Alle afleveringen

42 afleveringen, van nieuw naar oud

Human Resilience with James McQuiggan

26 oktober 2026 · 35 min
Afspelen

In this episode of the Security by Default Podcast, recorded at the tail end of Cybersecurity Awareness Month, host Joe Carson welcomes James McQuiggan, a cybersecurity professional with more than 25 years in IT and security. Lees meer

James traces his path from Windows 98 tech support to 18 years at Siemens, where he found his real passion: educating people about cyber risk, from grade-school kids to grandparents. That passion led him to university teaching in cyber threat intelligence and six years at a large security awareness training company.

Then came a one-on-one meeting that turned out to be his director and HR. In about eight minutes, his role was gone. James and Joe, who went through his own redundancy and garden leave, compare notes on the shock, the grief that follows, and the slow road back.

James explains how he turned the experience into a talk that maps job loss onto incident response: preparation, containment, recovery and lessons learned, plus threat intelligence on your own options. He covers the practical first steps — finances, healthcare and insurance and why within the first week he spoke to around a dozen people in his network.

The conversation also covers why your next role will most likely come from your peers rather than job bulletins, how speaking about the experience became James's therapy, and how he stays current through deepfake research, the Simply Cyber community and conferences. They close on humor, with James's new joke book, A Megabyte of Jokes, co-written with Mishaal Khan.

In this episode:

Why losing a job can feel like the end of a six-year relationship

The stages of grief after redundancy, and why they aren't linear

Applying incident response and threat intelligence to your career

The first 72 hours: finances, healthcare, and calling your network

Why referrals beat ATS and AI resume filters

Turning a hard experience into a talk that helps others

Staying current on AI and deepfakes

Why humor builds connection in the securi…
Same Scams, Cleaner Wrapper: Cybersecurity Awareness Month in the AI Era with Erich Kron

12 oktober 2026 · 38 min
Afspelen

It's Cybersecurity Awareness Month, and Joe Carson is joined by Erich Kron of KnowBe4 to ask whether the classic messages — strong passwords, phishing awareness, MFA, and patching — still hold up. Spoiler: they do, but attackers have upgraded the wrapper. Erich explains why users should ignore deepfake "tells" and focus on emotion, urgency and the request itself, how phishing has moved into Teams, WhatsApp and SMS, and why agentic AI is exploding the number of non-human identities we already struggle to manage. They also cover email bombing, MFA fatigue, mitigation before patches, deepfakes in the courtroom, and the shift from ransomware encryption to data extortion. Lees meer

Takeaways:

I assert that classic measures — strong passwords, MFA, phishing awareness, and patching — remain essential against modern threats.

We must focus on emotion, urgency, and the specific request rather than deepfake technical tells.

I warn that phishing now spreads through Teams, WhatsApp, SMS, and other chat channels, bypassing email defenses.

We see attackers using email bombing and MFA fatigue to overwhelm users and force mistaken approvals.

I recommend rapid mitigation steps before vendor patches arrive, and maintain accurate inventory and segmentation of assets.

We note that agentic AI and non human identities multiply attack surfaces and complicate identity and permission management.

I emphasize that extortion of stolen data has eclipsed encryption based ransomware as the primary profit method for attackers.

Erich Kron — Security Awareness Advocate, KnowBe4

Erich Kron has worked in IT and security since the 1990s, when his first network ran Windows 3.1 and LANtastic. He has worked across healthcare and manufacturing, and spent around ten years with the US Department of Defense as security manager for the Second Regional Cyber Center, where he served as an Active Directory domain admin during the Army's AD deployment and supported network infrastructure across North America. He l…
Passwords, Passkeys & Rogue AI Agents | Credentials in the Age of AI with Evil Mog

28 september 2026 · 39 min
Afspelen

We assert that agentic AI constitutes a profound and immediate threat to passwords, passkeys, and credential stewardship when such agents are afforded unfettered operational or contractual authority without deterministic guardrails. I describe, with technical specificity, how agents that hold passkeys or password-manager access can act autonomously to transact, alter accounts, or execute legally binding operations, and we categorize those risks into task-level, operational, and contractual modes of delegation. We argue that the remediation imperative involves explicit delegation models, ephemeral and auditable identities, and cryptographic assertions that bind an agent’s scope of action to a human owner. I counsel continued adoption of hardened password practices and password managers, combined with resilient offline backups and dual-control or deterministic controls layered atop probabilistic AI systems. We further insist that security-by-default, mandatory auditability, and standards for AI skill and supply-chain review are prerequisites to any safe integration of AI with authentication systems. Finally, I exhort practitioners to prioritize availability, integrity, and accountability alongside confidentiality so that credential resilience endures in an era of accelerating AI capability. We offer clear, practical guidance for individuals and organizations to protect credentials in the age of AI. I recommend using a zero-knowledge password manager and enabling secure backups. Evil Mog affirms that printed or offline copies of critical credentials are valid resilience measures when they are managed and backed up properly. We advise random and unique passwords of appropriate length, routine backups of vaults, and giving trusted delegates access via documented procedures rather than ad hoc sharing. For family and estate planning, we explain how offline copies or delegated access can help manage accounts after death. We also recommend operational controls when using ag… Lees meer
When a Simple Breach Became a Crisis: Lessons We Learned | Lukas Hlavicka

14 september 2026 · 32 min
Afspelen

I discuss with Lukas Hlavicka how ordinary security incidents can escalate into full-blown crises when organizations lack preparation, reliable backups, and secure deployment pipelines. We share stark war stories, from backups that were never actually taken to compromised software deployment systems and a ransomware attack that exposed six months of bank fraud. Lukas draws on over a decade of incident response experience, including leadership of a national CSIRT and work in the private sector. We describe common failure points: unknown assets and third‑party links, intertwined IT and OT systems, missing evidence, unclear roles for decision and containment, and compromised CI/CD. We stress clear, practical steps: maintain offline incident plans and backups, map assets and dependencies, secure and monitor deployment pipelines, and practice response with defined authorities. This episode targets any organization that thinks “it won’t happen to us” and seeks concrete lessons to prevent incidents from becoming crises. Lees meer

Takeaways:

I learned that many incidents become crises because organizations do not know what assets they own or how they connect to third parties.

We must keep offline backups and verify that backups are actually taken and restorable before incidents occur.

I saw attackers abuse cloud managed security products and deployment pipelines to gain full network access quickly.

We found that unclear roles and slow approval processes delay containment and allow the attacker to spread further.

I observed that organizations often destroy evidence or change systems in ways that hinder forensic investigations.

We recommend practicing incident response, keeping plans offline, and retaining institutional memory to avoid repeating past mistakes.

I noted cases where ransomware accidentally revealed long running fraud and showed the need to follow financial trails in investigations.

We must monitor CI/CD and software supply chains continuously because compromise …
From Legacy to Modern PAM: A Migration Playbook with Erik Siebler

31 augustus 2026 · 48 min
Afspelen

Navigating the intricate landscape of identity security has evolved dramatically over the past two decades. Once characterized by a mere username and password, the contemporary environment demands that employees manage an astonishing array of digital identities—approximately one hundred per individual, not accounting for the emerging complexities introduced by agentic AI. Lees meer

Joe Carson engages Erik Siebler, a seasoned professional with fifteen years of experience in Identity Governance Administration (IGA), Privileged Access Management (PAM), and authentication, to unravel the concept of 'legacy' within identity security. They delve into the defining attributes of legacy PAM systems, which are inherently infrastructure-bound, protocol-heavy, and tailored for a bygone era dominated by servers and routers. Erik elucidates the common pitfalls organizations encounter, particularly the tendency to misinterpret modern PAM solutions as mere expensive password managers, thus neglecting the essential integration of security into existing workflows to achieve frictionless access.

As the dialogue progresses, the focus shifts to the forefront of the identity security discussion: agentic AI. Erik articulates a nascent failure pattern in which one AI agent, denied access, may exploit another to circumvent restrictions, thereby complicating the landscape of privileged escalation. This new paradigm necessitates a reassessment of traditional security measures, as privilege escalation becomes increasingly relevant not only to attackers but also to the automated processes within organizations. The episode culminates in a practical migration playbook, emphasizing the importance of product selection, side-by-side rollouts, and key-user engagement, ultimately aiming to equip listeners with actionable insights for effectively transitioning from legacy PAM solutions to modern frameworks.

Takeaways:

The evolution of identity management has transitioned from simple usernames and passwords …
Navigating the Convergence of Physical Security and Digital Access | Daniel Raines

17 augustus 2026 · 30 min
Afspelen

Daniel Raines, a luminary in the realm of electronic security, shares his extensive journey through the intricate landscape of physical security and digital access. With three decades of experience, he has transitioned from hands-on installation of access control systems to software development, addressing vulnerabilities and enhancing security measures. Our discourse delves into the convergence of physical and digital security, exploring the nuances of vulnerability disclosure and the industry's response to emerging threats. Raines elucidates the complexities of hard-coded encryption keys and the imperative for robust security practices, particularly as the industry shifts towards mobile credentials and biometric solutions. This episode serves as a profound exploration of security's evolving nature, emphasizing the significance of adapting to technological advancements and fostering a culture of continuous learning and improvement. Lees meer

Daniel Raines' extensive career within the electronic security industry, spanning over three decades, serves as a testament to the evolving landscape of physical security and digital access. Initially immersed in the practical aspects of the field, Raines dedicated the first fifteen years to the installation of physical access control systems, including surveillance cameras and biometric solutions. However, he subsequently transitioned into software development, focusing on creating robust systems for access control and security research. This shift was catalyzed by his encounters with software vulnerabilities, which sparked a deep dive into ethical hacking and vulnerability disclosure. Raines' narrative illustrates not only his personal journey but also the critical intersection of physical and digital security, emphasizing the need for improved practices in vulnerability reporting and response within the industry.

