a firewall, how long a realistic clean-up takes (weeks, months, sometimes over a year), and why an encrypted VPN tunnel riding on port 443 can move data out the door without a single alert firing. 🔗 Episode resources, transcript and show notes: https://threat-talks.com 📝 Read the companion blog post: https://threat-talks.com/blog/four-firewall-mistakes-still-wrecking-networks-in-2026/🎙️ Subscribe on Spotify and Apple Podcasts, links below. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. #ThreatTalks #ZeroTrust #FirewallSecurity #NetworkSecurity #CyberSecurity #InfoSec Chapters:  00:00 Cold open: the top firewall mistakes of 202500:21 Meet Jelle Konings, security optimization specialist01:16 Mistake 1: No visibility into your network03:36 Mistake 2: Skipping User-ID mapping06:01 Mistake 3: No default deny rule07:44 Fixing it: from logs to default deny09:09 Bonus mistake: port-based vs. application-based rules13:20 Will 2026 be any different?

    Four Firewall Mistakes Still Wrecking Networks in 2026

  3. Jul 14

    Would Your Boss Read Your Prompts? Private AI, Explained

    Would you still use ChatGPT if your boss, or the AI provider, could read every single prompt you typed in? Most of us type something we would never share publicly into an AI tool every day. In this Threat Talks Deep Dive, Field CTO Rob Maas sits down with ON2IT senior developer Derk Bell to unpack the privacy problem hiding inside everyday AI use, and a genuinely clever way to solve it. The problem is bigger than a single prompt. An AI request carries far more context than a Google search: your conversation history, your files, and (with agents and MCP) automatic, autonomous access to your CRM, your email, your calendar and your codebase. A lot of that data is shipped off to a remote provider, often without you realizing it. Today we just trust those providers not to misuse it. As Derk points out, “trust us” is the exact opposite of Zero Trust: never trust, always verify. So how do you verify? Derk walks through Confer, the privacy-first AI service from Signal Protocol co-creator Moxie Marlinspike. Using the analogy of a tamper-proof, locked calculator box for an “anonymous” employee survey, he explains how Confer lets you actually check the wiring: a hardware Trusted Execution Environment that isolates and encrypts the running program, remote attestation that lets you verify the exact open-source code handling your prompt, a Signal-style encrypted channel to talk to it, and hardware-bound keys that are thrown away the moment your session ends, so even the operator can never read your data. We close on who needs this most (developers protecting trade secrets, executives working on M&A or strategy, and anyone bound by GDPR) and whether the big AI labs will adopt this the way the whole industry adopted Signal. The takeaway: privacy and powerful AI do not have to be a trade-off. “Trust us” was never a security strategy. 🔗 Episode resources, transcript and show notes: https://threat-talks.com📊 Grab the infographic referenced in the episode in the show notes to follow the technical steps. 🎙️ Subscribe to the podcast on Spotify, Apple Podcasts, or your podcast app of choice. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. Chapters:00:00 Would you still use ChatGPT if your boss read every prompt?01:00 Why AI is different from a Google search: context02:08 "Trust us" and why that is the opposite of Zero Trust03:22 It gets worse: AI agents, MCP and autonomous access05:52 Enter Moxie Marlinspike, Signal, and Confer06:30 The analogy: an "anonymous" employee survey in a locked box10:16 Inside Confer: the TEE, attestation and the encrypted channel14:21 End the session, throw away the keys16:08 Who needs this? Developers, executives, GDPR-bound teams18:29 Wrap-up: privacy and powerful AI can coexist

