STATUS: SECURE – The Cyber Threat Briefing

WatchUr6 - Cybersecurity
  • 5.0 (2)
  • Management

You cannot be secure if you do not know the threat. On the battlefield, the ability to communicate securely isn't a "nice to have"—it is the difference between life and death. In business, it is the difference between solvency and bankruptcy. Welcome to Status: Secure, the weekly cyber threat briefing for executives who refuse to operate in the blind. Hosted by the WatchUr6 collective, this show unites the battlefield with the boardroom. Featuring former Army Special Forces and Naval Special Warfare communications operators alongside an industry-leading CISO nominated for Cybersecurity Woman of the World. Each week, we decode the latest threats targeting Healthcare, Government Contracting, Finance, and Tech, and give you the tactical playbook to keep your lines open and your data secure. The enemy is listening. Is your status secure?

  1. 6d ago

    039 Laptop Farms, Infected Personal Devices, and BYOD vs Virtual Desktops in Healthcare

    Last month the FBI searched more than 40 houses in Texas and carried out roughly 187 laptops. Every one of them was issued by a company to somebody it believed it had hired. The machines were encrypted, patched, and enrolled in management. The people using them were in another country. In this episode we take apart the two failures that sit on either side of every remote worker. You control the hardware and cannot verify the human. Or you trust the human and have never seen the hardware. For a healthcare organization, the device in the middle is not just an endpoint. It is a workstation with a federal definition and safeguards attached to it, whoever paid for it. Intel Declassified in this Briefing: [00:32] 187 Laptops: What the FBI carried out of 40 Texas houses, and who was actually using them.[01:20] The DOJ Case: Fourteen charged, more than 70 US companies affected, and healthcare listed first among victim sectors.[02:49] Chain of Custody: Why shipping confirmation is not accountability, and what serialized comms equipment teaches about asset control.[03:47] The Reverse Failure: More than 10,000 infected machines studied, with roughly one in four users holding live corporate credentials.[06:21] The HIPAA Definition: Why a personal laptop handling patient information is a regulated workstation regardless of who bought it.[08:54] Four Models Ranked: BYOD, managed hardware, virtual desktops, and the browser-only option almost nobody prices.[11:11] The Classification Collision: When supplying the laptop starts looking like evidence of employment.[22:40] Three Marching Orders: Inventory, risk analysis by role, and the configuration step most organizations skip.Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/039-laptop-farms-byod-virtual-desktops-healthcare/Read the Associated Sitrep: BYOD, Managed Device, or Virtual Desktop? What's Right for Your 1099 Contractors Under HIPAA: https://watchur6.com/sitrep/compliance-protocols/1099-contractor-laptop-hipaa/

  2. Oct 27

    038 Exploited Software Tools, the 26% Patch Rate, and the SPRS Score That Cost $507,144

    Last week CISA told organizations to patch a tool whose entire job is privileged remote access. The vendor had already shipped the fix. The companies that got compromised were the ones who never turned the updates on. In this episode we work through why that keeps happening. Not because anyone was careless, but because the reasons organizations delay updates are mostly reasonable and the reasons nobody reviews a configuration are almost entirely structural. Then we get to the part that should concern every defense contractor listening: the score you posted to the federal government describes systems you may not actually be running anymore. By the end you will know the difference between owning a security tool and operating one. Intel Declassified in this Briefing: [01:15] The Tool Whose Entire Job Is Privileged Access: A CVE published October 15, an unauthenticated attacker needing no user interaction, and two compromises tracing back to August 29.[03:10] Attackers Read the Same List You Do: Every CVE is public the moment it posts, and the people exploiting it know most companies are not watching.[04:55] Security Patches Versus Bug Fixes: The distinction most owners have never had explained, and why never-be-first-to-update is the right instinct applied to the wrong category.[06:11] Criticals Now, Mediums at the Window: A workable patch policy, the reboot objection, and why patching production first is never the answer.[09:26] Automating It: Most products separate automatic security updates from feature updates, which means you can take one without the other.[11:34] Nobody Ever Reads the Defaults: A vendor cannot know your environment, so what they ship is the minimum, and almost nobody goes back to tailor it.[13:26] The Total Cost of Ownership: You bought it, installed it, and let it sit in the corner doing its thing. The purchase price was never the whole cost.[15:45] What Your SPRS Score Attests To: For a government contractor this stops being best practice and becomes a legal statement the federal government relies on.[18:02] Pull Your Score and Find Its Date: If a consultant calculated it three years ago, you found the problem. How to re-score honestly, and which requirements move the number most.[23:02] Physician Heal Thyself and Three Marching Orders: Why security teams break their own rules, then the three checks to run with your team this week.Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/038-exploited-software-tools-sprs-score/Read the Associated Sitrep: You May Have Security Vulnerabilities Due to MisconfiguredBusiness Applications - 3 Fixes You Can Implement Today: https://watchur6.com/sitrep/compliance-protocols/misconfigured-business-applications/