The discussion between Daniel and the host, Joseph Carson, delves into the intricacies of vulnerability disclosure in th…
L0pht Legend Chris Wysopal on the Evolution of Application Security

3 augustus 2026 · 52 min
Afspelen

Chris Wysopal, a distinguished figure in the realm of cybersecurity and a celebrated L0pht legend, engages in a profound dialogue with Joe Carson, delving into his remarkable journey from scavenging for Unix manuals to pioneering modern application security. Central to the discussion is the evolution of application security practices, particularly as they pertain to the emergence of artificial intelligence in coding. Wysopal recounts the storied ascent of the L0pht, traversing through pivotal roles at @stake and Symantec, ultimately culminating in the establishment of Veracode. The episode further explores the implications of AI-generated code on security, shedding light on the challenges and opportunities that this technological advancement presents for the cybersecurity landscape today. Listeners are invited to glean insights from Wysopal's extensive experience, which not only reflects on the past but also poses critical questions about the future of cybersecurity practices in an increasingly automated world. Chris Wysopal, a luminary in the realm of cybersecurity, recounts his remarkable journey from the nascent days of hacking to the forefront of application security. He shares anecdotes of his early experiences, such as dumpster diving for Unix manuals and the camaraderie fostered within the L0pht, a hacker collective that became a beacon of innovation and activism in the 1990s. Wysopal's narrative is interspersed with reflections on the evolution of cybersecurity and the societal implications of technology, particularly as he transitioned from the L0pht to @stake and subsequently co-founding Veracode. The conversation delves into the intricacies of application security, the challenges posed by AI-generated code, and the pressing need for a paradigm shift in how security is integrated into the software development lifecycle. This episode is a compelling exploration of Wysopal's contributions to the field and his insights into the future of cybersecurity in an … Lees meer
Ransomware Unmasked: Inside the World's Biggest Cybercrime Gang | Geoff White

20 juli 2026 · 39 min
Afspelen

The discourse surrounding ransomware takes center stage as we engage with investigative journalist Geoff White, whose extensive research delves into the notorious Conti Ransomware gang. This episode elucidates the profound implications of ransomware attacks, which have escalated beyond mere data encryption to encompass severe extortion tactics that threaten the integrity of personal and organizational data alike. White articulates the critical need for public awareness regarding the mechanisms and repercussions of ransomware, especially in light of recent high-profile attacks that have reverberated across various sectors in the United Kingdom. Lees meer

Furthermore, we explore the intricate dynamics of cybercrime, including the intersection of state-sponsored hacking and organized crime, revealing how these elements coexist and influence one another. In shedding light on the inner workings of the Conti gang, we aim to equip our listeners with the knowledge necessary to navigate this complex and evolving threat landscape effectively. The exploration of ransomware, particularly through the lens of the Conti Ransomware gang, presents a multifaceted narrative that delves into the complexities of modern cybercrime. Investigative journalist Geoff White, known for his extensive work in exposing organized crime and technology intersections, articulates the profound implications of ransomware on both corporate and individual levels.

This episode sheds light on the alarming trend where ransomware has transitioned from mere data encryption to more sophisticated extortion tactics. The discussion is framed within the context of recent high-profile attacks on major UK entities, illustrating how these breaches have penetrated public awareness and sparked discourse on cybersecurity. White elucidates the significance of the unprecedented leak of 300,000 internal messages from the Conti gang, offering a rare insight into their operational mechanics and ethical considerations. This leak has …
The Voice of the Customer: Why Listening Beats Selling with David Muniz

7 juli 2026 · 34 min
Afspelen

The paramount focus of this podcast episode is the critical necessity of amplifying the voice of the customer in the contemporary business landscape. I engage in a profound dialogue with David Muniz from Segura, exploring the integral role that understanding customer pain points plays in the provision of effective solutions. We delve into the importance of listening attentively to customers, rather than hastily advancing towards solutions based on assumptions. This conversation elucidates the vital connection between customer feedback and organizational success, emphasizing that a true comprehension of customer needs fosters trust and enhances the overall customer experience. As we navigate this insightful discourse, we uncover best practices and strategies for harnessing customer feedback to drive meaningful engagement and ultimately, success in the marketplace. David Muniz, a seasoned professional from Segura, joins the Security by Default podcast to delve into the significance of the customer's voice in shaping business strategies and solutions. The discourse initiates with an exploration of the fundamental need for businesses to prioritize understanding the customer's unique challenges and pain points before hastily proposing solutions. Muniz articulates that an effective customer success strategy hinges upon the ability to listen actively and empathetically to clients, thereby enabling organizations to tailor their offerings to meet the specific needs of their clientele. Through a series of poignant examples and insights gained from his extensive experience in customer relations, Muniz emphasizes that fostering a genuine connection with customers not only enhances the overall experience but also cultivates loyalty and trust within the marketplace. As the conversation unfolds, Muniz elaborates on the necessity of balancing analytical frameworks with qualitative insights derived from direct customer interactions. He stresses that while market analysts provide va… Lees meer
Why Identity Is Becoming Every CISO's Biggest Challenge | Vlad Shapiro

23 juni 2026 · 44 min
Afspelen

Vlad Shapiro, a distinguished mathematician turned identity management expert, articulates his transformative journey in this episode, offering profound insights into the intersection of identity and business. He elucidates how the realm of identity has evolved into a critical pillar for organizational functionality, emphasizing that without effective identity management, business operations may falter. Our discussion delves into the implications of this evolution, particularly the necessity for board members to prioritize identity governance alongside traditional business strategies. Furthermore, we explore the pressing gaps within the current identity landscape, including the challenges posed by a lack of standardization and the imperative for innovative thinking to navigate an increasingly complex digital environment. Shapiro's reflections not only highlight the significance of identity management in contemporary business but also underscore the need for a collaborative approach that integrates technological advancements with ethical considerations for future generations. Lees meer

In this episode of the Security by Default podcast, host Joe Carson engages with Vladislav Shapiro, who shares his journey from a mathematician to an identity management expert. They discuss the evolution of identity management, its growing importance in business, and the innovations shaping the future of identity technology. The conversation emphasizes the need for a business-oriented approach to identity, the gaps in current practices, and the ethical considerations in technology development. In this conversation, Joseph Carson and Vladislav Shapiro explore the complexities of AI governance, drawing parallels with nuclear energy management. They discuss the importance of control mechanisms, the role of identity in AI, and the emerging threats related to computational workload theft. The conversation emphasizes the need for continuous learning in a rapidly evolving technological landscape and…
How Hackers Attack AI: The New Battle to Secure Intelligent Machines | Harriet Farlow

9 juni 2026 · 43 min
Afspelen

This podcast episode delves into the intricate nexus of artificial intelligence and security, featuring an enlightening conversation with Harriet, the author of a newly released book Practical AI Security. We explore her compelling journey from a background in physics and anthropology to becoming a pivotal figure in the realm of cybersecurity, particularly focusing on the challenges posed by adversarial machine learning. Harriet elucidates the pressing necessity for organizations to comprehend and mitigate the security vulnerabilities inherent in AI systems, as well as the broader implications for national security. Our discourse also addresses the critical need for collaboration between cybersecurity professionals and AI developers to ensure that security considerations are embedded within AI design from the outset. Ultimately, we aim to provide our audience with a profound understanding of the evolving landscape of AI security and the imperative of safeguarding these transformative technologies. Lees meer

🎙️ Security by Default Podcast

Practical AI Security: Attacking, Defending, and Securing the Future of AI

With Harriet Farlow — Founder of Mileva Security Labs & Author of Practical AI Security

Artificial Intelligence is transforming the way we build technology, automate decisions, analyze data, and solve some of the world’s biggest challenges.

But as AI becomes more powerful and more deeply embedded into our lives, one critical question becomes increasingly important:

How do we secure AI itself?

In this episode of Security by Default, host Joseph Carson is joined by Harriet Farlow, AI security researcher, founder of Mileva Security Labs, and author of “Practical AI Security: A Hands-On Guide to Attacking, Defending, and Securing Modern AI Systems.”

Together they explore the rapidly evolving world of AI security, adversarial machine learning, and why understanding how AI works is essential before we can protect it.

