Voices from the field
Podcasts, talks, and practitioner perspectives with a short note on the lesson worth keeping.
Johannes Ullrich’s 12 October Stormcast connects an overused TLP label, research into Bedrock AgentCore permissions, and an exploited GlobalProtect flaw.
The common thread is a boundary that looks reassuring on paper but needs a working control behind it: safe sharing, narrow agent permissions, and a patched VPN gateway.
David Spark, Steve Zalewski, and sponsored guest Mark Stockley discuss why smaller organisations are underserved and what a usable baseline might look like.
The strongest question is not whether an enterprise tool can be sold cheaply. It is who will configure, monitor, and respond when a small team has no dedicated security staff.
Johannes Ullrich’s 2 October Stormcast looks at a phish carrying a real ScreenConnect client, a ClickFix lure inside a custom GPT, and two different email-identity tricks.
The useful question is not whether a tool or website looks familiar. It is who controls the next step: the remote session, the command a user is asked to paste, or the identity an email appears to carry.
David Spark, Geoff Belknap, and Howard Holton ask why the same cybersecurity debates fill our feeds year after year—and when repeating them is actually useful.
A familiar slogan can help someone new to the field. For a team making a decision, it needs another sentence: what evidence would show whether the advice worked here?
The 24 September episode covers Amazon blocking Meta’s Muse shopping agent, investigations into compromised tanker networks, Windows File History failures, and a Scattered Spider guilty plea.
The defender thread is accountability at operational boundaries: automated agents should identify themselves, IT and operational technology evidence should remain separable, and backup health needs verification after patching.
The 24 September Stormcast connects a Mac-focused ClickFix campaign, typosquatted Terraform providers, MikroTik authentication bypasses, and the F5 BIG-IP APM flaw.
The practical thread is trust at an execution boundary: pasted terminal commands, infrastructure dependencies, appliance authentication, and oversized authorization data all deserve controls that verify more than a familiar name or interface.
In the 22 September Stormcast, host Johannes B. Ullrich highlights three separate risks: payloads encoded in PNG pixels, a malicious npm package triggered during use, and a Pi-hole configuration flaw.
The common defender question is what happens after a trusted wrapper is accepted: what an image decoder reconstructs, what package code executes, and what an administrator can change through a management interface.
The 21 September episode connects a Gemini test that reached real systems, a researcher-led chain through OpenAI’s help forum and SSO, and a browser extension technique aimed at AI assistants.
Three different stories point to the same operational need: define scope, privileges, and monitoring around AI-enabled systems before giving them access to accounts or other environments.
In a Super Cyber Friday Express bonus episode, David Spark and guests Karl Mattson and Howard Holton discuss how security teams can choose tools they can operate and vendors they can trust.
The useful test is a real workflow: can practitioners use the product in their environment, and will the vendor’s support, pricing, and business terms hold up after the demo?
A breach story that shows how trusted relationships can be more valuable to attackers than zero-days.
My takeaway: identity controls need operational safeguards, not only technical policy. Helpdesk procedures are part of the security boundary.
A practical argument for detections that survive when attackers change infrastructure or payloads.
My takeaway: anchor coverage in attacker objectives and observable behaviors, then map the telemetry required to see them.
Experienced responders discuss why premature certainty can narrow an investigation too early.
My takeaway: preserve competing hypotheses, record assumptions, and separate observed facts from interpretation.
A discussion of credentials, ownership, and lifecycle failures around service accounts.
My takeaway: every machine identity needs a clear owner, purpose, expiry path, and observable baseline.