Exploited: The Cyber Truth

RunSafe Security

Exploited: The Cyber Truth is a hard-hitting, no-fluff podcast exposing the realities of today’s cyber threat landscape and risks to critical infrastructure. Through candid conversations with top cybersecurity experts, industry leaders, and frontline defenders, the show breaks down recent high-profile vulnerabilities and exploits and covers innovative strategies used to stop them. To keep critical infrastructure safe, defenders need the upper hand. Tune in and get the cyber truth.

  1. 4d ago

    When Cyber Attacks Become Physical: The Truth About OT Security Risk

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security Chief Strategy Officer Doug Britton and special guest Andrew Ginter, Vice President of Industrial Security at Waterfall Security Solutions, an author, and a leading voice in OT cybersecurity. Andrew explains why industrial security cannot simply borrow the same tools and practices used in enterprise IT. In OT environments, the physical process is the asset, and malicious information entering the system can become the threat. Doug explores how organizations can reduce exploitability, protect existing software, and maintain deterministic behavior without relying solely on disruptive patching cycles. Together, Doug and Andrew explore: Why OT security must be stronger than traditional IT securityHow cyber attacks can create real-world safety and operational consequencesThe risks created by IT/OT convergenceHow cyber-informed engineering strengthens industrial resilienceThe role of unidirectional gateways and deterministic protectionsWhy patch management alone cannot keep pace with AI-driven threats For critical infrastructure leaders, engineers, and security teams, this episode offers a practical look at designing industrial systems that remain safe, reliable, and resilient when cyber threats become physical.

    When Cyber Attacks Become Physical: The Truth About OT Security Risk

  2. Jul 10

    When the Grid Gets Hit: Inside OT Incident Response in Energy & Renewables

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guest Derrick Bethea, NERC Compliance Manager and OT Cybersecurity Leader at Cypress Creek Energy, for an inside look at how utilities and renewable energy operators prepare for, respond to, and recover from cyber incidents. Drawing on years of experience securing operational technology (OT) environments, Derrick explains why incident response plans must be tested—not just documented—and how organizations navigate the complex intersection of cybersecurity, regulatory compliance, and operational resilience. Joe explores how AI is changing both cyber defense and attacker capabilities, why legacy infrastructure presents unique security challenges, and how security-by-design and security-by-demand must work together to strengthen the energy sector. Together, Joe and Derrick discuss: Why OT incident response differs from traditional IT securityThe realities of NERC CIP compliance and regulatory reportingHow AI is accelerating vulnerability discovery across critical infrastructureWhy security must be part of procurement and engineering decisionsThe importance of testing incident response plans before an emergency occursHow utilities can balance innovation with operational resilience Whether you secure power generation, renewable energy assets, industrial control systems, or other critical infrastructure, this episode offers practical lessons for strengthening cyber resilience before the next incident occurs.

    When the Grid Gets Hit: Inside OT Incident Response in Energy & Renewables

  3. Jun 25

    From Compliance to Resilience: Securing Digital Mission Systems at Military Scale

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Lt. Gen. (Ret.) Bill Bender, former Chief Information Officer of the U.S. Air Force, to discuss what it takes to build true cyber resilience across some of the world's most complex digital environments. Drawing on his experience overseeing a $17 billion IT portfolio and helping establish the first Chief Information Security Officer (CISO) and Chief Data Officer (CDO) offices within the Department of Defense, Bender explains why organizations must move beyond checklist-driven security and adopt a mission-focused approach to risk management. Together, they explore: Why compliance alone cannot secure mission-critical systemsBuilding cybersecurity leadership, accountability, and culture at scaleManaging technical debt and long-lived systems that cannot easily be replacedThe role of Zero Trust in protecting complex defense environmentsHow software supply chains and SBOMs support mission assuranceWhy public-private collaboration is essential for modernization and innovationThe growing impact of AI on cyber defense and critical infrastructure security From defense acquisition to critical infrastructure protection, this episode examines how organizations can strengthen resilience.

    From Compliance to Resilience: Securing Digital Mission Systems at Military Scale

  4. Jun 11

    Seeing the Invisible: Asset Discovery, Segmentation, and the Reality of OT Security

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Shane Fry, CTO of RunSafe Security, and Andrew McPhee, Solutions Manager for Industrial Security at Cisco, to examine why visibility is one of the biggest challenges in OT cybersecurity. As industrial environments become more connected, organizations are struggling to identify unknown assets, understand hidden dependencies, and secure systems that were never designed with cybersecurity in mind. McPhee explains how attackers exploit these blind spots, why traditional IT security approaches often fall short in OT environments, and how visibility and segmentation can help reduce risk. Together, they explore: Why asset visibility is the foundation of OT securityHow unknown assets and communication pathways create riskThe differences between active and passive asset discoveryWhy segmentation remains one of the most effective OT security controlsHow IT/OT convergence is expanding the attack surfaceThe role of risk tolerance and risk acceptance in security decisions From manufacturing facilities to critical infrastructure, this episode explores what security teams must understand before they can effectively protect the systems they depend on.