About This Episode

AI is often described as the…
AI Is Not Magic: The Truth Behind the Technology Changing Everything | Diana Kelley

26 mei 2026 · 37 min
Afspelen

This podcast episode elucidates the evolution of artificial intelligence, particularly focusing on the transition from earlier models such as ELIZA and Watson to contemporary systems like ChatGPT and Claude. Our discussion emphasizes the importance of understanding the context and limitations of AI, as well as the implications of its rapid advancement on our professional landscape. We delve into the nuances of prompt engineering and the necessity of training AI models to interpret context effectively, which has become increasingly pivotal in their application. Furthermore, we address the societal concerns regarding job displacement in the wake of AI proliferation, positing that while certain roles may be rendered obsolete, new opportunities will arise, necessitating continuous adaptation and retraining. Ultimately, our dialogue aims to provide clarity amidst the complexities of AI technology, underscoring the imperative for informed engagement with these transformative tools. Lees meer

In this episode of the Security by Default podcast, host Joe Carson welcomes Diana Kelley, a prominent figure in the tech industry, to discuss her journey in technology, the evolution of AI, and its implications for cybersecurity and the job market. They explore the historical context of AI, from early systems like ELIZA to modern advancements like Watson and ChatGPT, and address common misconceptions about AI's capabilities. The conversation also delves into the future of jobs in an AI-driven world, emphasizing the need for training and understanding of AI technologies. In this conversation, Joseph Carson and Diana Kelley discuss the evolution of jobs in the context of technological advancements, particularly focusing on AI and its implications for the workforce. They explore the necessity of continuous retraining and the emergence of new roles, the importance of contextual understanding in AI, and the behavior of AI agents. Additionally, they emphasize the need for control mechanisms in AI …
Why Cybersecurity Fails Without Trust: The Human Side of Defense | JC Vega

12 mei 2026 · 37 min
Afspelen

This podcast episode elucidates the critical importance of effective communication and leadership within the realm of cybersecurity. We engage in a profound discussion with JC Vega, who shares his extensive background in both operational security and cybersecurity, emphasizing the necessity of translating complex technical concepts into relatable business language. We explore the pivotal role of leaders in fostering a secure organizational environment, underscoring that cybersecurity is not merely an IT concern, but an enterprise-wide imperative that encompasses every facet of an organization's operations. The conversation further delves into strategies for empowering champions within organizations to advocate for security practices, thus ensuring that everyone understands the significance of their roles in safeguarding the enterprise. Ultimately, we aspire to convey that a collaborative, informed approach is essential in navigating the complexities of today's security landscape, thereby enhancing both individual and organizational resilience. Lees meer

In this episode, cybersecurity expert JC Vega shares insights on effective communication, leadership, and risk management in cybersecurity. He emphasizes the importance of translating technical concepts for business leaders, building trust, and fostering community to enhance organizational resilience.

keywords

cybersecurity, leadership, risk management, communication, trust, community, organizational resilience, cybersecurity education

keytopics

Translating cybersecurity for non-technical audiences

Building champions within organizations

The importance of trust and verification in security

Cybersecurity as an enterprise survival issue

Leveraging AI and technology responsibly

sound bites

"Validate and verify, don't just trust."

"Train like it's a Super Bowl."

"Leave a link, build a community."

Chapters

00:00 Introduction to Cybersecurity Leadership

02:34 Translating Cybersecurity for Non-Technical Audiences

05…
Can AI Beat Hackers? The Future of Cyber Training Has Changed | Hack The Box

28 april 2026 · 20 min
Afspelen

The eminent discourse of this podcast episode delves into the pivotal role of artificial intelligence in the contemporary cybersecurity landscape, underscoring the symbiotic relationship between AI and human expertise. I, Joseph Carson, engage in a compelling conversation with Gerasmus, a distinguished figure from Hack the Box, as we explore the transformative impact of AI on both offensive and defensive cybersecurity strategies. Our dialogue illuminates the necessity for practitioners to adapt and evolve their skill sets in tandem with rapid technological advancements, highlighting the significance of platforms such as Hack the Box in fostering a culture of continuous learning and practical application. We further examine the implications of AI governance and the emergence of agentic AI as a potential risk factor, urging a meticulous approach to data management and security protocols. Ultimately, this episode serves as a clarion call for cybersecurity professionals to embrace innovation while preserving the essential human element in safeguarding digital infrastructures. Lees meer

In this special edition recorded live at RSA Conference, Joseph Carson is joined by Gerasimos Marketos (gmar), Chief Product Officer at Hack The Box.

They explore how AI is reshaping cybersecurity skills, why traditional education is struggling to keep up, and how hands-on platforms are redefining how defenders and ethical hackers are trained. From real-world fraud detection to AI-powered CTF competitions, this episode dives into the evolving relationship between humans and machines in cybersecurity.

🔑 Key Themes & Topics

AI vs Humans in cybersecurity competitions

Why AI is an accelerator, not a replacement

The evolution from traditional training → hands-on gamified learning

Closing the cybersecurity skills gap

Red, Blue, and Purple team upskilling

AI governance, risk, and agentic threats

The future of cybersecurity careers and hiring

⏱️ Chapters

00:00 – Introduction & RSA Conference i…
Behind the Scenes: How Cybersecurity Decisions Really Get Made | Fernando Montenegro

14 april 2026 · 41 min
Afspelen

Fernando Montenegro, a distinguished industry analyst in cybersecurity, articulates the pivotal best practices that analysts should adopt to navigate the complexities of the cybersecurity landscape effectively. Throughout our discourse, he elucidates the necessity for analysts to function as intermediaries among various stakeholders, including buyers, sellers, and investors, thus facilitating informed decision-making processes. Montenegro emphasizes the importance of clarity in communication, advocating for an open-minded approach during analyst interactions to maximize the value derived from these engagements. He further discusses the strategic implications of cybersecurity decisions, urging organizations to appreciate the multifaceted influences that shape their security postures. Ultimately, this episode serves as an invaluable resource for professionals seeking to enhance their analytical practices within the rapidly evolving cybersecurity domain. Lees meer

In this episode, Fernando Montenegro shares his journey into the cybersecurity industry, insights on industry analysis, and the evolving trends shaping cybersecurity today. Discover how analysts bridge the gap between vendors, buyers, investors, and academia, and learn practical tips for engaging effectively with industry experts.

key Takeaways

Role of industry analysts in cybersecurity

Emerging trends in cybersecurity including AI and attack surface expansion

Effective engagement with analysts for decision support

Strategic cybersecurity budgeting and investment

Influence of economics and incentives on security decisions

sound bites

"Understanding what's going on in the world"

"Good enough security can be effective"

"Workload AI versus workforce AI"

Chapters

00:00 Introduction to Security by Default Podcast

00:53 Fernando Montenegro's Origin Story

05:16 The Role of an Industry Analyst

08:55 Maximizing Value from Analyst Interactions

13:16 Understanding AI in Conversations

15:44 Choosing the Right So…
Can We Make Cybersecurity Fun Again? Turning Fear Into Action | Gary Berman

31 maart 2026 · 47 min
Afspelen

This podcast episode delves into the imperative of transforming the often daunting landscape of cybersecurity into a realm of engagement and enjoyment. I, Joe Carson, alongside my esteemed guest Gary, explore how the prevailing culture of fear, uncertainty, and doubt (FUD) can be supplanted by a more vibrant and playful approach. We discuss the significance of fostering a sense of community and support within the cybersecurity field, emphasizing the need to celebrate successes and share positive narratives that can inspire both professionals and newcomers alike. The conversation further highlights innovative methods such as gamification and the incorporation of storytelling to make cybersecurity training more accessible and enjoyable. Ultimately, we aim to ignite a movement that not only safeguards our digital environments but also rekindles the joy and creativity that can be found within this vital industry. Lees meer

Join cybersecurity expert Joseph Carson and guest Gary as they explore innovative ways to make cybersecurity engaging, fun, and accessible. Discover how humor, storytelling, and community involvement can transform the industry and attract new talent.

Chapters

00:00 Welcome to the Cybersecurity Chaos

02:32 From Fear to Fun in Cybersecurity

05:27 The Journey of a Cyber Advocate

08:09 The Importance of Community and Collaboration

10:45 Bringing Laughter Back to Cybersecurity

13:13 Rebranding Cybersecurity for New Talent

16:00 The Power of Words in Cybersecurity

18:43 Innovative Approaches to Cyber Awareness

21:29 Lessons from Kids: Simplifying Cybersecurity

24:39 The Inner Child and Cognitive Dissonance

26:40 Gamification and Learning Innovations

28:19 Storytelling in Cybersecurity

29:15 Cybersecurity Starts at Home

30:36 Community Engagement and Employee Connection

32:14 The Importance of Acknowledgment

34:13 Finding Joy in Everyday Life

35:11 Humor as a Coping Mechanism

40:04 The Power of Positive Thinking

45:02 Mission Accomplished: Fun an…
Inside Modern Cyber Warfare: The Invisible Battles Happening Every Day | Chris Kubecka

17 maart 2026 · 45 min
Afspelen

This podcast episode delves into the intricate interplay between global politics, cybersecurity, and the evolving nature of threats faced by critical infrastructure. Our esteemed guest, Chris, shares his compelling journey from early experiences with technology to significant roles in safeguarding vital systems against sophisticated cyber threats. Notably, the discussion illuminates the transformation of cyber warfare, highlighting the emergence of physical attacks that disrupt both digital and physical infrastructures. We also examine collaborative efforts among nations to fortify defenses against such challenges, emphasizing the necessity of cooperation in the face of rising geopolitical tensions. As we navigate this complex digital landscape, it becomes increasingly apparent that a unified approach is paramount to ensuring our collective security and resilience in an interconnected world. Lees meer

Join Joseph Carson in this insightful episode as he interviews cybersecurity expert Chris Kubecka. They discuss critical infrastructure security, cyber warfare, geopolitical risks, and the evolving landscape of digital threats, providing valuable lessons for cybersecurity professionals and policymakers.

