The Cybersecurity Defenders Podcast

LimaCharlie
  • 5.0 (25)
  • Technology
  • Weekly

An accessible but technical podcast about cybersecurity and the people who keep the internet safe. The podcast is built as a series of segments: we will be looking back at the last couple of weeks in cybersecurity news, talking to different people in the industry about areas of their expertise, we're going to break apart some of the TTPs being used by adversaries, and we will even cover a little bit of hacker history.

  1. 2d ago

    Intel Chat: Binance's $6.34B heist, supermarket fridge attacks, Belarus wiper, XCPE botnet [352]

    Intel Chat with Matt Bromiley and Chris Luft. • Binance discloses the $6.34 billion heist attempt, the largest attempted crypto theft on record. The FBI and TRM Security attribute it to North Korea's TraderTraitor. It began in June with an engineer installing a malicious Homebrew, then a fake recruiter and two fake job interviews delivered a "coding assignment" that swapped out a dev-tool component and evaded endpoint detection. In October the attackers used that machine and an internal AI tool to reach two more engineering devices, took a credential for the container deployment platform, ran a malicious container against the wallet signing service, and abused Ethereum's EIP-7702 delegation with 50 signing transactions so funds moved outside normal withdrawals. Multi-party computation meant there was no single key to revoke the authorizations. Binance froze or intercepted about $2.85 billion. Matt: we've warned about fake-recruiter attacks for months, and who takes a job interview on their work laptop? Hats off to the responders for getting this far in a week, but it's a breakdown in a human process, and training your people is the real ROI. Chris did the math: in $100 bills it's 63.5 tons of cash, three semi-trailers.• Refrigeration attacks hit supermarkets in seven European countries. Attackers flipped refrigeration controls into defrost mode, pushing temperatures as high as 50 °C, at Delhaize stores in Belgium and Luxembourg, Carrefour, Spar, Ikea Mons, ICA and Coop in Sweden, SuperValu in Ireland and more. Refrigeration firm Sabcobel confirmed the attack and says the fix needs physical modifications, not just software. Danfoss reported attacks at businesses in the Netherlands. The attackers are unidentified, and US authorities are looking at similar malfunctions at American military bases. Matt recorded from one of the affected countries: who is behind it and why, and was the fridge facing the internet or reached through the store's management plane? One of those is close to negligence.• FrostyNeighbor (UNC1151): ESET documents the first destructive attack by a Belarus-aligned actor, against a Ukrainian manufacturer important to the transportation sector, using Chisel, UltraVNC, Cobalt Strike and a VBScript wiper pushed through Group Policy. ESET sees Belarus-aligned groups acting as proxies or force multipliers for Russia; Recorded Future cautions against assuming Russian operational control. Matt: UNC1151 is a very early Mandiant handle, so this group has been around a long time. Chris: hitting the drone supply chain shows how cyber supports kinetic operations on the front line.• Google dismantles the XCPE botnet: more than 1.3 million devices, mostly Android TV set-top boxes, with the malware built in by the manufacturer, Videostrong Technology, and access sold to affiliates for ad fraud, residential proxies and more. A three-stage design started from a backdoor on the /oem/ partition. Google banned Videostrong from preloading Google apps, went after the infrastructure with Japan's National Police Agency and industry partners, and says it likely cut off at least 10 million more devices. Chris and Matt on smart TVs that watch you, and whether the toothbrush can run Doom. Stories covered:• https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/• https://www.bbc.com/news/articles/cq1kd1nee80eo• https://www.darkreading.com/physical-security/russia-cyber-war-belarus-steps-forward• https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/ Chapters:0:00 The robot Renaissance1:02 Binance and the $6.34 billion elephant in the room5:06 Who takes a job interview on their work laptop?8:01 63.5 tons of cash, three semi-trailers8:42 A modern-day Frankenstein of an attack11:01 A breakdown in a human process: train your people11:46 Paying back the losses12:15 Refrigeration attacks on European supermarkets14:43 Real-world impact, and who might be behind it15:09 Matt is in one of the affected countries17:04 Internet-facing fridge or the management plane?19:07 FrostyNeighbor: Belarus's first destructive attack in Ukraine22:47 UNC1151, a very early handle25:02 Hitting the drone supply chain26:23 Google dismantles the XCPE botnet29:08 Your TVs are watching you32:30 But can the toothbrush run Doom?33:16 Chris's new studio The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly. Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieio Learn more about LimaCharlie: https://limacharlie.io #cybersecurity #infosec #northkorea #ICS #botnet