    Seeing the Invisible: Asset Discovery, Segmentation, and the Reality of OT Security

  5. May 28

    The Cyber-Physical Truth: What We Get Wrong About Attacks on Critical Infrastructure

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joseph M. Saunders and Danielle “DJ” Jablanski, Cybersecurity Consulting Program Lead for Operational Technology at STV and former OT Cybersecurity Strategist at CISA, to examine what defenders often get wrong about attacks on critical infrastructure. With experience across government, threat intelligence, engineering, and industrial environments, DJ explains why sectors like water, rail, energy, and manufacturing require a different way of thinking about cybersecurity. Together, they explore: How cyber-physical risk differs from traditional IT riskWhy attacks can target engineering logic, process variables, and safety systemsThe challenge of securing long-lived OT assets and heterogeneous environmentsHow visibility, asset identification, and segmentation shape OT defenseWhy secure-by-design and secure-by-demand both matterWhy patching alone cannot keep up with distributed critical infrastructure From water systems to transportation networks, this episode breaks down what security leaders, asset owners, OEMs, and operators must understand to stay ahead of cyber-physical threats.

    The Cyber-Physical Truth: What We Get Wrong About Attacks on Critical Infrastructure

  6. May 21

    You Can’t Patch Your Way Out of This: What Mythos Means for the Future of Cybersecurity

    In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joe Saunders and EVP and CSO Doug Britton join us for a strategic discussion on what Anthropic’s “Mythos moment” means for the future of cyber defense. Joe and Doug explore why AI-driven vulnerability discovery marks a fundamental turning point for enterprises, critical infrastructure, and national security. As AI accelerates the discovery and weaponization of vulnerabilities, traditional patch-and-remediate strategies are becoming increasingly unsustainable, especially for safety-critical and mission-critical systems that cannot be patched quickly or frequently. Together, Joe and Doug examine: Why “find and fix” alone cannot scale in the AI eraHow AI is shifting the balance between attackers and defendersWhy patch timelines are widening as vulnerability discovery acceleratesThe growing need for resilience-based cybersecurityHow organizations can reduce exploitability without rewriting legacy systemsWhy mitigation technologies are becoming essential for critical infrastructure and national security Whether you secure embedded systems, manage cyber risk across critical infrastructure, or lead product security strategy, this episode makes the case for a new approach: one built not around chasing every vulnerability faster, but around ensuring systems remain resilient even when flaws exist.

    You Can’t Patch Your Way Out of This: What Mythos Means for the Future of Cybersecurity

  7. May 14

    The Next Cyber Crisis Won’t Be One Hospital—It Could Be the Entire Health System

    In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Greg Garcia, Executive Director for Cybersecurity of the Health Sector Coordinating Council (HSCC) Cybersecurity Working Group, to examine how ransomware, third-party dependencies, and interconnected healthcare infrastructure are shaping cyber risk across the healthcare sector. Drawing on experience spanning DHS, critical infrastructure protection, and healthcare cybersecurity coordination, Garcia explains how disruptions at a single vendor or service provider can cascade across hospitals, pharmacies, insurers, and patients nationwide. Together, they explore: Why healthcare cyber risk is shifting from isolated breaches to systemic disruptionHow ransomware and third-party compromises create cascading operational impactsLessons from the Change Healthcare ransomware attackThe growing challenge of securing connected healthcare systems and medical devicesWhy patching alone cannot keep pace with modern cyber threatsThe role of collaboration and resilience in protecting critical healthcare infrastructure From healthcare providers and medical device manufacturers to policymakers and critical infrastructure leaders, this episode explores what organizations must understand to prepare for the next generation of healthcare cyber threats.

    The Next Cyber Crisis Won’t Be One Hospital—It Could Be the Entire Health System

  8. Apr 30

    Trust at Machine Speed: AI, DevSecOps, and Zero Trust in National Security Software

    Artificial intelligence is moving faster than the policies, security controls, and acquisition processes designed to govern it—especially in national security environments where preventing failure is mission-critical. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Nicolas Chaillan, the host of In the Nic of Time and Former DAF CSO, to examine a central question: how do you build trust in systems that operate, adapt, and make decisions at machine speed? Drawing on his experience deploying DevSecOps across the Department of Defense and building large-scale AI platforms, Chaillan offers a direct perspective on what’s working, what isn’t, and where organizations are falling behind. Together, they explore: Why multi-model AI strategies are critical to avoid lock-in and improve outcomesHow AI is accelerating software development, testing, and security workflowsWhere policy and governance are lagging behind technical realityThe risks of restricting access to critical AI capabilitiesWhat zero trust looks like in systems driven by automation and AI From defense systems to software pipelines, this episode examines what it takes to move fast without losing control—and what leaders need to understand as AI becomes embedded across the mission stack.

    Trust at Machine Speed: AI, DevSecOps, and Zero Trust in National Security Software
See All (51)

About

Exploited: The Cyber Truth is a hard-hitting, no-fluff podcast exposing the realities of today’s cyber threat landscape and risks to critical infrastructure. Through candid conversations with top cybersecurity experts, industry leaders, and frontline defenders, the show breaks down recent high-profile vulnerabilities and exploits and covers innovative strategies used to stop them. To keep critical infrastructure safe, defenders need the upper hand. Tune in and get the cyber truth.

Information

  • Creator
    RunSafe Security
  • Years Active
    2025 - 2026
  • Episodes
    51
  • Rating
    Clean
  • Copyright
    © 2025 Exploited: The Cyber Truth
  • Show Website
    Exploited: The Cyber Truth