Key Topics

Cybersecurity in critical infrastructure

Geopolitical cyber threats and hybrid warfare

Evolving landscape of digital threats and resilience

Sound bites

"GPS jamming has been a massive challenge."

"Digital Empires: China, Europe, and the US."

"Radio communications are a vital fallback."

Chapters

00:00 Introduction and Background of Chris Kubecka

01:37 Cybersecurity Challenges in Critical Infrastructure

03:37 Evolving Nature of Cyber Threats

05:45 The Role of Drones in Modern Warfare

07:25 Hybrid Warfare and Global Diplomacy

10:10 The Shift in Global Cybersecurity Dynamics

12:18 The Importance of International Cooperation

14:33 Privacy and Ethics in Cybersecurity

16:50 Historical Context and Regional Cooperation

18:55 Cyber Attacks on Civilian Infras…
How Anyone Can Become a Hacker: Learning Cybersecurity the Right Way | Ian Austin

3 maart 2026 · 33 min
Afspelen

This podcast episode delves into the evolving landscape of cybersecurity, particularly focusing on the intersection of cloud security and artificial intelligence. Ian Austin, co-founder of Pwned Labs, shares his extensive journey through the cybersecurity domain, highlighting the gradual transition from traditional IT roles to specialized security positions. A salient point discussed is the significance of fostering a community-oriented approach to learning, which enhances knowledge acquisition and practical skills in an increasingly complex environment. Ian emphasizes that current training methodologies must incorporate gamification and hands-on experiences to engage learners effectively, ensuring that knowledge is not only theoretical but also applicable. As we navigate these insights, listeners will uncover valuable strategies for enhancing their own cybersecurity practices and understanding the critical importance of cloud security in today's digital landscape. Lees meer

In this episode of the Security by Default podcast, host Joe Carson speaks with Ian Austin, co-founder of Pwned Labs, about his journey in cybersecurity, the evolution of learning in the field, and the challenges of Cloud and AI security. Ian shares insights on transitioning into cybersecurity roles, the importance of community engagement, and the need for continuous learning in an ever-evolving industry. They discuss the significance of gamification in training and the current trends in cloud security, emphasizing the importance of hands-on experience and collaboration.

Key Takeaways

Ian Austin is a co-founder of Pwned Labs, specializing in cloud and AI security training.

His journey in cybersecurity began with help desk roles and evolved into penetration testing.

Creating content is a great way to learn and contribute to the community.

Cloud security presents unique challenges that require ongoing education and adaptation.

Gamification in training enhances engagement but should not overshadow pr…
Inside Password Cracking: How Hackers Really Break Your Secrets | Evil Mog

17 februari 2026 · 42 min
Afspelen

This podcast episode delves into the intricate realm of password security and the evolving landscape of authentication methods, with particular emphasis on the implications of artificial intelligence within this domain. I am joined by the esteemed Evil Mog, an executive managing hacker at IBM, who shares his extensive expertise and insights derived from years of involvement in the password cracking community. Throughout our discussion, we explore the significance of enhancing cybersecurity measures while simultaneously acknowledging the pervasive challenges that continue to manifest, such as the recent incidents of compromised systems. We also reflect on the necessity of fostering a culture of collaboration and knowledge sharing within the cybersecurity community to fortify defenses against increasingly sophisticated threats. Ultimately, this episode serves as a poignant reminder of the delicate balance between security and usability in our ongoing pursuit of safeguarding digital assets. Lees meer

In this episode of the Security by Default podcast, host Joe Carson welcomes Evil Mog, an expert in password cracking and cybersecurity. They discuss the importance of Hacker Jeopardy in making cybersecurity fun, the ongoing challenges with passwords, and the evolving role of AI in password cracking. The conversation also touches on incident response, the significance of documentation, and the future trends in cybersecurity, including the shift towards passwordless authentication and the impact of AI on both attackers and defenders.

Takeaways

Hacker Jeopardy is a fun way to engage with cybersecurity.

Teaching others helps reinforce your own knowledge.

Passwords will remain a necessary evil in security.

AI is enhancing password cracking methodologies.

Documentation is crucial in incident response.

The cost of hacking is increasing due to advanced techniques.

Collaboration between red and blue teams is essential.

Insider threats are on the rise in cybersecurity.

Password m…
Understanding the Critical Role of Identity in Modern Cybersecurity with Charles Chase

3 februari 2026 · 30 min
Afspelen

The focal point of today’s discourse centers on the crucial importance of identity security and privileged access management in contemporary organizational frameworks. I am joined by the esteemed Charles Chase, who shares his extensive experience in the realm of identity security, elucidating the pressing trends and best practices that organizations must adopt to safeguard their digital assets. Our conversation delves into the regulatory pressures that compel businesses to enhance their security measures, particularly in light of evolving threats and compliance requirements. Furthermore, we explore the significance of understanding the unknowns within identity management systems and the necessity of maintaining rigorous hygiene practices to mitigate potential vulnerabilities. Through this dialogue, we aim to illuminate the transformative impact of effective identity management strategies on organizational security and operational efficiency. Lees meer

In this episode of the Security by Default podcast, host Joe Carson speaks with Charles Chase about his journey into the cybersecurity field, focusing on identity security and privilege access management. They discuss the evolving trends in identity security, the importance of maintaining identity hygiene, and the impact of regulations like NIST 2 and DORA on organizational practices. The conversation also covers the shift towards passwordless security, the role of AI in identity management, and resources for those looking to enter the field. The episode concludes with reflections on the importance of identities in business and society.

Takeaways

Charles Chase fell into cybersecurity from a military background.

The importance of understanding what you don't know in identity security.

Organizations often have dormant accounts that pose security risks.

Regulatory bodies are pushing organizations to improve their identity security practices.

The shift towards passwordless security is gaining momentum.

AI is becoming a valu…
A Deep Dive into Cyber Operations and OSINT with The Grugq

20 januari 2026 · 46 min
Afspelen

The Grugq, a distinguished expert in the realm of open-source intelligence (OSINT) and cyber operations, elucidates the intricate interplay between information warfare and contemporary security challenges. He articulates the notion that during times of conflict, traditional rules governing cyber operations, such as deniability and stealth, become markedly less pertinent. Instead, the focus shifts towards achieving mission objectives without the necessity for concealment, as the stakes escalate in the context of warfare. Throughout our discourse, we explore the evolution of cyber tactics, emphasizing the shift from sophisticated methodologies to more rudimentary yet effective tools, reflecting a pragmatic approach to cyber engagements. Ultimately, our conversation serves as a profound examination of the current landscape of cyber warfare, underscoring the necessity for adaptability and a nuanced understanding of operational security in an era marked by rapid technological advancements and shifting geopolitical dynamics. Lees meer

In this episode of the Security by Default podcast, host Joseph Carson engages with the Grugq, a cybersecurity expert and PhD student, discussing his journey into the field, the evolution of cybersecurity practices, and the complexities of information warfare. The Grugq shares insights on anti-forensics, the importance of understanding human behavior in cybersecurity, and the current landscape of cyber warfare, particularly in the context of the ongoing conflict in Ukraine. The conversation highlights the challenges and changes in the cybersecurity field, emphasizing the need for clarity and understanding in a chaotic information environment.

Takeaways

The Grugq's journey into cybersecurity began with a Unix book.

He transitioned from internships to freelancing in cybersecurity.

Moving to Thailand helped reduce living costs while consulting.

Understanding anti-forensics is crucial for effective cybersecurity.

The rules of cyber warfare differ …
Building Resilience in Cybersecurity: Lessons from Joe Sullivan

6 januari 2026 · 48 min
Afspelen

The paramount theme of this podcast episode revolves around the critical necessity of preparing for crises within cybersecurity frameworks. As we navigate an increasingly chaotic landscape, it becomes evident that security must be accessible and comprehensible for all stakeholders involved. We engage in an enlightening dialogue with our esteemed guest, Joe Sullivan, who elucidates his remarkable journey from a federal prosecutor to a prominent figure in security leadership across major tech enterprises. Throughout our conversation, we emphasize the importance of cultivating resilience in the face of potential adversities, advocating for a paradigm shift from mere prevention to proactive crisis management. This episode serves not only as an exploration of individual experiences but also as a clarion call for organizations to invest in robust preparedness strategies to mitigate the impacts of inevitable security incidents. Lees meer

In this episode of the Security by Default podcast, host Joseph Carson interviews Joe Sullivan, a prominent figure in cybersecurity. They discuss Joe's journey from a federal prosecutor to the Chief Security Officer at Facebook, exploring the challenges and expectations in transitioning from government to private sector roles. The conversation delves into the evolving landscape of cybersecurity, the impact of ransomware, and the importance of crisis management and preparedness. Joe shares valuable lessons for aspiring security executives and highlights the significance of understanding technology in leadership roles. The episode concludes with Joe's current projects, including his nonprofit initiative, Ukraine Friends, which provides laptops to children affected by the war in Ukraine.

Takeaways

Security is possible for everyone.

Joe Sullivan's journey reflects a unique path into cybersecurity.

