The Human Perimeter

Simon Gajdosik/André Daus

The cybersecurity industry spent decades calling people the weakest link. They got it backwards. People are not the vulnerability. They are the perimeter. This show is about where security breaks down — and where it holds. Phishing, social engineering, deepfakes, insider threats. Real attacks explained in plain language for smart adults who just haven't been given the right information yet. No jargon. No scare tactics. No sponsors. An independent podcast by Andre Daus and Simon Gajdosik.

Episodes

  1. 22 Sept

    The Click Was Rational

    Simon's on vacation, so this week it's a solo deep dive into two fraud cases that look nothing alike on the surface but share the exact same structural flaw. In September 2026, 347,000 Trezor newsletter subscribers received a phishing email that passed every authentication check email security has: valid SPF, valid DKIM, valid DMARC. Not spoofed. Genuinely authentic, because attackers exploited an SSO misconfiguration at Brevo, Trezor's email platform, and sent the phishing mail through Trezor's own real, authorized channel. About 2,500 people clicked before it was shut down twenty minutes later. Then I connect it to invoice fraud, which is quietly draining businesses of billions, sometimes through a compromised inbox, sometimes through a genuine man-in-the-middle attack where nobody's account is ever touched at all, because email encryption between mail servers is opportunistic, not enforced. In this episode: How the Brevo/Trezor breach actually worked, and why most coverage got the mechanism wrongWhy "valid DKIM" was never a promise that a message is trustworthyThe difference between a compromised mailbox and a true network-level interception, and why victims often can't tell which one hit themWhy "be more careful" is the wrong advice for either attackWhat actually stops both: out-of-band verification, and treating email infrastructure as critical infrastructureThis is the recurring argument on this show: the human decision point is always the last line of defense, and it's routinely handed zero usable information to make the call with. That's a structural failure, not a training problem. The Human Perimeter is a cybersecurity podcast about the human decisions behind every technical failure, hosted by André Daus and Simon Gajdosik.

  2. 8 Sept

    Own Your Data

    A customer on xCloud lost every site on their account this week. Vultr's hostdisk failed, backups were off, no snapshots existed, and support said there wasnothing to restore.I am not here to pile on. Hardware fails and no provider can promise it won't.But the backup was never the host's job. Unless a company puts it in writingthat they run backups and will restore them, assume nothing is being backed up."Managed" is a marketing word. Read what it covers.The painful part: Vultr's backup option is a checkbox that costs 20% on top ofthe server price. On a small VPS that is a few dollars a month.

  3. 25 Aug

    One Password, 160 Companies

    In 2024, a single technique compromised roughly 165 companies that had never spoken to each other, never shared infrastructure, and in most cases never even knew they shared a vulnerability. No zero-day. No sophisticated exploit chain. Just stolen passwords, sitting unused for years, and one missing setting: multi-factor authentication. In Episode 7, Simon and Andre dig into the Snowflake customer breach campaign — how threat actor UNC5537 (ShinyHunters) turned old infostealer malware logs into access at Ticketmaster (560M records), AT&T (109M customers, undisclosed ransom paid), Santander, Neiman Marcus, LendingTree, Advance Auto Parts, and half a dozen others, extorting each one individually with a price tag ranging from $150,000 to $2 million. This wasn't 165 separate hacks. It was one repeatable gap, exploited at scale: credentials exposed years earlier that nobody rotated, and accounts nobody protected with MFA — even where the option existed. We break down what actually happened, why "the password leaked in 2020" is still a live threat in 2026, and what one control would have stopped almost all of it. Source: Push Security, "Snowflake: A Retrospective" — https://pushsecurity.com/blog/snowflake-retro 🔴 Live — join the chat, ask questions, tell us if your org has checked this.

  4. 28 Jul

    Your Voice Just Got Cloned

    Three seconds of audio. That's all it takes to clone a voice convincingly enough to fool a family member on the phone. AI scam calls now sound exactly like the people you trust — and in 2024 alone, seniors lost $4.9 billion to cybercrime, much of it accelerated by exactly this kind of fraud. Recorded live, Simon and Andre break down how generative AI has turned voice, image, and video into the newest attack surface — and what to actually do about it. Simon covers the technical mechanics: how little source audio is needed, where AI still leaves subtle tells, and what real verification protocols look like. Andre covers the psychology: why fear defeats scrutiny by design, why a cloned voice you trust is a deeper betrayal than a stranger's, and why shame gives scammers the time they need. They also run a live, consent-based demo — cloning Andre's own voice to read a short ad read — so you can hear exactly how convincing this technology has gotten. ⚠️ Disclosure: This episode includes a clearly labeled AI-generated voice clone of Andre, created with his consent for educational purposes. The cloned segment is verbally announced before and after it plays. No real person is impersonated without permission. In this episode: Why 3 seconds of audio is enough to clone a voiceThe FBI's December 2024 warning on generative AI fraudWhy "it sounded just like them" is no longer a reliable gut-checkFamily and business verification protocols that don't rely on detecting a fakeA live voice-clone demo, clearly labeledSources:FBI/IC3 PSA — "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud" (Dec 3, 2024): ic3.gov/PSA/2024/PSA241203FBI 2024 Elder Fraud data: fbi.gov/news/press-releases/fbi-recognizes-world-elder-abuse-day-and-reminds-americans-of-elder-fraud The Human Perimeter — where security meets human behavior.

  5. 14 Jul

    Passkeys

    In this episode, Simon and Andre explain what a passkey is, why it beats passwords and SMS codes, and where hardware tokens still matter in 2026. The question is no longer whether passkeys are good. They are. The real question is who holds the private key, where it can move, and how someone gets back in when something goes wrong.

