Risky Business Podcast

On this week’s show special guest co-host Rob Joyce joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. Rob served as an advisor to Donald Trump during his first term as president and also served at NSA for 34 years. While at the agency, Joyce led Tailored Access Operations (TAO), and later became NSA’s Director of Cybersecurity.

They cover:

• The surprisingly well done Fortibleed campaign
• Stolen Klue OAuth tokens lead to Salesforce data theft
• OpenAI wants to patch the planet
• runZero gets acquired by Accenture, congrats HD Moore!
• Much, much more!

This episode is also available on YouTube.

On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover:

• Anthropic’s Fable 5 and Mythos 5 get nuked by the US government four days after launch “because security”
• Why “guardrails” won’t keep the world safe from your AI doomsday machine
• The FISA 702 statute expired, but the spying can (probably) continue!
• NPM v12 delivers some protection against supply chain attacks, but not enough.
• Microsoft has a series of bugs that prevent Windows Update from … updating
• Much, much more!

This episode is also available on YouTube

On this week’s show special guest co-host Chris Wade, the founder of Corellium turned Cellebrite CTO, joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news.

They cover:

• Microsoft has repos owned, GitHub tokens popped, and a new 0day dropped on them
• Meanwhile, researchers are choosing full disclosure instead of engaging MSRC
• Meta’s AI support agent allowed a staggering 20,000 accounts to be stolen!
• Apple pulls Russia’s MAX messenger from the App Store and disables notifications
• Anthropic gives the public our first Mythos-class model but it won’t do cybersecurity work
• Stripe and Google Tag Manager used in eCommerce website hack campaign
• And much, much more!

This week’s show is brought to you by runZero. HD Moore, runZeros’ founder, drops by in this week’s sponsor interview to talk about the AI vibe shift. Everyone is very worried about getting owned all of a sudden, and it’s really changing the cybersecurity business.

This episode is also available on YouTube.

In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with Edward Wu, founder of Dropzone, about what AI is doing to detection, response and the SOC more generally.

Dropzone makes AI agents that conduct alert investigations in your SOC, but will the SOC as we know it even exist in the future?

Ed has a deep expertise in SOC tech, having previously led AI/ML detection engineering at Extrahop. This interview is a fantastic look at what the future may bring for detection and response professionals.

This episode is also available on YouTube

On this week’s show special guest co-host Andy Boyd joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. Andy is the CEO of REDLattice, which makes the Paragon “intelligence collection and reconnaissance” solution.

They cover:

• Adversaries are tracking US troop locations with commercially available location data
• A new Signal phishing campaign is going after message backups
• 404 Media is suing ICE to get its spyware contract with REDLattice (lol)
• Microsoft’s tone-deaf response to ‘never justifiable’ zero-day disclosures
• Mini Shai-Hulud pops up again just as Glassworm gets shattered
• Much, much more

This week’s episode is sponsored by Authentik, an open source identity platform that you can host yourself. In this week’s sponsor interview Authentik’s CEO Fletcher Heisler joins Patrick Gray to talk about how they’re keeping up with the bugpocalypse, and also the work they’re doing to support identities for AI agents.

This episode is also available on YouTube.

On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover:

• TeamPCP breached GitHub’s internal repos. Now what?
• Some absolute plonker glued Coruna to a hijacked npm package
• CISA is worried about about open source and wants third party submissions for KEV
• AI infrastructure is “systemically” insecure
• Much, much more

This week’s episode is sponsored by allowlisting vendor Airlock Digital. Airlock’s founders David Cottingham and Daniel Schell join Patrick Gray to talk about Microsoft briefly flagging DigitCert’s root certificate as malware. Fun!

This episode is also available on YouTube

On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news.

They cover:

• GitHub announced a possible breach
• CISA leaks important creds, keys in public repo
• Awful vulnerability in Bitlocker renders it useless without a PIN
• So. Many. Patches.
• Polish Government urges officials to ditch Signal for mSzyfr
• Much, much more

This week’s show is brought to you by Thinkst Canary. Thinkst’s founder, Haroon Meer, is this week’s sponsor guest. He joined James Wilson to talk about how doing “the basics” in security isn’t trivially easy.

This episode is also available on YouTube.

In this sponsored soap box edition of the Risky Business podcast Patrick Gray chats with Toni de la Fuente, the founder of Prowler.

Prowler started off as a bunch of scripts in a trenchcoat, then became an open source cloud security tool, and it’s now a venture-funded cloud security business. In this interview Toni talks us through how AI is changing the game for him as an open source project owner, and as a vendor. In short, reports of the death of IT and security tooling at the hands of frontier models have been greatly exaggerated.

This episode is also available on Youtube.

On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news.

They cover:

• Mini Shai-Hulud and the TanStack compromise using Github Actions
• Instructure pays Canvas elearning platform data extortionists
• More Linux privilege escalation 0days!
• CISA helping critical infrastructure operators rearchitect their networks so they work offline

This week’s episode is sponsored by email security platform Sublime Security. Bobby Filar chats with Patrick about how agentic AI is being evaluated by buyers in a marketplace that’s experiencing “AI fatigue”.

On this week’s show, Patrick Gray and James Wilson are joined by special guest co-host Brad Arkin. They discuss the week’s cybersecurity news, including:

• The US Government says we just have to patch faster, but…
• Bugs in cPanel, MoveIt and all Linux distributions this week show that patching alone isn’t enough
• James gets mad about lame AI Agent adoption advice from the US and Australian Governments
• James Kettle and Niels Provos both showed us that any model can find 0day like Mythos
• And the cyber-assisted theft of cargo results in an astonishing loss of $725 million dollars

This week’s show is sponsored by SpecterOps. Their CTO, Jared Atkinson, chats to Pat about the big changes in the threat landscape, brought about by AI, that are causing a pivot away from detection and remediation, and toward prevention.

This episode is also available on Youtube.