Transitioning from government to private sector presents challenges.

Understanding corporate culture is crucial for success.

Measuring success in cybe…
Laughing with Cyber - A Standup Comedy Special with Ian Murphy

23 december 2025 · 57 min
Afspelen

This podcast episode delves into the often-overlooked notion that the field of cybersecurity can be both enjoyable and engaging, rather than solely characterized by its daunting challenges and threats. We, Joe Carson and Ian Murphy, reflect on our shared experiences within the industry, emphasizing the importance of maintaining a sense of humor and joy amidst the chaos often associated with cybersecurity. Ian recounts his journey from the early days of the internet and his unconventional entry into the cybersecurity realm, highlighting how his background in mechanics and passion for storytelling have shaped his unique approach to security awareness. Our conversation touches on the significance of creativity in effectively communicating complex topics, as well as the necessity of fostering a more approachable and less fear-driven narrative within the cybersecurity space. Ultimately, we aspire to illuminate the path toward a more vibrant and connected community, where laughter and camaraderie thrive alongside security. Lees meer

In this episode of the Security by Default podcast, host Joseph Carson welcomes Ian Murphy, a cybersecurity expert and stand-up comedian. They discuss Ian's unconventional journey into cybersecurity, his experiences at the MOD and Symantec, and his transition to self-employment and comedy. Ian shares insights on the importance of storytelling in both cybersecurity awareness and comedy, as well as navigating online criticism and audience interactions. The conversation highlights the need for humor in serious industries and the value of real human connections.

Takeaways

Ian's journey into cybersecurity was unplanned and unconventional.

The importance of storytelling in both cybersecurity and comedy.

Self-employment offers freedom but comes with challenges.

Humor can be a powerful tool in serious industries.

Navigating online criticism requires thick skin and perspective.

Comedy is subjective, and not everyone will appreciate it.

Real human inter…
From Teenage Hacker to Hollywood: A Cybersecurity Story You Won’t Believe | Alissa Knight

16 december 2025 · 47 min
Afspelen

This podcast episode features an enlightening conversation with Alissa Knight, a notable figure in the cybersecurity landscape, who shares her unique journey into the realm of hacking and cybersecurity. From her early days of curiosity and mischief, starting at the tender age of thirteen, to her transformative experiences following a pivotal arrest, Alissa reflects on the lessons learned and the paths forged in the aftermath. The discussion delves into the evolution of hacking practices and the current landscape of API security, which Alissa identifies as a critical area of concern due to its expanding attack surface in contemporary technology. As we navigate through the complexities of artificial intelligence's role in cybersecurity, Alissa emphasizes the necessity of integrating security practices into the development process. This episode serves not only to illuminate Alissa's personal narrative but also to provide valuable insights for aspiring cybersecurity professionals and organizations alike. Lees meer

In this episode of the Security by Default podcast, host Joe Carson engages with cybersecurity expert Alissa Knight, who shares her unique journey into the world of hacking and cybersecurity. They discuss the evolution of hacking, the challenges of API security, and the transformative impact of AI on the industry. Alissa emphasizes the importance of continuous learning and adapting to new technologies, while also reflecting on her career shifts and the significance of storytelling in cybersecurity marketing. The conversation highlights the need for organizations to invest in their employees' education and the future of cybersecurity innovation.

Takeaways

Alissa started hacking at the age of 13, driven by curiosity.

The early days of hacking were like the wild west, with fewer resources.

A significant turning point in Alissa's life was her arrest at 17.

Cybersecurity offers lucrative career opportunities for skilled individuals.

API security is a growing concern …
Understanding Customer Success: Beyond Support in Cybersecurity

9 december 2025 · 42 min
Afspelen

This podcast episode elucidates the essential nature of customer success within the realm of cybersecurity, positing that the discipline transcends mere technical proficiency to encompass a broader business perspective. I convey that security is no longer confined to IT; rather, it is a multifaceted issue that intertwines with various organizational domains such as finance, sales, and human resources. The dialogue with our esteemed guest, David Muniz, highlights the importance of understanding customer expectations and the role of trust in fostering meaningful relationships between organizations and their clients. We explore the distinction between customer support and customer success, emphasizing that the latter is a long-term endeavor focused on guiding clients toward their defined objectives. Ultimately, our conversation underscores the imperative of adopting a customer-centric approach to ensure that cybersecurity solutions not only protect but also enhance the overall business experience. Lees meer

In this episode of the Security by Default podcast, Joseph Carson engages with David Muniz to explore the evolving landscape of cybersecurity. They discuss the importance of diversity in the field, the distinction between customer success and support, and the critical role of trust in business relationships. The conversation also delves into the Zero Trust paradigm, emphasizing the need for a human-centric approach in cybersecurity. David shares insights on staying updated in a rapidly changing industry and the significance of happiness in the workplace, concluding with thoughts on the human element in cybersecurity.

Keywords

cybersecurity, customer success, zero trust, trust in business, diversity in tech, human relationships, customer support, industry insights, happiness in work, staying updated

Takeaways

· Customer success focuses on long-term relationships, not just immediate problem-solving.

· Trust is a key component in building successful customer relationships…
Personalizing Cybersecurity Training: The Key to Modern Defense Strategies Michael Waite

3 december 2025 · 32 min
Afspelen

The primary focus of today's discussion revolves around the profound implications of artificial intelligence (AI) on the cybersecurity landscape, particularly emphasizing the heightened sophistication and frequency of cyberattacks. As we navigate through the intricacies of this evolving domain, we aim to elucidate how the advent of advanced AI technologies is transforming both the methods employed by threat actors and the strategies utilized for organizational defense. Our esteemed guest, Michael Waite, brings invaluable insights from his extensive experience in technology and cybersecurity, highlighting the necessity for a paradigm shift in how we approach security awareness and training. We delve into the critical need for personalized training programs that address specific risks associated with individual roles within an organization, moving away from outdated, one-size-fits-all methods. Ultimately, our dialogue seeks to foster a deeper understanding of the current threat landscape, advocating for a collaborative and informed approach to safeguarding not only corporate environments but also the personal digital lives of individuals. Lees meer

In this episode of Security by Default, host Joe Carson sits down with Michael Waite from Dune Security to explore how AI is reshaping cybersecurity and why it’s time to rethink traditional awareness training.

As cyber threats become more sophisticated, personalized, and AI-powered, organizations can no longer rely on outdated, one-size-fits-all learning models. Joe and Michael break down what modern cybersecurity training should look like, how to engage employees more effectively, and why empowering people both inside and outside the office is essential to strong defense.

What You’ll Learn

How AI is transforming both cyber attacks and defensive strategies

Why the volume and quality of phishing attempts continue to rise

The limitations of traditional annual awareness training

The shift toward personalized, role-based learning…
The Future of Trustworthy AI: Insights from Satu Korhonen

19 november 2025 · 40 min
Afspelen

Satu Korhonen elucidates the intricacies of hacking artificial intelligence, emphasizing the necessity of understanding both the vulnerabilities and ethical considerations inherent in AI systems. She advocates for a paradigm shift where cybersecurity and AI development converge, fostering collaboration rather than division among these domains. Central to her discussion is the notion that AI, while a powerful tool, is fundamentally probabilistic, thereby requiring a critical approach to its outputs and implications. Korhonen further highlights the educational imperative of familiarizing individuals with AI vulnerabilities, suggesting that playful engagement through gamified experiences can enhance comprehension and awareness. This discourse not only illuminates the challenges posed by AI but also underscores the potential for human-AI synergy in navigating the complexities of modern technology. Lees meer

In this episode of the Security by Default podcast, Joseph Carson and guest Satu Korhonen a passionate practitioner, researcher and founder of Helheim Labs delve into the intersection of AI and cybersecurity. They discuss the challenges and opportunities in creating trustworthy AI systems, the importance of collaboration between AI and cybersecurity professionals, and the role of regulation in ensuring AI safety. Satu shares her journey from education to AI, highlighting key moments and insights from her career. The conversation also touches on the EU AI Act, the importance of understanding AI's limitations, and the need for a balanced approach to AI development.

Key Takeaways

AI systems are fundamentally probability-based, not perfect.

Collaboration between AI and cybersecurity is crucial for safety.

The EU AI Act focuses on human rights and risk management.

Understanding AI's limitations is key to using it effectively.

AI can enhance productivity but requires careful implementation.

Training AI with both good and bad data improves its robustness.

AI should serve hu…
The Evolving Landscape of Identity Threats: Strategies for Mitigation and Awareness

5 november 2025 · 39 min
Afspelen

This podcast episode delves into the pressing issue of identity threats and the evolving trends surrounding them. Our esteemed guest, Philippe Peters, who leads Identity Threat Labs at Segura, provides invaluable insights into the methodologies employed by cybercriminals in their quest to exploit vulnerabilities associated with credentials. We explore the alarming shift in tactics, where attackers increasingly purchase credentials rather than relying solely on zero-day exploits, highlighting the importance of vigilance in monitoring user behavior and implementing robust security measures. Moreover, we discuss the significance of events such as BSides, which serve as platforms for knowledge exchange, networking, and community engagement in the cybersecurity landscape. This episode aims to equip listeners with a deeper understanding of identity threats and the proactive steps necessary to mitigate these risks in their organizations. Lees meer

In this episode of the Security by Default podcast, host Joe Carson welcomes back Filipi Pires, Head of Identity Threat Labs & Global Product Advocate at Segura® to discuss the latest trends in identity threats and cybersecurity. They explore the evolution of attacks, particularly focusing on social engineering and the role of AI in both offensive and defensive strategies. Filipi shares insights from recent events, including the significance of BSides conferences in fostering community and knowledge sharing. The conversation emphasizes the importance of a zero trust approach and the need for continuous education in cybersecurity.