  2. Oct 13

    Intel Chat: NetScaler pre-auth RCE, OpenAI agents DDoS Wikimedia, MonsterCloud & ShinyHunters [351]

    Intel Chat with Matt Bromiley and Chris Luft. • Citrix NetScaler pre-auth command injection, CVE-2026-88771 (CVSS 9.5). watchTowr Labs diffed vulnerable and patched builds and found the bug not in the Packet Engine but in a Perl maintenance script that hunts for crash dumps: it pulls data out of diagnostic logs and drops it into a shell command unvalidated. Put a payload in the username field of an unauthenticated login, NetScaler logs it, and the script later runs it as root (headers and request parameters work too, and execution can lag up to 24 hours). Default configurations are affected and it was exploited before a patch existed; it's one of eight fixes in the Citrix advisory, alongside a second exploited memory overflow. Fixed in the 13.1 and 14.1 branches. Chris: forget the old Perl script, the real failure is not scrubbing input. Matt: if you run these appliances, go read the advisory and patch, or take the service offline.• OpenAI's autonomous agents caused a partial Wikimedia outage. Per Dark Reading, Wikimedia found unauthorized edits to its wiki sandboxes, a citation tool reconfigured to work as a proxy to external services, failed attempts on its Etherpad, and hundreds of thousands of queries against the Wikidata Query Service, which likely caused a partial outage in May. CTPO Selena Deckelmann confirmed the incidents; none of the agents were approved bots. Matt's read: call it what it is, a DDoS. No model wakes up and decides to attack a wiki. "If you were allowed to escape a sandbox, it's because someone put a ladder there for you," and putting a brick on the accelerator and stepping out of the car is not a defense. Chris: what happens when open-weight models on home GPUs can do the same? Do agents end up needing license plates?• MonsterCloud's owner charged with selling "proprietary decryption" that was really paying the ransom. Prosecutors say Zohar Pinhasi (aka Zack Silver and Zack Green) negotiated with the same groups that hit his clients and bought the keys, paying more than $8 million and billing victims more than $19 million. In one case $8,200 to an affiliate became a ~$150,000 invoice. He faces wire fraud and wire fraud conspiracy charges. Matt: he was one honest sentence away from being a legitimate negotiator, so vet whoever you hire to negotiate.• Alleged ShinyHunters leader arrested in Jordan and cooperating with the FBI. SecurityWeek identifies him as Saif al-Din Khader ("Rey"), a teenager from Amman also tied to Scattered Lapsus$ Hunters, arrested shortly after the group defaced the FBI's recruitment site and claimed 2-3 TB of data. Dutch police separately arrested a 24-year-old in Amsterdam the FBI ties to attacks on 140+ organizations and at least $70 million in extortion; reporting names him as Pepijn van der Stap. Brian Krebs reports Khader put an Umbreon image on the defaced FBI site, van der Stap's old nickname, apparently to point investigators at him. Chris: don't poke the bear, and there's no honor among thieves. Stories covered:• https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/• https://www.darkreading.com/cyberattacks-data-breaches/openai-agent-escape-causes-wikimedia-service-outage• https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/• https://www.securityweek.com/alleged-shinyhunters-leader-arrested-in-jordan/ Chapters:0:00 Seasons change, and the cost of software goes to zero1:59 Home computers are going to be a target again2:38 "It's darkest before it goes pitch black"3:25 Citrix NetScaler pre-auth command injection (CVE-2026-88771)6:04 Forget the old Perl script, scrub your input7:00 If you're a defender: read the advisory and patch9:24 Please don't write blog posts like this9:50 OpenAI agents cause a Wikimedia outage13:16 What happens when everyone sends agents across the web?13:40 "ChatGPT launched a DDoS attack"16:58 No LLM ever woke up and decided to attack a wiki17:38 "Someone put a ladder there for you"18:19 When open-weight models can do this at home19:45 "My LLM went crazy" is not a defense20:15 A driver's license for the internet?20:52 MonsterCloud: ransomware recovery that just paid the ransom23:53 A middleman with an 18x markup26:17 Vet your negotiator26:44 Alleged ShinyHunters leader arrested in Jordan28:49 The Umbreon frame-up29:31 No honor among thieves32:08 Maybe biweekly is the way to do it The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly. Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieio Learn more about LimaCharlie: https://limacharlie.io #cybersecurity #infosec #ransomware #AIsecurity #threatintel

  3. Oct 1

    Securing AI agent identity and authority with Geoffrey Mattson [350]

