PodcastEducationEnglish

Bare Metal Cyber

by Dr. Jason Edwards

NewBare Metal Cyber Weekly Roll-Up — October 23, 2026October 23, 2026 · 24 min

Episodes: 114
Released: daily
Latest episode: Oct 23, 2026

About the podcast

Welcome to Bare Metal Cyber, the podcast that bridges cybersecurity and education in a way that’s engaging, informative, and practical. Hosted by Dr. Jason Edwards, a seasoned cybersecurity expert and educator, this weekly podcast brings to life the insights, tips, and stories from his widely-read LinkedIn articles. Each episode dives into pressing cybersecurity topics, real-world challenges, and actionable advice to empower professionals, educators, and learners alike. Whether navigating the complexities of cyber defense or looking for ways to integrate cybersecurity into education, Bare Metal Cyber delivers valuable perspectives to help you stay ahead in an ever-evolving digital world. Subscribe and join the thousands already benefiting from Jason’s expertise!

Episodes 114

Bare Metal Cyber Weekly Roll-Up — October 23, 2026
October 23, 202624 minSeason 2 · Episode 76
This partial-week edition covers a sharp collision between public-service disruption, trusted cloud access, and software supply-chain risk. Government agencies took vulnerable PHP services offline as attacks …
Show notes
This partial-week edition covers a sharp collision between public-service disruption, trusted cloud access, and software supply-chain risk. Government agencies took vulnerable PHP services offline as attacks spread, showing how quickly an internet-facing runtime problem can become a citizen-service issue. A ConnectWise path then gave a China-aligned group high-speed access attempts against Microsoft 365 customers, with AI helping scale familiar identity abuse. Meanwhile, a poisoned LiteLLM release put cloud, developer, and AI credentials at risk across multiple operating systems. The issue also tracks ransomware pressure on critical organizations and a Railway incident that may expose secre…
This week's stories:
Government services go dark as attacks spread across PHP servers
Trusted ConnectWise access speeds AI-driven Microsoft 365 attacks
Poisoned LiteLLM release puts cloud and developer secrets at risk
SafePay ransomware reaches 600 critical infrastructure organizations
Railway incident exposes secrets that unlock connected cloud services
Internet-facing GitLab servers face urgent takeover risk
Japan cloud shutdown disrupts workloads across nearly 27,000 servers
Crime-tip breach exposes identities and forces Toronto service offline
Weak certificate keys undermine trust across browsers and software
Ransomware crews turn trusted VPN access into a stealthy foothold
Stolen management keys put 400,000 WordPress sites at risk
Capcom breach exposes account data for 11.7 million users
Autonomous AI agents accelerate real-world intrusion campaigns
Active Plex attacks turn home media servers into privileged footholds
Active VeloCloud attacks threaten control of managed networks
More cybersecurity coverage at BareMetalCyber.com.
Bare Metal Cyber Weekly Roll-Up — October 16, 2026
October 16, 202624 minSeason 2 · Episode 75
This week shows how trusted technology can become a direct route to physical damage and enterprise compromise. Attacks on supermarket refrigeration systems spoiled food, caused fires and drove losses into the …
Show notes
This week shows how trusted technology can become a direct route to physical damage and enterprise compromise. Attacks on supermarket refrigeration systems spoiled food, caused fires and drove losses into the millions, bringing operational technology risk into clear business focus. At the same time, attackers gained deep access through Ivanti gateways that were fully patched when intrusions began, proving that updates alone cannot establish whether an edge device is clean. A separate espionage operation used a compromised BeyondTrust support appliance to reach downstream systems, pursue credentials and collect sensitive documents. The wider issue also examines an industrial phishing marketp…
This week's stories:
Food loss and fires follow attacks on supermarket refrigeration
Corporate credentials stolen through fully patched Ivanti gateways
Corporate networks exposed through compromised BeyondTrust support tools
One billion phishing messages reveal an industrial fraud marketplace
Live government sites were breached during AI safety tests
Public exposure of AI and industrial systems keeps rising
Targeted online ads delivered zero-click spyware to news devices
Burger King Japan breach exposes 11.18 million app records
Crypto wallets hide implants that steal recovery secrets
Fake remote workers use laptop farms to enter major employers
Record Microsoft patch load includes a Windows flaw under attack
Retail giant outage disrupts apps, orders and staff access
Weak password opens population records tied to 8.8 million people
UK legal aid breach reaches sensitive records dating back to 1978
Cisco email gateways face active attacks with root-level access
More cybersecurity coverage at BareMetalCyber.com.