Key Takeaways

The BSides community is essential for cybersecurity education.

Attackers are increasingly using social engineering techniques.

AI is being leveraged by both attackers and defenders.

Zero trust is a critical framework for modern security.

Organizations must implement multiple layers of protection.

Credential theft is a major concern in identity threats.

B-Sides events provide networking oppo…
Cyber Law Unveiled: Bridging Security and Legal Perspectives with Pamela Victor Ibitamuno

22 oktober 2025 · 29 min
Afspelen

The salient point of this episode revolves around the intricate relationship between cybersecurity and cyber law, emphasizing the challenges faced in regulating the rapidly evolving digital landscape. I, Joe Carson, host of the Security By Default podcast, engage in a profound dialogue with our esteemed guest, Pamela Victor Ibitamuno, a legal expert with a unique background in penetration testing. Pamela elucidates her journey from experiencing cybercrime victimization to her commitment to merging her passions for law and cybersecurity through the field of cyber law. This discussion critically examines the difficulties legal professionals encounter in comprehending technical aspects of cyber incidents, as well as the pressing need for legal frameworks that genuinely address the complexities of cybercrime rather than merely responding to technological advancements in haste. Ultimately, we explore the necessity for a collaborative approach between legal practitioners and cybersecurity experts to establish effective regulations that safeguard society while fostering innovation. Lees meer

In this episode of the Security by Default podcast, host Joe Carson engages with Pamela Victor Ibitamuno, a lawyer with a unique background in penetration testing. They discuss the critical intersection of cyber law and cybersecurity, exploring the challenges faced in prosecuting cyber crimes, the importance of understanding intent, and the need for adaptive legal frameworks in the face of rapid technological advancements. The conversation also delves into the role of AI in the legal field and how professionals can stay updated in this ever-evolving landscape.

Takeaways

Pamela's journey from penetration testing to cyber law highlights the importance of understanding both fields.

Legal professionals often struggle to grasp the technicalities of cybersecurity.

Regulations may not effectively address the problems they aim to solve.

Cyber crime often transcends borders, complicating prosecuti…
The Role of Game Design in Cybersecurity Training with Peadar

8 oktober 2025 · 42 min
Afspelen

This podcast episode elucidates the pivotal role of game design in enhancing cybersecurity training, presented through an engaging dialogue between the host, Joe Carson, and guest Peadar. The discussion commences with Peadar's fascinating transition from education to game design, highlighting the necessity of bridging the gap between technical and non-technical audiences in the cybersecurity sphere. We delve into the essential components of effective games, which encompass goals, rules, feedback systems, and voluntary participation—elements critical for fostering engagement and retention of knowledge. The conversation further explores how games can serve as metaphors for complex concepts, enabling participants to internalize essential cybersecurity principles while navigating the intricacies of communication between diverse stakeholders. Ultimately, this episode underscores the transformative potential of integrating game mechanics into cybersecurity training, advocating for an approach that prioritizes understanding over mere rote learning. Lees meer

In this episode of the Security by Default podcast, host Joe Carson engages with game designer Peadar, Gamification Lecturer at Tallinn University to explore the intersection of game design and cybersecurity training. Peadar shares his journey from teaching to game design, emphasizing the importance of using games to facilitate learning in complex subjects like cybersecurity. The conversation delves into the fundamental elements of games, the challenges of creating effective training games, and the need for conceptual transfer games that bridge the gap between technical and non-technical audiences. Peadar also discusses the future of cybersecurity training, the significance of soft skills, and the different player types in game design. The episode concludes with recommended resources for those interested in game design and cybersecurity.

Peadar Callaghan, Gamification Lecturer at Tallinn University, Digital Learning Games Lab…
Your Security Badge Can Be Hacked: RFID Secrets Exposed | Iceman

24 september 2025 · 1 uur 6 min
Afspelen

Christian Herman, known in the hacking community as Iceman, joins us to delve into the intricacies of RFID hacking, with a particular focus on the Proxmark device. This episode elucidates the journey of Iceman from his early encounters with technology to becoming a prominent figure in the RFID hacking domain. We discuss not only the technical aspects of utilizing the Proxmark for various hacking endeavors but also the challenges and learning curves inherent in mastering such a sophisticated tool. Iceman shares his personal anecdotes of overcoming obstacles in his hacking career, emphasizing the importance of community support and knowledge sharing. Through this dialogue, we aim to inspire listeners to engage with the world of hacking, highlighting both its complexities and its potential for innovation. Lees meer

In this episode of the Security by Default podcast, host Joe Carson interviews Christian Herrmann, also known as Iceman, who shares his journey into the world of RFID hacking. The conversation covers Christian's origin story, his passion for technology, and the challenges he faced while learning and developing his skills. They discuss the importance of community engagement, open-source contributions, and the evolution of hacking tools like Proxmark. The episode also touches on risk management in cybersecurity, the ethical implications of hacking tools, and the significance of finding balance in personal and professional life. Christian emphasizes the value of asking for help and surrounding oneself with supportive individuals in the tech community.

Takeaways

Christian Herrmann, known as Iceman, shares his journey into RFID hacking.

He emphasizes the importance of community engagement and open-source contributions.

The evolution of Proxmark has significantly impacted the RFID hacking community.

Tools used in hacking can have ethical implications that need to be considered.

Risk management is a crucial aspect of cybersecurity and hacking.

Finding balance betwee…
Understanding Cybersecurity: The Importance of Effective Storytelling

23 september 2025 · 29 min
Afspelen

This podcast episode delves into the multifaceted nature of branding and communication within the realm of cybersecurity, emphasizing that cybersecurity is no longer merely an IT concern but rather a societal issue that necessitates a broader perspective. We engage with George, a distinguished podcast host and community leader, who shares his insights on the importance of understanding human behavior in building effective cybersecurity communities. The discussion highlights the significance of storytelling in branding, illuminating the necessity for organizations to connect with their audience on a deeper level to convey their value propositions effectively. Furthermore, we explore the role of communication in fostering relationships and creating meaningful interactions within the industry, underlining the importance of listening and adapting to the needs of others. Ultimately, this episode serves as a compelling reminder that successful branding and community building in cybersecurity hinge on authenticity, understanding, and effective communication strategies. Lees meer

In this episode, Joe Carson speaks with George Kamide about the evolving landscape of cybersecurity, emphasizing the importance of community building, branding, and effective communication. They discuss how cybersecurity is no longer just an IT issue but a societal one, and how understanding user experience is crucial for success. The conversation also highlights the role of podcasts in educating the cybersecurity community and the challenges of building meaningful connections in a digital world.

Takeaways

Cybersecurity is a societal problem, not just an IT issue.

Branding is essential for standing out in a crowded market.

Understanding user experience is critical for product success.

Podcasts can provide valuable education and insights in cybersecurity.

Building communities takes time and effort without immediate ROI.

Effective communication is key to conveying value propositions.

Listening to cus…
Exploring the Intricacies of Cybersecurity Marketing with Zara Pirzada

10 september 2025 · 51 min
Afspelen

The discussion presented in this episode revolves around the intricate dynamics of the cybersecurity industry, emphasizing the multifaceted roles within it. Our esteemed guest, Zara Pirzada, the managing partner and owner of Infinitus Management Consulting, elucidates her journey into cybersecurity, highlighting the importance of understanding various market strategies for startups. She articulates a profound perspective on the necessity of aligning marketing strategies with genuine product value, thereby ensuring that organizations effectively communicate their unique selling propositions. Additionally, Zara draws attention to the critical nature of fostering trust and transparency in client relations, particularly within the context of evolving technological landscapes. As we delve deeper into these themes, listeners will gain invaluable insights into navigating the complexities of cybersecurity practices and the imperative of continuous learning and adaptation in this ever-changing field. Lees meer

#Cybersecurity #MarketingChallenges #Podcast

Takeaways

Zaira Pirzada's journey into cybersecurity was unintentional but evolved into a passion.

Open source intelligence (OSINT) played a crucial role in Zaira's early career.

Listening and learning from others is vital in the cybersecurity industry.

The transition from analyst to CMO involves understanding market dynamics and customer needs.

Unique value propositions are essential for startups to stand out in a crowded market.

Data is a key asset in cybersecurity, influencing decision-making and strategy.

Building trust and reliability is crucial in cybersecurity communications.

Negotiation in cybersecurity is evolving with the introduction of AI and data valuation.

Education and knowledge sharing are fundamental to success in the cybersecurity community.

Continuous learning is necessary to keep up with the fast-paced changes in the industry.

The discourse presented in this podcast episode is a profound examination o…
Bringing Clarity to Cybersecurity: A Conversation with Harry Coker Jr.