    Would Your Boss Read Your Prompts? Private AI, Explained

  4. Jul 7

    Framework Fatigue: Why NIST Rebuilt the Cybersecurity Framework

    Ten years after its first release, the NIST Cybersecurity Framework got a full rebuild. Not because it failed, but because everyone started using it, and it was never built for everyone. In this episode, host Lieuwe Jan Koning talks with Amy Mahn, IT Standards Advisor at NIST, and Daniel Eliot, Lead for Small Business Engagement at NIST’s Applied Cybersecurity Division, about what CSF 2.0 actually changes and why it took a multi-year public process to get there. The original framework was written with critical infrastructure operators in mind. A decade later, hospitals, school districts, and small businesses were all using it too, often without the staff or budget the framework quietly assumed they had. NIST collected more than 4,000 comments from organizations across over 100 countries to find out what was missing. The result includes a new Govern function that puts cybersecurity risk decisions in front of leadership and the board, a deliberately technology agnostic and vendor agnostic design that keeps the framework useful no matter which tools an organization runs, a Quick Start Guide aimed at organizations without a dedicated security team, and a sharper focus on supply chain risk. Amy and Daniel also explain why “vendor agnostic” is a feature, not a gap: it’s what lets an organization decide for itself who or what is best suited to close a given risk, instead of a framework quietly picking winners. Part 2, “CSF 2.0: Beyond the Framework,” continues the conversation and covers implementation in practice. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. New episode every Tuesday. Follow Threat Talks to stay up to date on the topic of cybersecurity. Chapters:00:00 Framework fatigue, the problem NIST heard01:12 Welcome to Threat Talks02:05 Meet Amy Mahn and Daniel Eliot (NIST)03:40 What the original CSF got right, and where it broke down07:15 Four thousand comments, one framework10:30 The new Govern function14:05 Why CSF 2.0 is technology agnostic and vendor agnostic17:20 The Quick Start Guide for teams without a security team20:10 Supply chain risk gets its own seat at the table22:45 What Part 2 will cover24:48 Closing thoughts

    Framework Fatigue: Why NIST Rebuilt the Cybersecurity Framework

  5. Jun 30

    Why Do You Trust Your AI Agent?

    Agentic AI is powerful, and someone recently found that out the hard way when an AI tool, given free rein with a user’s own permissions, deleted her entire mailbox. That cautionary tale opens this Threat Talks Deep Dive, where host Lieuwe Jan Koning talks with Rob Maas, Field CTO of ON2IT, about what Zero Trust looks like when the thing you’re securing is an AI agent. Drawing on Rob’s recent blog post (and the Zero Trust pillars shared by CISA and Forrester’s Zero Trust eXtended framework), they work through each pillar in turn. The recurring theme is “just-in-case” privileges: the broad access we hand humans on the assumption they’ll use judgment. Agents have no such judgment. Give one an intent and it will use everything it has to reach the goal, and it can spin up parallel instances to get there faster. Across Identity, Devices, Network, Applications & Workloads, and Data, Rob makes the case for: Non-human identities with just-in-time, quickly-rotated privileges, so a leaked token can’t be reused forever.Tightly constrained execution environments (VM, container, serverless) that only touch what the agent truly needs.Identity-based network segmentation, so an agent working with CRM data can never reach the financial system.Allow-listed MCP tooling, because tool sprawl is the new shadow IT.New data controls for a world where everything (prompts, retrieval, documents) is data flowing to and from a model.He’s candid about the gaps, too: there’s no generic “AI firewall” yet, prompt injection has no guaranteed fix, and the hardest control points now live in the details of how individual developers configure their tools. The optimistic note: because agent-to-model and agent-to-agent calls can be logged, you can actually see what an agent is doing, an advantage over the opacity of the human mind. The episode closes on what’s still missing and a clear first step for any organization: get an overview of every agent and MCP server in use, and the access each one has. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. New episode every Tuesday. Follow Threat Talks to stay up to date on the topic of cybersecurity.

    Why Do You Trust Your AI Agent?

  6. Jun 23

    Mythos is not the AI Apocalypse

    Mythos found a 23-year-old vulnerability in FreeBSD that no human team had caught. Your 30-day patch cycle assumes years before it gets weaponized. Today that window is one day. Next year it will be one hour. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Rob Maas, Field CTO at ON2IT, to break down what Anthropic's Mythos actually found, why the public release (Fable) still frustrates security professionals, and whether the FABLE framework gives defenders a realistic path forward. Rob's verdict: there is truth in what Anthropic claims. It is not as catastrophic as the marketing suggests. But if your fundamentals are not in place, the time to fix that is now. 00:00:00 Introduction00:00:46 What is Mythos? From Project Glasswing to Fable00:03:13 What Mythos actually found: FreeBSD, Palo Alto, real patches00:05:57 The zero-day clock: from years to one hour00:09:00 The FABLE framework and the CSA "Mythos Ready" paper00:15:24 Authentication, segmentation, and egress filtering00:20:51 Myth or reality: Rob's verdict Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔===► YOUTUBE:    / @threattalks► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

