The Art of Security

Fortra
  • 5.0 (4)
  • Technology
  • Updated Biweekly

Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries. In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape. While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment. Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.

  1. 2d ago

    Security Theater: Feeling Safe vs. Being Secure

    What happens when cybersecurity programs prioritize visible activity over meaningful risk reduction? Security theater can reassure executives and end users, but that reassurance becomes dangerous when dashboards, checkbox compliance, and inflated metrics distract teams from the controls that actually reduce exposure. In this episode of The Art of Security, Josh Davies and Tyler Reguly examine the line between communicating security effectively and merely performing it. They challenge conventional thinking about security metrics, product marketing, threat hype, compliance, and the pressure to make security programs look productive. Key takeaways Why activity metrics such as alerts triaged, vulnerabilities patched, and detections created may not reflect improved security How threat hype and named vulnerabilities can redirect limited resources away from higher-priority risk Why security visibility and clearly assigned asset ownership provide a stronger foundation for meaningful measurement How security teams can demonstrate control effectiveness without relying on checkbox compliance or misleading ROI calculations Security should create confidence because controls are validated, assets are monitored, and responsibilities are clear, not because a dashboard looks impressive. 👍 Like the video if the discussion challenged how you measure security 💬 Tell us which cybersecurity metrics your team finds genuinely useful 🔔 Subscribe for practical conversations with cybersecurity practitioners and researchers

  2. Sep 2

    CalPhishing: When Calendar Invites Become the Lure

    Calendar invites have become part of the trusted infrastructure of daily life, and attackers are taking advantage. In this episode, the team examines the resurgence of CalPhishing, an attack technique that uses legitimate calendar workflows, HTML content, attachments, spoofed organizers, and trusted platforms to evade defenses and compromise accounts. Fortra security engineer and FIRE team member Daud Jawad joins hosts Josh Davies and Tyler Reguly to break down the calendar phishing techniques reaching users today. They explore why these attacks can bypass traditional email security controls, how trusted workflows lower users' defenses, and why organizations may need to reconsider how they process and test calendar invitations. Key takeaways How attackers use calendar invite bodies, HTML attachments, spoofed organizers, and legitimate vendor infrastructure to deliver phishing lures Why CalPhishing can evade email authentication, filtering, browser protections, and other established security controls How calendar-based attacks can target credentials, session tokens, OAuth consent, device codes, and trusted internal workflows How organizations can reduce exposure through calendar processing controls, user education, cross-channel verification, and calendar-based phishing simulations Read Daud's related blog on Fortra.com Don't let the next threat sneak onto your calendar. Subscribe to The Art of Security podcast.

  3. Aug 19

    AI-Powered Red Teaming: Where Automation Works and Where It Falls Short

    AI can accelerate red team operations, but how much autonomy is too much when production systems and sensitive data are at stake? In Episode 13 of The Art of Security, co-host Josh Davies speaks with Pieter Ceelen of Fortra's Outflank and Cobalt Strike red teams about the opportunities and risks surrounding AI-powered red teaming. They examine where AI can strengthen adversary simulation, why fully autonomous testing demands caution, and how rules of engagement must evolve as AI becomes part of offensive security operations. The conversation explores: Where AI can support reconnaissance, vulnerability research, initial access, reporting, and post-exploitation analysis Why human oversight remains critical in sensitive and production environments How red teams can balance automation, operational risk, and potential reward Whether AI will change the skills needed by the next generation of penetration testers How AI could reshape vulnerability discovery, zero-day research, and the ongoing contest between attackers and defenders Listen to the full episode for a practical perspective on using AI to advance red team operations without losing sight of judgment, accountability, or risk.

  4. Aug 5

    Lights, Camera, Cyberattack: What Hollywood Gets Right and Wrong About Hacking

    Hollywood can turn a cyberattack into glowing graphics, frantic typing, and total system control in seconds. But beneath the technical nonsense, hacker movies sometimes capture something real about cybersecurity. In this episode of The Art of Security, co-hosts Josh Davies and Tyler Reguly revisit hacker movies and shows including Hackers, WarGames, Sneakers, Mr. Robot, The Matrix Reloaded, and more. They examine what Hollywood gets right, what it gets spectacularly wrong, and the real-world security lessons hiding behind the drama. The conversation explores: Why Hackers remains a cybersecurity cult classic Whether hackers can really control traffic lights and broadcasts How real security tools and techniques appear on screen Why fictional hackers have inspired generations of practitioners Are hacker movies helping audiences understand cybersecurity, or have they been teaching us the wrong lessons all along? Listen now, then tell us: Which hacker movie gets cybersecurity right, and which one gets it completely wrong? Make sure to subscribe now so you don't miss any episodes!