27 augustus 2025 · 37 min
Afspelen

Today, we delve into the profound insights of Mr. Secretary Harry Coker Jr., who elucidates the imperative of fostering clarity amidst the pervasive chaos inherent in cybersecurity. In our discourse, he emphasizes the necessity for defenders to perceive disruption not as a hindrance, but as an opportunity for innovation and growth within the realm of online security. Coker recounts his own journey into this field, which commenced long before the terminology of "cybersecurity" was widely adopted. He reflects on the pivotal moments and mentorships that shaped his trajectory, underscoring the significance of accountability in leadership. As we navigate through this episode, listeners will glean valuable lessons that resonate with the broader themes of resilience and strategic adaptation in the face of continuous technological evolution. Lees meer

In this episode of the Security by Default podcast, host Joe Carson speaks with Secretary Harry Coker Jr. about his journey into cybersecurity, the importance of mentorship, and the challenges faced in leadership roles. They discuss the evolving role of AI in government and cybersecurity, the significance of resilience in the face of failures, and personal interests that help them unplug from their busy lives. The conversation emphasizes the need for clarity in chaos and the importance of learning from every experience.

Takeaways

Bringing clarity to chaos is essential for success.

Mentorship plays a crucial role in career development.

Every day in leadership presents new challenges and opportunities.

Learning from both successes and failures is vital.

Trust but verify is a key principle in leadership.

AI is transforming government operations and cybersecurity.

Cyber resilience is becoming more important than ever.

Personal interests help leaders to unplug and recharge.

Success is often shared, while failure is solitary.

The human element must remain in AI decision-making.

Chapters

00:00 Introduction to Cybersecurity and P…
A Legacy of Malware: Mikko Hyppönen Reflects on His Career

14 augustus 2025 · 10 min
Afspelen

Mikko Hyppönen, a luminary in the realm of cybersecurity, reflects on his illustrious career during this insightful dialogue. With over three decades of experience, he articulates the evolution of his professional journey, transitioning from programming to the intricate domain of malware analysis. He recounts his initial encounter with malware, specifically the Omega virus, which ignited his passion for reverse engineering and paved the way for his enduring contributions to security. Moreover, Hyppönen unveils his recent shift toward drone defense technology, indicating a profound commitment to addressing contemporary challenges in military applications. As he prepares to leave the cybersecurity landscape, he expresses gratitude for the community that has supported him throughout his tenure, underscoring the importance of collaboration in making the digital world a safer environment. Lees meer

In this special edition episode of the Security by Default podcast, Mikko discusses his extensive career in cybersecurity, his transition to a new role in drone defense, and the innovative Museum of Malware that showcases the intersection of art and cybersecurity. He reflects on his journey, memorable experiences, and the importance of storytelling in engaging audiences

Takeaways

Mikko's alternative career choice was journalism.

He started in programming and transitioned to cybersecurity.

Keynote speaking at Black Hat involves storytelling.

Experience reduces anxiety in public speaking.

The Omega virus was Mikko's first memorable malware.

The Museum of Malware archives the history of cyber threats.

The museum features art inspired by malware and cyberattacks.

Mikko is transitioning to a drone defense company.

He sees parallels between cybersecurity and drone defense.

Mikko expresses gratitude for his 34 years in the cybersecurity industry.

Resources:

https://www.withsecure.com/en/experiences/museum-of-malware-art
Unveiling the Complexity of Non-Human Identities in Cybersecurity with Evandro Goncalves

13 augustus 2025 · 39 min
Afspelen

The discussion with Evandro Goncalves centers on the critical topic of machine identities, which are non-human identities operating within IT environments. As organizations increasingly rely on automation, understanding and managing these identities has become paramount. Evandro elucidates the complexities and challenges associated with machine identities, highlighting the vast number of such identities in comparison to human counterparts and the potential risks they pose, including misconfigurations and privilege abuse. He emphasizes the importance of visibility and accountability in managing these identities, advocating for best practices such as implementing secure vaults and applying the principle of least privilege. This episode serves as a vital resource for those seeking to enhance their understanding of machine identities and bolster their organization's security posture. Lees meer

In this episode of the Security by Default podcast, Joseph Carson and Evandro Goncalves discuss the critical topic of machine identities also known as non-human identities (NHI), exploring their definitions, challenges, and best practices for management. They delve into the complexities of managing non-human identities in cybersecurity, emphasizing the importance of visibility, risk management, and the principle of least privilege.

The conversation also highlights experiences from the NATO Lock Shield event, showcasing the real-world implications of identity security. Evandro shares insights on staying updated in the cybersecurity field and the importance of hands-on learning.

Takeaways

The podcast aims to make security accessible to everyone.

Machine identities are non-interactive identities used in IT environments.

Organizations may have up to 80 machine identities for every human identity.

Visibility and management of machine identities are significant challenges.

Over-privileged accounts are a common issue in organizations.

Applying the principle of least privilege is crucial …
From Cybercriminal to Defender: An Incredible Hacker Redemption Story | Hieu Minh Ngo

30 juli 2025 · 48 min
Afspelen

Hieu Minh Ngo, a former cybercriminal turned cyber threat investigator, shares his remarkable journey from the dark depths of hacking to a profound commitment to cybersecurity. In this episode, we delve into Hieu's transformation, which commenced with his early fascination with computers in Vietnam and evolved into illicit activities on the dark web. Following a significant prison sentence, Hieu emerged with renewed purpose, dedicating himself to combating cybercrime and educating others about online safety. His experience highlights the critical importance of mentorship and community in guiding young hackers towards ethical paths. Through his work with the Vietnamese government and various organizations, Hieu is now actively shaping a safer digital landscape while inspiring the next generation to utilize their skills for good. Lees meer

In this episode of the Security by Default podcast, host Joe Carson interviews Hieu Minh Ngo, a former cyber-criminal turned cybersecurity advocate. Hieu shares his journey from a curious teenager in Vietnam to a successful hacker, his time in prison, and his eventual redemption as he now works to help others avoid the pitfalls he faced. He discusses the importance of honesty, mentorship, and using one's skills for good, emphasizing the need for awareness in cybersecurity and the potential for change in the lives of young hackers.

Takeaways

Hieu Minh Ngo transitioned from a cyber-criminal to a cybersecurity advocate.

His journey began with curiosity about computers and the internet.

He faced severe consequences for his hacking activities, including imprisonment.

Prison became a time for self-reflection and personal growth for Hieu.

He emphasizes the importance of being honest with oneself.

After prison, he was recruited by the Vietnamese government for cybersecurity work.

Hieu now mentor’s young hackers to use their skills for good.

He believes in the power of community and positive influences.

Hieu encourages young hackers to par…
Understanding Identity Threats in Cybersecurity with Filipi Pires

16 juli 2025 · 49 min
Afspelen

In this episode of the Security by Default podcast, host Joe Carson speaks with Filipi Pires, a cybersecurity expert with a diverse background in both technical and sales roles. They discuss Filipi's journey into cybersecurity, the importance of identity in security, and the challenges organizations face with misconfiguration. The conversation also covers tools and techniques used in cybersecurity research, the significance of observability, and the need for continuous learning in the field. Filipi shares insights on community engagement and the importance of respecting the journey in one's cybersecurity career. Lees meer

Takeaways

Identity is a central theme in cybersecurity.

Misconfiguration is a leading cause of security issues.

Continuous learning is essential in the cybersecurity field.

Tools should be used to understand techniques, not just for their own sake.

Community engagement is vital for knowledge sharing.

Phishing remains a simple yet effective attack method.

Legacy software poses significant risks to organizations.

Observability is crucial for effective security management.

Respecting the journey in cybersecurity is important for growth.

Chapters

00:00 Introduction to Cybersecurity Journey

02:49 Exploring Cybersecurity Research and Trends

05:32 Tools and Techniques in Cybersecurity Research

08:34 Learning Through Capture The Flag Events

11:28 Identity Threats and Misconfigurations

14:16 Legacy Systems and Their Impact on Security

25:40 Understanding Use Cases in Security Permissions

27:36 The Principle of Least Privilege

29:31 The Complexity of Identity Management

30:28 Challenges in Observability and Access Control

32:16 Navigating Multi-Cloud Permissions

34:07 Tools for Enhancing Security Visibility

36:14 Continuous Learning in Cybersecurity

41:53 Community Engagement and Knowledge Sharing

45:32 Respecting the Journey in Cybersecurity

Companies mentioned in this episode:

Segura

Trend Micro

Black Hat

Defcon

BSIDES

AWS

GCP

Azu…
The Hacker Building AI Tools to Find Security Weaknesses | Carlos Polop

2 juli 2025 · 29 min
Afspelen

The primary focus of this podcast episode revolves around the innovative contributions of Carlos Polop to the field of cybersecurity, particularly through his work on HackTricks and various vulnerability assessment tools. Carlos shares his journey into the realm of hacking, which began later than most, ignited by a curiosity to overcome Wi-Fi challenges. He elaborates on the creation of Hack Tricks, a comprehensive repository of hacking techniques that serves not only as a personal resource but also as a pivotal educational tool for the cybersecurity community. Throughout our dialogue, we delve into the transformative impact of artificial intelligence on the industry, examining how tools like Hack Tricks AI facilitate learning and vulnerability detection. Additionally, Carlos emphasizes the importance of embracing AI as a powerful ally in enhancing one's skills and knowledge within this ever-evolving landscape of cybersecurity. Lees meer

In this episode of the Security by Default podcast, host Joe Carson welcomes back cybersecurity expert Carlos Polop. They discuss Carlos's journey into the cybersecurity field, the creation and impact of HackTricks, and the role of AI in cybersecurity. Carlos shares insights on using large language models for hacking, the future of AI, and upcoming training courses.