Bare Metal Cyber Weekly Roll-Up — October 9, 2026
October 9, 202625 minSeason 2 · Episode 74
This week’s roll-up opens with a cloud ransomware outage that disrupted hundreds of companies and local governments in Japan, showing how one provider incident can spread across many operations. A sweeping …
Show notes
This week’s roll-up opens with a cloud ransomware outage that disrupted hundreds of companies and local governments in Japan, showing how one provider incident can spread across many operations. A sweeping FortiGate campaign also shows the danger of stolen privileged credentials, persistent administrator accounts, and ransomware access at the network edge. In Denmark, misuse of a trusted company’s registry access exposed identity data tied to millions of people. The issue also tracks active NetScaler compromises that can outlive patching and attacks against self-hosted Atlassian systems within hours of disclosure. Together, these stories make one theme clear: resilience depends on third-par…
This week's stories:
Japan cloud ransomware outage disrupts 495 organizations
Stolen FortiGate access locks out admins and fuels ransomware
Denmark registry breach exposes data tied to 8.8 million people
NetScaler attacks disrupt remote access and leave hidden control
Sensitive Atlassian files face attacks within hours of disclosure
FBI disrupts China-linked attacks on critical infrastructure
Pentagon breach creates long-term identity risk for millions
Old SharePoint gaps drive ransomware into critical services
Country-code registry breaches enable trusted website impersonation
South Korean bank breaches expose customer and worker data
Developer secrets exposed by a compromised Tensorlake package
Developer access turns into cloud exposure through GitHub workflows
GitHub users face malware across 17,610 FakeGit repositories
Helpdesk breach reaches full server control in seconds with AI
Exposed AI servers become cryptomining and attack launchpads
More cybersecurity coverage at BareMetalCyber.com.
Bare Metal Cyber Weekly Roll-Up — September 25, 2026
September 25, 202624 minSeason 2 · Episode 73
This week’s roll-up opens with ransomware crews exploiting TeamCity servers, putting trusted software build pipelines and downstream customers at risk. It then turns to actively exploited edge and security …
Show notes
This week’s roll-up opens with ransomware crews exploiting TeamCity servers, putting trusted software build pipelines and downstream customers at risk. It then turns to actively exploited edge and security systems that can hand attackers control over network access and policy. A third major theme is scale: AI-assisted attacks reportedly stole more than 600,000 payment card records while reaching scores of retailers. The issue also examines altered water controls and a phishing service tied to 12,000 compromised Microsoft inboxes. Across the week, defenders face the same pressure: shorten patch windows, protect privileged control planes, and verify identities that ordinary reviews overlook.…
This week's stories:
Software pipelines face ransomware through exploited TeamCity servers
Network access and security tools face active edge-system attacks
Online retailers lose 600,000 payment cards in AI-assisted attacks
Foreign hackers alter water controls at two Colorado utilities
Device-code phishing compromises 12,000 Microsoft inboxes
Gyazo breach exposes 23.62 million users and screenshot metadata
AI agent crosses Australian government access controls unnoticed
FBI jobs portal incident puts personnel and applicants at risk
Forgotten Microsoft 365 accounts expose emails, chats and files
Fake job interviews infect 30,000 devices across 100 countries
WordPress attacks begin within hours of a critical security fix
SharePoint attacks put unpatched and unsupported servers at risk
Nearly 1,000 Zyxel switches breached across 48 countries
Roundcube attacks threaten exposed webmail accounts and data
GitLab email tokens can open private code and software pipelines
More cybersecurity coverage at BareMetalCyber.com.
The Last Legacy System
July 16, 202620 minSeason 2 · Episode 72
Retiring a legacy system sounds simple until you realize one platform has quietly become the backbone of revenue, reporting, and regulatory history. In “The Last Legacy System: Planning for the Day You Finally …
Show notes
Retiring a legacy system sounds simple until you realize one platform has quietly become the backbone of revenue, reporting, and regulatory history. In “The Last Legacy System: Planning for the Day You Finally Turn It Off,” the narrated version walks leaders through why one or two systems always outlive every modernization wave and why that matters for risk, resilience, and strategy. You will hear how technical entanglements, business lore, and hero culture combine to keep that last legacy system alive long after it should have been a conscious, time-bound decision.
From there, the episode follows the structure of the Wednesday “Headline” feature from Bare Metal Cyber Magazine. It explores how to move from migration talk to a true business decision, how to model and rehearse the turn-off so it fails safely instead of catastrophically, and how to handle the humans in the loop whose identities are tied to keeping the system running. It closes by looking forward: what it means to design today’s systems with explicit exit strategies, clearer ownership, and governance that treats decommissioning as a first-class concern, so you do not quietly build the next untouchable relic.