  3. Oct 20

    037 The AWS Outage, Azure's 18 Regions, and the Vendor Dependency Nobody Mapped

    This week we are covering the third one nobody plans for: if your vendor stops, you stop. In May, a cooling system failed in one building in Northern Virginia. Coinbase went dark for about seven hours. FanDuel went offline in the middle of an NBA playoff game. Five months later, Microsoft lost gateway networking across eighteen Azure regions. No ransomware. No stolen credentials. No attacker at all. Just a cooling system, a maintenance process, and thousands of businesses that had a day they had no control over. Most executives run a vendor security program and have never built a vendor dependency program. Those are two different questions about the same vendor, and only one of them has an owner. Intel Declassified in this Briefing: [01:21] A Cooling Failure Took Down Coinbase: May 7, one availability zone past safe limits, and the environmental control working exactly as designed.[03:38] What a Service Credit Actually Covers: Roughly 10% of the affected compute bill. It refunds part of your hosting and does not touch a dollar of lost revenue.[04:21] Azure's Bad Week: Six hours of AI service failures in Sweden Central, then gateway networking down across 18 regions on three continents.[10:14] Dependency Is Not Security: Can this vendor lose my data, versus can this vendor stop my business. Why only one of those has a questionnaire.[12:57] The White-Label Problem: If your core product is built on somebody else's application, they can raise prices 200% or disappear, and you get no vote.[17:14] The Spider Web: Follow any thread inward and it leads to one very large provider. Why a diversified stack can be a single point of failure.[19:16] The PACE Plan: Primary, Alternate, Contingency, Emergency. The Special Forces communications structure applied to your vendors.[21:58] Marching Orders: The critical vendor inventory, risk quantification including backlog cost, and a live exercise against one vendor.Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/037-aws-outage-azure-vendor-dependency/ Read the Associated Sitrep: The Vendor PACE Plan - What Happens When Your Biggest Vendor Goes Down: https://watchur6.com/sitrep/mission-resilience/vendor-pace-plan/

  4. Oct 13

    036 Match Group Breached: How 10 Million Records Left a Marketing Platform, Not the Product

    Ten million records walked out of Match Group this year, and the attacker never touched the product. Not Tinder's database. Not Hinge's. The data came out of a marketing analytics tool. This week we walk the full chain: the vishing call, the lookalike domain, the Okta single sign-on credential, and the third-party platform that turned one compromised identity into the largest consumer dating breach of the year. Then we get into the part that should worry every founder listening. Your product can be secure, your database locked down, your engineers flawless — and the breach still happens inside a tool your marketing team bought with a company credit card. We cover who owns that, what it costs, and why the default configuration on almost every analytics platform is set to collect the maximum. Intel Declassified in this Briefing: [01:04] The Target Was Never the Product: ShinyHunters went after single sign-on accounts at Okta, Microsoft, and Google — and the same campaign window named Bumble, Panera Bread, and CrunchBase.[01:52] One Changed Character: The matchinternal.com lookalike domain, and why verifying it would have taken under a minute.[03:17] What One Credential Opened: AppsFlyer marketing analytics, plus Google Drive and Dropbox. 1.7 GB and roughly 10 million records.[05:01] A Limited Amount of User Data: Our CISO breaks down what that phrasing is actually doing.[07:00] The Account You Forgot About: Why these platforms delete nothing, and why your 1990s contact information is still social engineering fuel.[10:39] Why Large Companies Accept This Risk: A nine-figure fine is a line item at scale. For a small company, this breach ends the business.[14:16] The Default Is Give Us Everything: Over-permissioning explained, including the Google Analytics setting almost nobody has reviewed.[17:17] When Nobody Regulates You: Class actions, state attorneys general, the FTC, and the CCPA's $100 to $750 per consumer.[22:07] The Marching Orders: Know where your data is, audit what single sign-on opens, and send the minimum — then check that a software update did not reset it.Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/036-match-group-breach-marketing-platform/Read the Associated Sitrep: Over-Permissioned Apps - Do You Know What Your Third Parties Can See: https://watchur6.com/sitrep/compliance-protocols/over-permissioned-third-party-apps/