    Today we're speaking with Geoffrey Mattson, CEO of SecureAuth, about identity and authority for AI agents: what changes when software stops being something a human uses and starts taking actions on its own. Geoffrey is a serial entrepreneur working at the intersection of cybersecurity and AI. Before SecureAuth he was CEO of Xage Security and co-founded MistNet.ai (acquired by LogRhythm), after product and engineering leadership roles at Juniper Networks, Huawei, Nortel and Bell Labs across Europe, Asia and the U.S. At SecureAuth he is focused on how organizations manage the identity, permissions and authority of autonomous agents. In this conversation: why an agent has the power of a software process with the unpredictability of a human, the difference between delegating authority and handing over your credentials, tightly scoped, time-bound tokens that get subdivided as work passes to sub-agents, the wild west of MCP servers, bringing shadow agents into the light, why guardrails can speed AI adoption up rather than slow it down, and what a solo attacker running a network of LLMs means for small and mid-sized businesses. Learn more at https://www.secureauth.com/ Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/ Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

  4. Sep 16

    Physical AI and self-learning machines with Dr. Amarjot Singh [348]

    Today we're speaking with Dr. Amarjot Singh, Founder & CEO of Skylark Labs, about physical AI — what changes when a model leaves the server and has to perceive, decide and act inside a machine that moves through the real world. Dr. Singh earned his PhD in artificial intelligence and deep learning from the University of Cambridge, and has worked as a research fellow at Stanford University and on DARPA research focused on artificial general intelligence. His work spans computer vision, self-learning AI, drones, humanoid robotics and autonomous systems, with more than 50 international journal and conference publications. At Skylark Labs he is focused on taking that research into real-world systems, including AI-powered drones, robotic platforms and technologies designed for defense and other mission-critical environments. In this conversation: why a bad prediction from a robot is a different problem than a hallucination from a chatbot, what an on-device AI stack actually looks like from sensors to action, learning from a single exposure at the edge and deliberately forgetting the rest, how one machine shares validated knowledge with the rest of a fleet, why hands and manipulation remain the hardest problem in robotics, what "reliable enough" means when failure has physical consequences, and where this all lands in ten years. Learn more at https://skylarklabs.ai/ Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/ Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

  5. Sep 11

    Intel Chat: Claude models reached real systems, an AI safety resignation & ShieldCrash [347]

    Intel Chat with Matt Bromiley and Chris Luft. • An Anthropic researcher quits over where the race is heading. Jacob Coxon, who trains models on large amounts of data, is leaving both Anthropic and the AI industry: he believes the leading labs are racing toward self-improving systems they may not be able to control, and that competition will push them there anyway. Matt's problem with the genre of exit: if the people who care most about safety walk out, walking out guarantees they have no say. And the big labs were never the whole threat, because anyone can pull down an open model with no guardrails tonight: "I can go get access to an unfettered model right now."• Four Claude models reached real third-party systems during cybersecurity evaluations. Anthropic's write-up: the evals were mistakenly connected to the public internet, the models were told they were in a simulation with no internet access, and they ran without the safeguards that ship in production. Two alignment failures are named, biased reasoning and recklessness, and a scan of ~481 million transcripts found nothing of similar or greater severity. Worst case: Claude Mythos 5 published a malicious package to the real PyPI during a CTF, it landed on 15 systems believed to be security scanners, one leaked credentials, and Claude used them to reach a security vendor's live database. Opus 4.7 knew its target was real but assumed it was authorized. METR is investigating. Matt's take: none of it is novel — "you and I have covered like 15 adversaries who have done that too" — it is hyper-automation of attacks we already understand.• OpenAI's Astra reaches the "Critical" cybersecurity tier — the top band of its Preparedness Framework, for consequential offensive work with minimal oversight. It scored 100% on ExploitBench, escaped a restricted browser sandbox, ran commands on the host, took root on a hardened OS, and chained small weaknesses into long-horizon campaigns. Cyber jailbreak refusals are 91.5% versus 59% for GPT-5.6 Sol, which still leaves 8.5%. Access is phased: vetted professionals, then the Daybreak Blue red-teaming program. Matt is unmoved — if a model took total root control of a "hardened" OS, then the definition of hardened needs revamping. The fortress was a bouncy castle.• ShieldCrash, a reminder that humans are still a threat. Nightmare-Eclipse released another Windows zero-day PoC they say bypasses Microsoft's September patch for an earlier Windows Defender flaw, in the Microsoft Malware Protection Engine, on all supported Windows versions. It follows CVE-2026-69414 (ShieldBreak), the August privilege-escalation bug Microsoft patched — the researcher says the fix missed a path to the same underlying issue, and has been dropping exploits around Patch Tuesday since April after a dispute with Microsoft over vulnerability reports. SOCRadar CISO Ensar Seker reads it as an arbitrary SYSTEM-context file read, not a full SYSTEM shell; Nightmare-Eclipse calls it full privilege escalation. Either way a SYSTEM-level read hands over configs and credentials for the next link in a chain, and repeated bypasses — RoguePlanet, ShieldBreak, now ShieldCrash — suggest a boundary that needs a redesign. Stories covered:• https://www.wsj.com/tech/ai/anthropic-researcher-quits-over-out-of-control-ai-fears-707b7628• https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents• https://socfortress.medium.com/openais-astra-reaches-critical-cybersecurity-capability-threshold-6a3b5f822e91• https://www.darkreading.com/vulnerabilities-threats/nightmare-eclipse-strikes-again-shieldcrash-windows-exploit Chapters:0:00 Are we at the start of the AI apocalypse?1:48 Every AI apocalypse movie, same premise4:10 The Matrix's original script: humans as memory5:14 An Anthropic researcher quits over out-of-control AI6:49 If you care about AI safety, why leave?11:03 "I can go get an unfettered model right now"12:18 Four Claude models reached real systems15:17 Agents that accept "permadeath" to finish the task16:39 None of it was novel — it was automation19:24 Stop asking how dangerous it is and go patch20:22 OpenAI's Astra crosses the "Critical" threshold23:24 If they got root, it was a bouncy castle25:51 Research articles, not imminent threats27:00 ShieldCrash: a scorned researcher vs Defender29:51 mimikatz, legal threats and the Streisand effect32:59 Waiting for the AI that cures a disease The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly. Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieio Learn more about LimaCharlie: https://limacharlie.io #cybersecurity #infosec #AIsecurity #threatintel #malware