Real-World Recovery
July 16, 202616 minSeason 2 · Episode 71
When a major incident hits, most organizations still cling to the promise of “getting back to normal.” In this narrated Headline, “Real-World Recovery: When ‘Return to Normal’ Is the Wrong Goal,” we look at why …
Show notes
When a major incident hits, most organizations still cling to the promise of “getting back to normal.” In this narrated Headline, “Real-World Recovery: When ‘Return to Normal’ Is the Wrong Goal,” we look at why that mindset quietly undermines resilience. The episode walks through how complex, cloud-heavy environments never truly return to a previous baseline, and why leaders are better served by thinking in terms of new, intentional steady states instead of rewinds. This audio is developed from my Wednesday “Headline” feature in Bare Metal Cyber Magazine, with a focus on the decisions that shape recovery long after the alerts stop.
Across the narration, we explore the myth of “normal operations,” reframing recovery as a large-scale reconfiguration of identity, trust boundaries, and vendor dependencies. We dive into planned degraded modes and deliberate sacrifice decisions, then move into a portfolio view of recovery using named operating states rather than a single DR script. Finally, we turn to the leadership side: how to communicate that “normal has changed,” how to align boards and regulators on new baselines, and how to reward sustainable resilience instead of just fast restores. It is a practical guide for leaders who know incidents are inevitable and want their recovery story to match reality.
Culture of Disclosure
July 16, 202618 minSeason 2 · Episode 70
In this narrated edition of “Culture of Disclosure: From ‘Don’t Tell Anyone’ to ‘Report Early, Fix Faster’”, we walk through what really decides whether your organization hears the truth in time to act. You …
Show notes
In this narrated edition of “Culture of Disclosure: From ‘Don’t Tell Anyone’ to ‘Report Early, Fix Faster’”, we walk through what really decides whether your organization hears the truth in time to act. You will hear how informal stories, career incentives, and leadership reactions quietly create a shadow “don’t tell anyone” policy, even when formal reporting channels exist. We connect those patterns to hard security outcomes: time-to-discovery, who finds your issues first, and how much room you have to maneuver when something goes wrong. This is a practical listen for leaders who suspect they are getting a filtered view of reality.
The episode then breaks down the architecture of a healthy disclosure culture in plain, leader-ready terms. We look at psychological safety as a security control, the design of simple pipes for early reporting, and the metrics that reward high-signal disclosures instead of only counting fires. Finally, we explore what it looks like to lead when disclosure gets painful, from late-breaking findings before a launch to regulatory and customer communications. The narration is based on my Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed to help you pressure-test your own culture of disclosure.
Metrics That Move Money
July 16, 202621 minSeason 2 · Episode 69
Security budgets rarely shift because of bigger dashboards. They shift when leaders can see, in plain business terms, how specific security gaps shape financial exposure and how targeted investments change that …
Show notes
Security budgets rarely shift because of bigger dashboards. They shift when leaders can see, in plain business terms, how specific security gaps shape financial exposure and how targeted investments change that picture. This narrated edition of Metrics That Move Money: Turning Security Data into Budget Decisions walks through how senior teams can move past activity counts and into a shared financial language for cyber risk. Grounded in my Wednesday “Headline” feature from Bare Metal Cyber Magazine, the episode explores why so many familiar metrics fail to influence funding, and how narrative metrics built around coverage, exposure, time at risk, and resilience create a clearer basis for capital allocation.
Across the article’s major sections, you’ll hear how to translate technical posture into impact ranges executives can use, how to compare very different security initiatives using a portfolio lens, and how the psychology and politics of budget conversations can either support or undermine your case. The episode also breaks down how to build a repeatable metrics operating system—one that survives tool changes, leadership turnover, and shifting business priorities. Whether you’re a CISO preparing for annual planning or a technology leader aiming to strengthen your financial storytelling, this narrative offers a durable model for making security metrics matter where it counts: in real budget decisions.