The conversation emphasizes the importance of ethical hacking and the need for continuous learning in the rapidly evolving tech landscape.

Key Takeaways

HackTricks was created as a personal resource for learning and sharing knowledge.

The community has greatly benefited from HackTricks in their learning journeys.

AI is revolutionizing the field of cybersecurity and coding.

Large language models can assist in finding vulnerabilities and automating tasks.

It's important to ask the right questions when using AI tools.

Carlos is developing new training courses focused on cloud security and privilege escalation.

Hacktricks AI is designed to help users with specific cybersecu…
Exploring the Evolution of Identity Governance and Administration with Martin Sandren

18 juni 2025 · 35 min
Afspelen

This podcast episode delves profoundly into the intricate nuances of Identity Governance and Administration (IGA) within the broader context of Identity and Access Management (IAM). We engage in a comprehensive dialogue with Martin, a seasoned expert in the field, who elucidates the fundamental distinctions between IGA and IAM while tracing the historical evolution of IGA systems, notably highlighting the transformative impact of regulatory developments. Our conversation further explores the contemporary challenges facing IGA, particularly in light of the dynamic workforce and the escalating sophistication of cyber threats, underscoring the necessity for organizations to adapt their identity strategies accordingly. Additionally, we examine the pivotal role of artificial intelligence and cloud technologies in modernizing IGA frameworks, thereby enhancing operational efficiency and security posture. This episode promises to furnish listeners with invaluable insights and perspectives that are essential for navigating the complexities of identity management in today’s ever-evolving digital landscape. Lees meer

In this conversation, Joseph Carson and Martin Sandren delve into the evolving landscape of Identity Governance and Access Management (IGA). They discuss the significance of IGA in modern organizations, the challenges faced, and the impact of cloud solutions and AI on identity management. The conversation highlights the need for contextual and adaptive policies, the importance of interoperability, and the role of community engagement through conferences to stay updated in this rapidly changing field.

Key Takeaways

IGA is essential for managing access and compliance in organizations.

The shift to cloud-based IGA solutions has transformed the landscape.

Contextual and adaptive policies are becoming the norm in identity management.

AI is playing a crucial role in enhancing identity governance.

Interoperability between systems is a significant challenge.

Phishing attac…
Unveiling the Art of Hardware Hacking with Joe Grand

4 juni 2025 · 54 min
Afspelen

This podcast episode centers on the exploration of hardware hacking, emphasizing the significance of continuous learning and community engagement within the hacker culture. I am joined by the esteemed Joe Grand, a prominent figure in the hardware hacking domain, who shares his extensive knowledge and experiences. Throughout our conversation, we elucidate the importance of collaboration and mentorship as pivotal elements that foster innovation and drive progress in the field. Grand reflects on his own journey, highlighting the challenges and triumphs he has encountered, ultimately inspiring listeners to embrace their curiosity and pursue their passions in technology. As we delve into the nuances of hacking and security, we hope to ignite a fervor for exploration and knowledge-sharing among our audience. Lees meer

In this episode, Joe Carson interviews Joe Grand, a renowned hardware hacker and educator. They discuss Joe Grand's journey into hacking, the importance of community and collaboration in the field, and the evolution of technology and security challenges over the years. Joe shares his early experiences with computers, his transition from engineering to hardware hacking, and the pivotal role of the Loft in shaping his career. The conversation also touches on the founding of @Stake (ATstake, Inc.) and the challenges of balancing passion with corporate expectations in the cybersecurity industry.

In this conversation, Joe Grand discusses his journey in the hacking community, including his experiences designing badges for Defcon, the importance of artistic engineering, and the impact of live hacking events. He shares insights on parenting in the digital age, the significance of legacy software security, and the challenges of vendor communication. Joe also highlights his current projects, the learning process through failure, and resources for aspiring hackers, culminating in a discussion about his involvement in a film related to cryptocurrency.

Takeaways

Community and…
Harnessing AI: The Future of Cybersecurity and Data Governance with Terence Jackson

21 mei 2025 · 35 min
Afspelen

The primary focus of this podcast episode is the evolving role of Chief Information Security Officers (CISOs) in the contemporary cybersecurity landscape, particularly in relation to the integration of artificial intelligence (AI) into security strategies. We engage in a profound discussion about the necessity for CISOs to adapt their approaches in light of increasing data complexities and the rapid advancement of AI technologies, which pose both new challenges and opportunities for organizations. The conversation highlights the critical importance of foundational cybersecurity practices such as identity and access management, data governance, and the implementation of zero trust frameworks. Moreover, we explore the pressing need for CISOs to move beyond traditional IT security paradigms, embracing their roles as risk managers who facilitate secure business operations rather than merely enforcing restrictions. As we delve into this intricate subject, we underscore the significance of a proactive and informed approach to managing cybersecurity risks in an era marked by relentless technological evolution. Lees meer

In this episode of the Security by Default podcast, host Joseph Carson speaks with cybersecurity expert Terence Jackson about the evolving landscape of cybersecurity, the challenges faced by CISOs, and the importance of data security and governance. They discuss the impact of AI on security practices, the role of the CISO as a risk manager, and the need for organizations to prioritize foundational security measures in a rapidly changing technological environment.

In this conversation, Terence Jackson and Joseph discuss the evolving landscape of cybersecurity, emphasizing the importance of asset management, the role of AI in business intelligence, and the need for a balance between security and user experience. They explore the future of CISOs in a world increasingly governed by digital intelligence and the necessity of continuous learning and community engagement …

Alle afleveringen

Human Resilience with James McQuiggan

Same Scams, Cleaner Wrapper: Cybersecurity Awareness Month in the AI Era with Erich Kron

Passwords, Passkeys & Rogue AI Agents | Credentials in the Age of AI with Evil Mog

When a Simple Breach Became a Crisis: Lessons We Learned | Lukas Hlavicka

From Legacy to Modern PAM: A Migration Playbook with Erik Siebler

Navigating the Convergence of Physical Security and Digital Access | Daniel Raines

L0pht Legend Chris Wysopal on the Evolution of Application Security

Ransomware Unmasked: Inside the World's Biggest Cybercrime Gang | Geoff White

The Voice of the Customer: Why Listening Beats Selling with David Muniz

Why Identity Is Becoming Every CISO's Biggest Challenge | Vlad Shapiro

How Hackers Attack AI: The New Battle to Secure Intelligent Machines | Harriet Farlow

AI Is Not Magic: The Truth Behind the Technology Changing Everything | Diana Kelley

Why Cybersecurity Fails Without Trust: The Human Side of Defense | JC Vega

Can AI Beat Hackers? The Future of Cyber Training Has Changed | Hack The Box

Behind the Scenes: How Cybersecurity Decisions Really Get Made | Fernando Montenegro

Can We Make Cybersecurity Fun Again? Turning Fear Into Action | Gary Berman

Inside Modern Cyber Warfare: The Invisible Battles Happening Every Day | Chris Kubecka

How Anyone Can Become a Hacker: Learning Cybersecurity the Right Way | Ian Austin

Inside Password Cracking: How Hackers Really Break Your Secrets | Evil Mog

Understanding the Critical Role of Identity in Modern Cybersecurity with Charles Chase

A Deep Dive into Cyber Operations and OSINT with The Grugq

Building Resilience in Cybersecurity: Lessons from Joe Sullivan

Laughing with Cyber - A Standup Comedy Special with Ian Murphy

From Teenage Hacker to Hollywood: A Cybersecurity Story You Won’t Believe | Alissa Knight

Understanding Customer Success: Beyond Support in Cybersecurity

Personalizing Cybersecurity Training: The Key to Modern Defense Strategies Michael Waite

The Future of Trustworthy AI: Insights from Satu Korhonen

The Evolving Landscape of Identity Threats: Strategies for Mitigation and Awareness

Cyber Law Unveiled: Bridging Security and Legal Perspectives with Pamela Victor Ibitamuno

The Role of Game Design in Cybersecurity Training with Peadar

Your Security Badge Can Be Hacked: RFID Secrets Exposed | Iceman

Understanding Cybersecurity: The Importance of Effective Storytelling

Exploring the Intricacies of Cybersecurity Marketing with Zara Pirzada

Bringing Clarity to Cybersecurity: A Conversation with Harry Coker Jr.

A Legacy of Malware: Mikko Hyppönen Reflects on His Career

Unveiling the Complexity of Non-Human Identities in Cybersecurity with Evandro Goncalves

From Cybercriminal to Defender: An Incredible Hacker Redemption Story | Hieu Minh Ngo

Understanding Identity Threats in Cybersecurity with Filipi Pires

The Hacker Building AI Tools to Find Security Weaknesses | Carlos Polop

Exploring the Evolution of Identity Governance and Administration with Martin Sandren

Unveiling the Art of Hardware Hacking with Joe Grand

Harnessing AI: The Future of Cybersecurity and Data Governance with Terence Jackson