    Mythos is not the AI Apocalypse

  7. Jun 16

    What about Iran? One Word Document, Three Backdoors

    Every big nation state has a cyber army: China, Russia, the US, Europe. But what about Iran? Meet Boggy Serpens, a group tied to Iran’s civilian intelligence service whose entire business is breaking in and staying in, then handing the keys to whoever strikes next. Their playbook, Operation OLALAMPO, needs just one booby-trapped Word document to plant three separate backdoors on your network. A Telegram-bot command channel that hides inside everyday encrypted chat traffic, a Rust “Ghost” backdoor built to defeat analysis, and a legitimate AnyDesk install quietly turned against you.The layered defense for every stage: email and file controls, behavioral EDR, egress policy, threat intel, and Zero Trust segmentation.The twist: why this operation mostly failed, plus the tells that the malware was partly written with AI.Filmed live at the ON2IT SOC, host Lieuwe Jan Koning runs a red team vs blue team session with analysts Yuri Wit, the “proxy Iranian” attacker, and Rob Maas on defense. Watch the full episode to see each move, and the exact control that stops it. 🔗 Episode resources, transcript and show notes: https://threat-talks.com 🎙️ Subscribe to the podcast on Spotify, Apple Podcasts, or your podcast app of choice. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. Chapters (paste into YouTube description) 00:00 Every nation state has a cyber army: what about Iran?00:21 Meet the guests: Yuri (red team) and Rob (blue team)01:17 Boggy Serpens and Operation OLALAMPO: Iran's access brokers04:20 Infection via Office macros, and the social-engineering layer07:18 You opened the document: three payloads08:06 Backdoor 1: Telegram-bot command and control12:55 Backdoor 2: the Rust "Ghost" backdoor, and why it's so hard to analyze16:03 Backdoor 3: legitimate AnyDesk, pre-loaded for the attacker17:59 Zero Trust and network segmentation18:59 Did it work? AI tells, and staying vigilant

    What about Iran? One Word Document, Three Backdoors

  8. Jun 9

    Europe Is Losing the Sea Cable Race

    In 2026, 40 new submarine cables go live. Most won't land in Europe. Europe is losing the sea cable race, and most people haven't noticed yet. In this second part of our sea cables conversation, host Peter Ernst sits down with Ernst Noorman, the Netherlands' Cyber Ambassador-at-Large and a member of the ITU Advisory Body on Submarine Cable Resilience, to move from the “how” of sea cables to the “why it matters.” We compare two places that were once called the two hardest spots in the world to build digital infrastructure, Amsterdam and Singapore, and unpack how Singapore solved its crunch with 32 cable landings, five years of zero cable faults, and a green-energy-first tender process, while the Netherlands risks resting on a 30-year-old head start. Along the way: the difference between sovereignty and autonomy, why “always the cheapest option” no longer works, the EU Cyber Resilience Act and security by design, what NIS2 means for boards and CEOs personally, and why Europe needs to stop being modest about Airbus-sized wins. Chapters 00:00 — 40 new cables, most skip Europe00:30 — Meet Ernst Noorman & the ITU advisory body02:00 — The sea cable map is being redrawn04:08 — Why the Netherlands risks losing its head start06:26 — How Singapore solved it: 32 landings, zero faults08:09 — Tax cuts for digital, would Europe ever?08:59 — Sovereignty vs autonomy: it's about choice15:02 — You can't own the whole stack (ASML, Nokia, Ericsson)15:53 — Why “always the cheapest” stops working17:47 — The Cyber Resilience Act & security by design18:51 — The water-from-the-tap analogy19:51 — What boards and CEOs must actually ask25:30 — Back to Singapore: government-led, by design29:39 — The good news: Europe's real strengths36:15 — What needs to happen in the next 3–5 years Threat Talks is a podcast by ON2IT and AMS-IX. Subscribe for more on Zero Trust, cyber resilience, and the infrastructure behind the internet.

    Europe Is Losing the Sea Cable Race
See All (133)

Trailer

About

Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!

Information