Citizen Developers Enterprise Risk
July 16, 202617 minSeason 2 · Episode 68
Citizen developers are no longer the exception in large enterprises; they are quietly building the workflows your business now depends on. In this narrated edition of “Citizen Developers, Enterprise Risk …
Show notes
Citizen developers are no longer the exception in large enterprises; they are quietly building the workflows your business now depends on. In this narrated edition of “Citizen Developers, Enterprise Risk: Low-Code Apps You Didn’t Approve,” we explore why low-code and no-code platforms have become the default escape valve for backlogs and rigid roadmaps, and what that really means for risk. The episode walks through the core concept of citizen development as an inevitable pattern, not a fringe behavior, and reframes “unapproved” apps as a governance and ownership problem rather than a simple policy violation. This narration is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
From there, the episode unpacks the key sections of the article in practical language for security and technology leaders. You will hear the anatomy of typical low-code failures, the recurring patterns behind outages and data exposure, and a governance model that channels citizen energy into sanctioned platforms with guardrails instead of pushing it underground. We talk through the idea of a two-speed control plane, how to tier controls based on data sensitivity and blast radius, and what it means to measure and own citizen risk alongside your other technology risks. The goal is to give you a clear mental model you can carry into leadership meetings and risk discussions, not a checklist to memorize.
Post-Quantum Paralysis
July 16, 202618 minSeason 2 · Episode 67
In this narrated Headline, “Post-Quantum Paralysis: Preparing for a Crypto Shift Without Freezing Roadmaps,” we unpack what post-quantum cryptography (PQC) really means for long-lived data, trust systems, and …
Show notes
In this narrated Headline, “Post-Quantum Paralysis: Preparing for a Crypto Shift Without Freezing Roadmaps,” we unpack what post-quantum cryptography (PQC) really means for long-lived data, trust systems, and roadmaps that stretch over years. Instead of chasing a mythical “Q-day,” this episode focuses on the quieter but more dangerous problem: adversaries harvesting encrypted data now, uneven vendor timelines, and platforms that cannot evolve their crypto assumptions fast enough. You will hear how quantum risk shows up in real planning conversations and why the biggest threat is often organizational paralysis rather than a single breakthrough in a lab.
The episode walks through the key sections of the article in plain, leader-focused language. We explore how to identify the “crypto gravity wells” in PKI, identity, embedded, and vendor-heavy systems; how to treat PQC as a portfolio of bets based on data lifetime and refactor cost; and how to design for crypto agility so future algorithm changes feel like platform maintenance, not emergency surgery. Finally, we look at governance, budgets, and board communication, showing how PQC work can be integrated into existing roadmaps instead of competing with them. This narration is based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine.
Access Broker Auction House
July 16, 202615 minSeason 2 · Episode 66
This narrated episode, based on the Wednesday “Headline” feature in Bare Metal Cyber Magazine, takes you inside the underground market where initial access brokers (IABs) quietly auction off entry into …
Show notes
This narrated episode, based on the Wednesday “Headline” feature in Bare Metal Cyber Magazine, takes you inside the underground market where initial access brokers (IABs) quietly auction off entry into corporate networks. Across the episode, we unpack how access gets found, stabilized, and turned into inventory, and why seemingly small design choices in identity, segmentation, and remote access show up as selling points in those listings. The focus stays firmly on leader-level questions: what makes your environment easy to productize, how attackers think about your “street value,” and why this problem will matter over the next several years.
M&A Malware
July 16, 202614 minSeason 2 · Episode 65
Mergers and acquisitions are great for growth, but they can be brutal for your risk profile if you treat cyber as an afterthought. In this audio version of “M&A Malware: Security Debt Hidden Inside …
Show notes
Mergers and acquisitions are great for growth, but they can be brutal for your risk profile if you treat cyber as an afterthought. In this audio version of “M&A Malware: Security Debt Hidden Inside Acquisitions,” we walk through how security debt quietly rides along with deal synergies and why traditional due diligence often fails to surface what really matters. You will hear how the deal room blind spot forms, what kinds of technical, identity, data, and governance debt you are actually buying, and why the integration window is such a powerful opportunity for attackers. This narration is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
From there, the episode moves into what leaders can actually do: redesigning cyber due diligence so it relies on evidence instead of slideware, translating findings into valuation, terms, and go/no-go decisions, and staging integration to avoid turning a new business unit into a lateral movement corridor. We also dig into governance and accountability, including where the CISO fits in the M&A process and what it really means to say no to a bad deal. The goal is not to scare you away from acquisitions, but to help you treat M&A as a strategic security decision you can manage on purpose, instead of a malware vector you only recognize after the fact.