  5. Oct 6

    035 Coca-Cola's Fairlife Ransomware, Nike's 1.4TB Leak, and the Rise of Extortion Without Encryption

    One attack stopped milk production at four plants. The other took 1.4 terabytes out of Nike and never encrypted a single file. This week we break down two of the biggest cyber events of 2026, and they failed in completely opposite directions. Coca-Cola's fairlife subsidiary lost its production systems to the Anubis ransomware group and chose not to negotiate. Nike lost product designs, supplier lists, and pricing to WorldLeaks — a group that has largely abandoned encryption entirely, because there is nothing to restore when nothing was locked. What connects them is uncomfortable. In both cases, what got taken was not what the security program was pointed at. Intel Declassified in this Briefing: [01:03] The Bottling Line: Why compromising manufacturing control systems is a different kind of attack than a records breach.[04:12] Pay or Don't Pay: The calculation behind Coca-Cola's decision not to negotiate, and the eleven days to resumed production.[05:37] Why Canada Kept Running: Network isolation as the difference between a regional outage and a continental one.[07:31] What Did They Steal Then: Our CISO's unfiltered reaction to Nike's statement that no personal data was involved.[09:21] Nothing to Restore: Why your backup strategy is irrelevant against extortion without encryption.[12:23] 241 Days: The average dwell time, and why moving terabytes is months of quiet work through a third-party supplier.[14:28] Crown Jewels: Why most companies secure what the auditor asks about instead of what would actually hurt to lose.[17:14] Materiality: If you don't define it, the regulator will — and their definition will not be generous. Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/035-fairlife-ransomware-nike-leak-extortion-without-encryption/Read the Associated Sitrep: Extortion Without Encryption - The Tabletop Your Ransomware Plan Is Missing: https://watchur6.com/sitrep/mission-resilience/extortion-without-encryption-tabletop/

  6. Sep 29

    034 Physical Security: Badge Cloning, USB Drop Attacks, and HIPAA Physical Safeguards

    A cloned badge gets somebody through the door. An unlocked laptop gets them onto the network. Not one cyber control has to be defeated for that to happen. This week we go the other direction from our usual briefing. Your security awareness training covers phishing and passwords and says nothing about the card hanging around your neck — and that gap is structural, because physical security and cyber security have always lived in different departments. We cover what a badge broadcasts when it leaves the building, how little it costs to clone one, what an attacker does in the twenty minutes after they walk in, and the section of the HIPAA Security Rule most healthcare organizations have never read. Intel Declassified in this Briefing: [01:06] The Training Gap: Why physical security belongs to facilities, and why that means nobody covers it.[03:32] Cloned in Seconds: The reader is on Amazon, MIFARE Classic has been broken since 2008, and one active badge per person is the control that catches it.[05:20] Walking In Beats Breaking In: Why a targeted attacker prefers the front door.[08:28] After Remote Work: How badly the screen-lock habit degraded, and what people leave sitting on their desks.[11:59] The Mailed USB: The FBI warning on FIN7 impersonating HHS and Amazon, and the 2026 pairing of planted devices with fake help desk calls.[16:15] The Parking Lot: A stranger didn't question a man breaking into a car. He offered to help.[20:04] HIPAA Physical Safeguards: Facility access controls, contingency operations, workstation use, and device disposal.[26:43] The Risk You Cannot Transfer: Encryption, badge reconciliation, and why outsourcing your guards does not outsource accountability.Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/034-physical-security-badge-cloning-usb-drop-attacks/Read the Associated Sitrep: Physical Security Awareness Training That Actually Changes Behavior: https://watchur6.com/sitrep/mission-resilience/physical-security-awareness-training/