  6. Sep 3

    Intel Chat: OpenAI's Astra hits Critical, DEF CON phishing, Philippine nuclear breach [346]

    Intel Chat with Matt Bromiley and Chris Luft. • OpenAI says Astra is the first of its models to reach the "Critical" cybersecurity capability level under its Preparedness Framework — the tier that means a model can independently find and exploit zero-days across well-defended systems, or run an end-to-end attack from a high-level instruction. Astra scored perfectly on ExploitBench, independently discovered two zero-days, escaped a browser sandbox, and chained flaws in a hardened OS to get root. It also refused 91.5% of cyber jailbreak attempts, versus 59% for GPT-5.6 Sol. Matt's take: every frontier model now seems benchmarked on offensive security, and the model with no governors on it is the one to worry about.• Post-DEF CON phishing aimed at security researchers. Huntress documented an actor who DM'd one of its researchers on X while impersonating a CoinDesk executive organizing a conference. The lure was a Google Doc carrying a malicious Apps Script sidebar, then ClickFix-style instructions — Atomic macOS Stealer (AMOS) for Mac users, fake Google updates and PowerShell for Windows. The Windows chain ended with NetSupport Manager as a RAT, a Ledger wallet implant, and a proxy that installed its own certificate authority and redirected VirusTotal lookups. Matt's read: they probably just bought a conference attendee list, and the write-up should become awareness training for everyone outside security.• A Philippine nuclear agency and a naval contractor breached through flaws that were already patched. Hunt.io found an attacker-controlled ownCloud server in Amsterdam holding ~1.2GB of files, after the operators exploited an ownCloud bug from 2023 and a WordPress caching plugin bug patched in 2024 that were both still exposed. The haul included a research reactor core-component database, fuel inventories, radiation safety documents, personnel records, BitLocker keys and credential stores. Hunt.io stopped short of attribution despite Chinese-language code comments. The twist Matt loves: for once it was the adversary who left a repository wide open, giving defenders a look at their tooling — Sliver, Metasploit, an embedded Meterpreter build.• Silver Fox counterfeit installers that switch off Windows Update. Microsoft tracked an active campaign using high-fidelity fake software-download sites aimed mainly at Chinese-speaking users and China-based operations of multinationals, with a payload whose hash changes on every download. It persists via scheduled tasks disguised as IT jobs, adds Defender exclusions from a SYSTEM task, deletes shadow copies, then stops update services, renames update DLLs and clears the Windows Update cache. And it still stages out of C:\Users\Public and C:\ProgramData — which sets Matt off on why those are still not no-go zones after 13 years, and why nobody has shipped the frontier model that just fixes the basics. Stories covered:• https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/• https://www.huntress.com/blog/defcon-phishing-google-doc-malware• https://www.darkreading.com/cyberattacks-data-breaches/old-unpatched-flaws-attackers-philippines-nuclear-agency• https://thehackernews.com/2026/09/fake-software-installers-disable.html Chapters:0:00 Matt checks in from Virginia Beach1:44 OpenAI's Astra crosses the "Critical" cyber threshold3:43 Every frontier model is now aimed at cybersecurity6:52 So where is the model with no governors on it?8:23 Post-DEF CON phishing targeting security researchers10:42 Did the adversary know who they were targeting?12:55 Turn the write-up into training for everyone else15:01 Philippine nuclear agency breached through old, patched flaws17:48 For once, the adversary left the door open21:26 Silver Fox: counterfeit installers that disable Windows Update24:00 Still C:\Users\Public, 13 years later25:42 Give us a frontier model that fixes the basics The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly. Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieio Learn more about LimaCharlie: https://limacharlie.io #cybersecurity #infosec #AIsecurity #threatintel #malware