  5. Jul 22

    AI Governance in Action: How to Secure AI Without Slowing Innovation

    Your AI has access. But does It have too much? AI can help organizations move faster, automate work, and unlock new opportunities. But when AI systems can access sensitive data, connect to business tools, or take actions on a user's behalf, governance becomes an operational security priority. In this episode of The Art of Security, co-host Josh Davies speaks with Gina Cardelli, Principal Security Strategist at Fortra, about how organizations can adopt AI without losing visibility or control. They examine what recent AI security incidents can teach businesses about excessive permissions, exposed infrastructure, third-party tools, shadow AI, and the risks of moving too quickly. Gina also explains how threat modeling, continuous monitoring, least privilege, and cross-functional AI councils can help organizations understand an AI system's potential blast radius and manage risk as its capabilities evolve. Listen to learn: Why AI governance cannot be treated as a one-time policy exercise How to threat model AI use cases before deployment Why continuous monitoring is essential for AI systems and agents How third-party AI tools can introduce data and supply chain risks What organizations can do about shadow AI Why many AI security failures still begin with familiar vulnerabilities How to introduce practical controls without bringing AI innovation to a halt AI governance doesn't have to be perfect on day one. But organizations need to understand how AI is being used, what it can access, and what could happen if something goes wrong. AI security is evolving quickly. Subscribe to The Art of Security for more conversations that help you keep pace.

  6. Jul 8

    Not Curious? Cybersecurity Isn't the Career for You — A Student's Honest Take

    Is cybersecurity really facing a skills shortage or are businesses just unwilling to train the next generation? In episode 10 of The Art of Security, Josh Davies and Tyler Reguly are joined by Dema Gorkun, cybersecurity student at MacEwan University, leader of the Student Ethical Hacking Club, and OWASP collaborator. Dema shares a candid student's-eye view of what today's cybersecurity education gets right, where it falls short, and how curiosity, home labs, and community involvement matter more than any resume. From vibe coding pitfalls to phishing projects that triggered emergency CEO meetings, this conversation explores the future of cybersecurity talent — and how to stand out in an AI-driven hiring landscape. Whether you're a student, a hiring manager, or a seasoned practitioner wondering how to mentor the next wave of talent, this episode offers a refreshing, unfiltered look at how we create the security artists of the future. 🎧 Don't miss an episode — subscribe to The Art of Security today

  7. Jul 1 ·  Bonus Video

    What Canada's Bill C-8 Means for Cybersecurity

    Canada's Bill C-8 has received Royal Assent. But what does that actually mean for cybersecurity teams, critical infrastructure operators, telecommunications providers, and vendors selling into Canadian organizations? In this bonus episode of The Art of Security, Brent Arnold of INQ Law about the impact of Bill C-8, also known as An Act Respecting Cyber Security. They discuss the law's focus on telecommunications security, critical cyber systems, minimum cybersecurity requirements, incident preparedness, and the growing importance of supply chain risk. This bonus conversation follows episode 9, After the Breach: Ransomware, Data Loss, and the Legal Fallout. Subscribe to The Art of Security so you don't miss future episodes on cybersecurity, data breaches, legal risk, and incident response.

  8. Jun 24

    After the Breach: Ransomware, Data Loss, and the Legal Fallout

    What really happens after a data breach? In this episode of The Art of Security, hosts Josh Davies and Tyler Reguly are joined by Brent Arnold of INQ Law to unpack the legal, operational, and business fallout that follows a breach. From ransomware negotiations and breach reporting obligations to data loss, regulatory risk, and recovery planning, Brent shares what organizations need to know when a cyber incident becomes a legal crisis. The conversation also explores why preparation matters, how process failures often matter as much as technical ones, and why knowing where your sensitive data lives is critical before an incident happens. If you work in cybersecurity, risk, compliance, or business leadership, this episode offers a practical look at what comes next when data is exposed, stolen, or held hostage. Listen now for practical insights on ransomware response, legal risk, and recovery.

See All (21)

Trailers

5
out of 5
4 Ratings

About

Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries. In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape. While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment. Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.

Information

  • Creator
    Fortra
  • Years Active
    2026
  • Episodes
    21
  • Rating
    Clean
  • Copyright
    © 2026
  • Show Website
    The Art of Security

You Might Also Like