  7. Sep 22

    033 The Race for an AI Governance Framework: ISO 42001, NIST AI RMF, and How to Choose

    The board wants AI controls. Procurement is writing AI clauses into contracts. And inside most organizations, nobody is sure which framework to commit to. This week we lay out what is actually on the table. ISO 42001, the NIST AI Risk Management Framework, COBIT and the ISACA credentials, and GRAICE — the Global Responsible AI Compliance and Ethics framework from the Global Council for Responsible AI, which our CISO has been working with directly. But the most useful answer in this episode is that the framework is not where you start. You cannot put a standard around something you have not found, and most organizations have no idea how much AI is already running inside software they already bought. Intel Declassified in this Briefing: [01:18] Pressure From Four Directions: The board, the customers, procurement, and the state AI disclosure rules now appearing in contract language.[04:38] ISO 42001: The first AI management system standard, why the ISO 27001 alignment makes it a building block, and why it is the one showing up in contracts.[07:03] NIST AI RMF: Govern, Map, Measure, Manage. Not a certification, and why that still matters for anyone who has never run a risk program.[08:52] COBIT and the ISACA Credentials: Why you cannot adopt COBIT for AI, and how AAISM, AAIA, and AAIR map onto the roles you already have.[11:11] GRAICE: The meta-framework that maps the others together and covers the one thing none of them do — ethics, and the human who has to hold that line.[13:05] Don't Start With the Framework: Inventory, accountable owner, risk register. In that order.[17:58] What Happens When You Just Turn Copilot On: A person can only see so much data. AI sees all of it at once.[23:02] The Marching Orders: Three moves, and why training comes before access. Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/033-the-race-for-an-ai-governance-framework/Read the Associated Sitrep: AI Governance Frameworks You Can Implement Today: https://watchur6.com/sitrep/compliance-protocols/ai-governance-frameworks/

  8. Sep 15

    032 McKesson Breached: Voice Phishing, Social Engineering, and Vendor Liability

    No malware. No exploit. No vulnerability to patch. The attackers picked up a phone — and vishing, or voice phishing, walked them straight through single sign-on and into a terabyte of healthcare data. On August 28th, McKesson filed a Form 8-K with the SEC disclosing a cybersecurity incident discovered on August 25th. Then the extortion group ShinyHunters told BleepingComputer how they did it. They called the service desk, impersonated employees, and were given credentials. This week we go one subject all the way down. Because if McKesson is one of your vendors, the liability for that breach is now partly yours — and thousands of healthcare organizations that were never attacked at all will spend the next year notifying patients about it. Intel Declassified in this Briefing: [01:15] The Human Factor: Why our CISO wasn't surprised, and how every breach report has started to read identically.[03:28] One Login, Every System: What single sign-on actually opens, and why the attacker only had to find one account.[05:34] The Bank Comparison: Your bank asks five questions before discussing your account. Your help desk assumes you work there.[08:02] Records Are Not Patients: Why 284 million is being reported wrong, and how the 500-individual threshold decides what you owe.[11:06] The Clock You Inherit: What happens downstream when your Business Associate is breached, and whose name goes on the patient letter.[13:20] The Telephone Game: Health-ISAC warned about this exact playbook. Why the warning never reached the boardroom.[15:46] Pen Test Your Help Desk: The one test that would have caught this, and why organizations refuse to run it.[19:54] If You're Smaller Than McKesson: Why bots and AI mean small is no longer overlooked, and the one low-cost control to start with. Mission Links: Verify your Security Posture: https://watchur6.com/secureWant to Hire us: https://watchur6.com/contact/View the Show Notes: https://watchur6.com/podcast/032-mckesson-breached-voice-phishing-social-engineering-vendor-liability/Read the Associated Sitrep: Help Desk Social Engineering - How to Build a Verification Protocol That Holds: https://watchur6.com/sitrep/threat-intelligence/help-desk-social-engineering/

See All (39)

Ratings & Reviews

5
out of 5
2 Ratings

About

You cannot be secure if you do not know the threat. On the battlefield, the ability to communicate securely isn't a "nice to have"—it is the difference between life and death. In business, it is the difference between solvency and bankruptcy. Welcome to Status: Secure, the weekly cyber threat briefing for executives who refuse to operate in the blind. Hosted by the WatchUr6 collective, this show unites the battlefield with the boardroom. Featuring former Army Special Forces and Naval Special Warfare communications operators alongside an industry-leading CISO nominated for Cybersecurity Woman of the World. Each week, we decode the latest threats targeting Healthcare, Government Contracting, Finance, and Tech, and give you the tactical playbook to keep your lines open and your data secure. The enemy is listening. Is your status secure?

Information