  7. Aug 14

    Intel Chat: AI patches fail, LiteLLM supply chain, Claude eval incidents & DPRK npm [345]

    Intel Chat with Matt Bromiley and Chris Luft. • AI-generated patches fix vulnerabilities about half the time. 1Password's Off-By-1 team tested ChatGPT-5.5 and Opus 4.8 against six vulnerabilities: across 6,080 generated patches only 46% fixed the underlying flaw, and some that did were narrow enough to be bypassed. Separate Veracode research found a 56% security pass rate across 100+ models, with 44% of AI-generated code carrying detectable OWASP Top 10 issues. Matt's pushback: what is the HUMAN success rate for comparison, and why is nobody publishing that number?• LiteLLM supply chain attack. CloudSEK reports 2,500+ organizations and 434,000 CI/CD pipelines potentially exposed. LiteLLM was not the initial target: the compromise came in through Aqua Security's Trivy scanner and spread when LiteLLM's CI automatically installed it, ending with malicious versions 1.82.7 and 1.82.8 on PyPI. They were live for roughly 40 minutes, which automated dependency resolution and cached layers were more than enough to propagate.• Anthropic's models reached real systems during evaluations. Reviewing 141,006 evaluation runs, Anthropic found three incidents where Claude models gained unauthorized access to real organizations during capture-the-flag exercises, after a misunderstanding with an evaluation partner left the environments internet-connected. One model published a malicious package to the real PyPI, where it ran on 15 real systems. Matt argues this is a lab test rather than a threat report, and asks what defenders are supposed to do with it.• North Korea behind the npm compromises. Amazon Threat Intelligence links the typo-crypto, debug, chalk and axios incidents to the same DPRK actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA and BlueNoroff. Wiz found roughly one in ten cloud environments touched by the debug and chalk incident within two hours. The technique has shifted: malicious functionality is now split across several innocuous-looking packages that only do anything once combined, plus slopsquatting and prompt injection aimed at AI code scanners. Stories covered:• https://www.darkreading.com/application-security/ai-generated-patches-fail-half-time• https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/• https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals• https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/ Chapters:0:00 Back from Black Hat3:31 AI-generated patches fix vulnerabilities about half the time6:23 What is the human success rate?10:53 LiteLLM supply chain attack13:03 Pin your dependencies15:59 Anthropic models reached real systems during evals22:12 This is a lab test, not a threat report27:06 North Korea behind the debug, chalk and axios compromises30:59 Malware assembled from harmless-looking parts33:27 Clever people on the other side of the fence The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly. Subscribe wherever you listen:• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740• YouTube: https://www.youtube.com/@limacharlieio Learn more about LimaCharlie: https://limacharlie.io #cybersecurity #infosec #AIsecurity #supplychainsecurity #threatintel

  8. Aug 13

    Proving the value of security operations with Christopher Crowley [344]

    Today we're speaking with Christopher Crowley, cybersecurity consultant through Montance and Senior Instructor with the SANS Institute, about the value of cybersecurity operations — how to measure it, how to express it to the business, and how AI is changing the work of the SOC. Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operations centers. He is the author of the annual SANS SOC Survey, a security operations class called SOC-Class, and a new book entitled The Value of Cybersecurity Operations. He is a Senior Instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montance. His background also includes network operations, software development, mobile security assessment, and security policy. Learn more at https://montance.com and get the book at https://shop.montance.com Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/ Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

See All (352)

Trailer

5
out of 5
25 Ratings

About

An accessible but technical podcast about cybersecurity and the people who keep the internet safe. The podcast is built as a series of segments: we will be looking back at the last couple of weeks in cybersecurity news, talking to different people in the industry about areas of their expertise, we're going to break apart some of the TTPs being used by adversaries, and we will even cover a little bit of hacker history.

Information

You Might Also Like