Breach Please

Breach Please Team

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

  1. 2d ago

    S0:E36 - Jake Talks to Exaforce about Data vs APIs in AI-enabled SOC

    In this episode, Jake sits down with one of Exaforce's co-founders and a long time user to discuss AI-enabled SOC. One of the big things we talk about is why API-based solutions miss a lot of context that is only really possible to generate with an underlying data model. We also talk about dogs and cats at the end for some fun personal discussions. Jess will be back tomorrow for more fun security banter.

  2. 3d ago

    S0:E35. Update Yo Firewall Rules and Digital Escorts (totally SFW)

    In this episode, Jake and Jess talk about an upcoming critical change to domains for M365 and Teams that are ironically going to disproportionately impact those with the best security the most. We conclude this is busy work that MSFT is causing. Then we take a hard right into talking about Microsoft's Digital Escort (sounds dirty, but somehow is totally SFW) program, revealed by ProPublica. It's older news, but Jess hadn't heard about it and there's gold in them there hills. Digital Escorts: https://www.propublica.org/article/microsoft-china-defense-department-digital-escorts-investigation-warning Teams and Copilot (sadly somehow now M365) moving domains: https://www.computerworld.com/article/4221272/teams-and-copilot-are-changing-addresses-update-your-firewalls.html

  3. 4d ago

    S0:E34. Jake and Stel talk zero-trust and validating network edge devices.

    Jake and Jess will be back tomorrow for more content together. In this episode of Breach Please, Jake sits down with Stel Valavanis, co-founder of Blue Team Con. They discuss how for too long, we've known that network edge devices needed to be part of the zero trust equation, but put them in the "too hard" bucket of security because we didn't have tools to monitor them. Stel talks about the formation of a new company, Kyrient that Jake is both the inventor of the core technology of and an advisor for, that's hoping to address this. The key point that we try to make that is that we're blind today to most network device compromises and that's not a state of affairs that can continue in a modern security environment.

  4. 5d ago

    S0:E33 - (re-record) The EU CRA and You (even if you aren't an EU company)

    Folks, our apologies. We didn't realize how bad the audio was with a given microphone/computer setup was for Riverside (our recording platform). We re-recorded and honestly, not only is the audio better, but it's a MUCH better episode overall. On September 11, 2026, reporting requirements baked into the EU Cyber Resiliency Act came into force. The requirements apply to any vendor that sells or makes available for sale digital products (including SaaS, yes, you too) in the EU. You don't have to be an EU company. Reporting timelines are extremely tight, with 24 and 72 hour initial triggers. Fines for noncompliance are huge. This is something several of our clients don't realize applies to them, so we figured it was a good idea to do an episode on it. We're not lawyers, so you should read what some actual lawyers wrote on the subject if you want more information: https://www.taylorwessing.com/en/insights-and-events/insights/2026/09/cra-reporting-requirements

  5. 6d ago

    S0:E32 - Where Traditional EDR Has Visibility Gaps with Golan Myers from Bloom Security

    In this episode, I sit down with Golan Myers with Bloom Security and discuss what EDR is missing in its visibility. We then discuss some of the findings from his research and Bloom Security and what they're doing to solve the problem. https://www.linkedin.com/in/golan-myers/ https://bloom.security/

  6. Sep 11

    S0:E31 — They Did Everything Right, and Still Got Burned

    Trezor disclosed a breach affecting roughly 67,000 US customers, data from orders placed between November 2019 and August 2021. The twist: Trezor had repeatedly requested and received written assurance that this data was deleted, in line with their contract and data policy. It wasn't. Jess and Jake use this as a real-world case study in third-party risk management, why "right to audit" is often a paper tiger control nobody budgets to actually use, and why this is the exact kind of story to proactively brief leadership on before it happens to you. Second half: a wave of CVEs in PaperCut, the managed print service used heavily in schools and enterprises, letting attackers remotely take over print servers running as SYSTEM. Jess and Jake talk through why that's a bigger deal than it sounds (credential theft, lateral movement, and every sensitive document that crosses the print queue), why these servers so often end up exposed to the internet, and how to actually think about vulnerability risk beyond raw CVE counts. In this episode: Trezor's breach: third-party vendor data that should have been deleted years ago, wasn'tWhy "right to audit" contract language rarely gets used, and what to do insteadReducing blast radius: don't retain data you don't need, and if you must, wall it off behind a jump boxHow to brief leadership proactively: "we can do everything right and still get burned"PaperCut's remote takeover CVEs: SYSTEM-level access, credential theft, and lateral movementWhy print servers end up internet-exposed (BYOD, guest Wi-Fi, mobile printing)CVE count vs. actual risk: reading vulnerability history like an engineer, not a scorecardA tone-deaf vendor sales pitch that used their own vulnerability disclosures as a selling point Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. Nothing in this episode is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

  7. Sep 9

    S0:E30 — WeChat's Zero-Click Worm Didn't Need AI to Be Scary

    Researchers at security firm Calif found a zero-click exploit chain in WeChat: place a call, the target doesn't even have to answer, and you get code execution on their phone. Chain it with other bugs and you get full device control, on both iOS and Android. Tencent patched it. The bigger problem started after, when the New York Times ran a headline blaming an AI model for building a computer worm that could rapidly hack WeChat accounts. Jess and Jake walk through what the researchers actually did (AI sped up the process, it didn't discover or weaponize anything on its own), why "the model built a worm" is the kind of sensationalism that makes their actual jobs harder, and why this is fundamentally an attack surface story, not an AI story or even really a WeChat-specific one. In this episode: The WeChat zero-click exploit: how it works, and why the caller needs to already be a contactChaining bugs to go from initial code execution to full device controlWhy "the AI model built a worm" is bad reporting, and what it actually means when researchers say AI sped up their workWhy this is an attack surface conversation, not an AI-apocalypse oneThe real cost of sensationalist headlines: talking execs down instead of focusing on what mattersCorporate messaging apps: WeChat, WhatsApp, and why "this is how the business communicates" isn't a security answer

  8. Sep 8

    S0:E29 — The GRE Tunnel That Wasn't in the Config

    Sygnia published new research on Fire Ant, a threat actor they first tracked in 2025 around hypervisor espionage against vCenter and ESXi. The new report covers something rarer: live compromise of Cisco IOS XR network devices, discovered because a responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs. Jess and Jake walk through what that means for defenders, why IOS XR being Linux-based changes the economics of building a backdoor, and why "compromised network devices" remains one of the most underappreciated categories of incident today. They also get into the ongoing mess of threat actor naming conventions (why one group can have a dozen different names across vendors, and why that's not just marketing), and revisit an earlier debate: is network device security part of zero trust, or a separate problem? Jake asked the internet. The internet had opinions. In this episode: Why one threat actor group ends up with a different name at every vendor, and why that's harder to fix than it soundsFire Ant: Sygnia's research on Cisco IOS XR compromise and a GRE tunnel that left no trace in logs or saved configWhy IOS XR being Linux-based lowers the cost of building a persistent backdoor from six figures to a scripting problemThe running-config-vs-saved-config trap during incident responseWhy unencrypted internal traffic means a compromised network device gets credentials, not just topologyMan-in-the-middle terminology, RC4, Kerberoasting, and why alerting on SPN enumeration breaks down for an on-path attackerWhy network device security has to be part of zero trust, not an asterisk on it Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. Nothing in this episode is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

See All (37)

About

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

Information

  • Creator
    Breach Please Team
  • Years Active
    2026
  • Episodes
    37
  • Rating
    Clean
  • Copyright
    © Copyright JWJH Media LLC
  • Show Website
    Breach Please