    Passkeys

  6. 30 Jun

    The Email That Fooled the Whole Company

    One email lands in the inbox: A supplier invoice. A SharePoint link. A DocuSign request. A password reset. A domain renewal notice.Nothing dramatic. Just work. In Episode 5, Simon and Andre take apart the phishing email that fools a whole company. Not the cartoon spam with bad spelling. The good one. The one that looks like the tools, vendors, bosses, deadlines, and workflows people already trust. Security Magazine summarized Comcast Business research saying about 67% of breaches start with someone clicking a seemingly safe link, and that 80 to 95% of attacks begin with phishing. Comcast’s 2025 report analyzed 34.6 billion cybersecurity events, including 4.7 billion phishing attempts. The FBI’s 2024 IC3 report recorded 193,407 phishing and spoofing complaints, more than any other listed crime type. The question is no longer why someone clicked. Episode 4 covered that. The question now is what happens when the email becomes the attack path.

    The Email That Fooled the Whole Company

  7. 16 Jun

    Why You Click

    You know the link looks strange. You click anyway. Why? Social engineering does not target your intelligence first. It targets the moment around it: pressure, trust, fear, curiosity, fatigue, and routine. In Episode 4, Simon and Andre look at why smart people fall for scams. Not because they are careless. Because attackers design messages for the brain people actually use at 4:47 p.m., between two calls, with thirty unread emails and a manager waiting for an answer. The episode draws on the paper Human Cognition through the Lens of Social Engineering Cyberattacks. The paper treats social engineering as a psychological attack. Workload, stress, low vigilance, limited domain knowledge, lack of experience, culture, trust, and attacker effort all shape the click. Knowing about phishing does not always protect you. General technical skill does not always protect you. Suspicion alone does not always protect you. A better defense starts with the pause.

    Why You Click

  8. 2 Jun

    Scattered Spider: They Didn't Hack You. They Called Your Help Desk.

    In November 2023, the FBI and CISA put out a joint advisory on one of the most effective cybercriminal groups operating today: Scattered Spider. What makes them unusual isn't the malware or the exploits. It's that they barely need any. A phone call, a convincing story, and a help desk employee trying to be helpful — that's often all it takes. In this solo episode, André breaks down exactly how Scattered Spider operates: how they impersonate IT staff to extract credentials, how they hijack phone numbers to bypass two-factor authentication, and how they stay hidden inside a network by blending in with normal IT activity. Including, in some cases, joining the victim's own incident response calls to monitor how the investigation is going. This is also a story about how security fails at the human layer — and what organisations actually need to do to close that gap. What we cover: Who Scattered Spider is and what sets them apartWhy your help desk is now a primary attack surfaceSIM swapping and MFA fatigue — two techniques that break most authentication setupsHow they maintain access even after passwords are changedTheir move into ransomware via the BlackCat/ALPHV groupThe defences that actually work against this type of attackSource: CISA/FBI Joint Advisory AA23-320A 🌐 human-perimeter.com

    Scattered Spider: They Didn't Hack You. They Called Your Help Desk.

  9. 19 May

    People Are Not the Weakest Link

    The security industry has called people the weakest link for 30 years. Cybersecurity psychologist Inge Wetzer says the weakness isn't in the people — it's in how the industry understands them. André and Simon dig into why that framing is wrong, why training theater backfires, and what it actually means to treat people as the perimeter.

  10. 5 May

    The $25 Million Call That Never Happened

    A CFO who knew 15 precise account numbers across 5 banks. A group of senior executives all agreeing in real time. A confidential transaction that couldn't be discussed with anyone else. Every one of those details was a red flag. None of them were caught. In this episode, Simon unpacks the infrastructure and authentication breakdown behind the $25M Arup deepfake fraud. André applies Red Team thinking to the social engineering — why smart, experienced people stop questioning exactly when they should start. The attack surface isn't your systems. It's trust itself.

  11. Season 1 Trailer

    Why Cybersecurity Has Been Thinking About People All Wrong

    In this introductory episode, André Daus and Simon Gajdosik lay out why The Human Perimeter exists — and why it takes a different angle than almost every other cybersecurity show out there. The cybersecurity industry has spent decades blaming people for breaches. We think the framing is wrong, and we're going to spend a lot of episodes proving it. One host comes from the infrastructure side — building servers, locking them down, cleaning up the aftermath. The other comes from strategic opposition and financial risk — walking into rooms and asking the questions nobody wants to answer. Together they cover the psychology behind why people click, why convenience always fights security, and what it would actually look like to move people from the weakest point in the chain to something stronger. Every episode goes live — meaning you can ask questions in real time. Biweekly. Unscripted. No paywalled questions. Subscribe at human-perimeter.com to get notified when the next episode goes live.

  • 1 Trailer
    10 Episodes

Trailer

About

The cybersecurity industry spent decades calling people the weakest link. They got it backwards. People are not the vulnerability. They are the perimeter. This show is about where security breaks down — and where it holds. Phishing, social engineering, deepfakes, insider threats. Real attacks explained in plain language for smart adults who just haven't been given the right information yet. No jargon. No scare tactics. No sponsors. An independent podcast by Andre Daus and Simon Gajdosik.

Information

  • Creator
    Simon Gajdosik/André Daus
  • Years Active
    2026
  • Episodes
    11
  • Rating
    Clean
  • Copyright
    © Simon Gajdosik/André Daus
  • Show Website
    The Human Perimeter