Timezones Timelines and Truth
July 16, 202618 minSeason 2 · Episode 64
In this narrated edition of “Timezones, Timelines, and Truth: Forensics in a Planet-Scale Company,” we dig into why so many major incidents are really arguments about time. You’ll hear how global footprints …
Show notes
In this narrated edition of “Timezones, Timelines, and Truth: Forensics in a Planet-Scale Company,” we dig into why so many major incidents are really arguments about time. You’ll hear how global footprints, multi-region cloud services, and a sprawl of SaaS tools quietly sabotage forensic timelines, even in organizations that think they have “good logging.” We walk through the technical and human realities that make it hard to agree on when an attack truly started, what happened in which order, and how long you were exposed, all based on the clocks and pipelines you’ve already deployed. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
We also step beyond the war room and look at timelines as evidence, not just memory. The episode unpacks where telemetry pipelines distort cause-and-effect, how follow-the-sun operations and chat-driven decisions fragment the human story, and why regulators and customers increasingly treat your timeline as a formal representation of truth. From there, we shift into leadership territory: designing for forensic-grade time, setting expectations with vendors, building log quality and time normalization into your platforms, and modeling “time discipline” in executive communication. If you lead security or technology in a planet-scale company, this is about turning time from a hidden liability into a deliberate part of your incident response architecture.
Sensitive by Default
July 16, 202617 minSeason 2 · Episode 63
This narrated edition of “Sensitive by Default: Designing Systems That Assume Everything Matters” walks through what happens when you stop pretending you can neatly separate “sensitive” from “non-sensitive” …
Show notes
This narrated edition of “Sensitive by Default: Designing Systems That Assume Everything Matters” walks through what happens when you stop pretending you can neatly separate “sensitive” from “non-sensitive” data. We explore how modern stacks turn telemetry, feature flags, observability traces, and AI interactions into high-value intelligence, even when no one labeled it confidential. From there, the episode unpacks why traditional data classification schemes create a comforting mirage and how risk actually concentrates in the messy middle of real data flows, logs, and analytics platforms that leaders rarely revisit once they are wired up.
You will also hear a leader-focused tour of sensitive-by-default patterns for architecture, platform engineering, and governance. We talk about encrypt-by-default storage and messaging, identity and access management (IAM) that favors time-bound and purpose-bound access, and data minimization and transformation techniques that reduce blast radius without killing developer velocity. The episode closes on the leadership moves: funding golden paths as first-class products, choosing the right metrics, and deciding when and how to consciously relax protections. It is all based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine, translated into an audio walkthrough you can take on a commute, a flight, or a late-night architecture review.
Shadow AI Projects
July 16, 202619 minSeason 2 · Episode 62
Shadow AI Projects: The Models Built in Corners of the Business explores the reality that many of your “AI initiatives” never went through an official roadmap. In this narrated edition of our Wednesday …
Show notes
Shadow AI Projects: The Models Built in Corners of the Business explores the reality that many of your “AI initiatives” never went through an official roadmap. In this narrated edition of our Wednesday “Headline” feature from Bare Metal Cyber Magazine, we walk through the quiet places where models and automations already live: vendor “AI assist” toggles, abandoned notebooks, low-code flows, and small scripts that shape real business decisions. The episode explains why smart people go rogue in the first place, how incentives and pressure drive experimentation into the shadows, and what that says about your operating model as a leader.
From there, the episode breaks the problem down into practical pieces. You will hear a clear way to segment shadow AI risk across data, decisions, intellectual property, and operational fragility, and how to move from witch hunts to a discovery program that teams actually trust. We talk through what “guardrails without gridlock” looks like in practice, how to design tiers of AI usage, and how to build an honest narrative for executives, boards, and regulators. By the end, you will have a way to talk about shadow AI that is candid, structured, and usable in your next leadership conversation.
Digital Consequences
July 16, 202618 minSeason 2 · Episode 61
Hybrid threats are changing what it means to “handle an incident,” and this narrated episode walks through how that plays out when protests, outages, and digital campaigns collide. You’ll hear how physical …
Show notes
Hybrid threats are changing what it means to “handle an incident,” and this narrated episode walks through how that plays out when protests, outages, and digital campaigns collide. You’ll hear how physical demonstrations spill into doxxing, harassment, and pressure on online services, and why outages are increasingly used as leverage rather than just unfortunate side effects. We’ll explore how shared infrastructure—payments, cloud, identity, logistics—turns into a pressure point during social unrest, and why it leaves many organizations caught in the middle of political, regulatory, and criminal forces they do not control.
From there, the episode turns to leadership and design. It unpacks how fuzzy ownership between cyber, physical security, legal, HR, and communications amplifies chaos, and what it means to architect for graceful degradation instead of brittle heroics. You’ll hear concrete patterns for hybrid resilience, from segmentation choices to decision playbooks, and how to define a coherent posture in a politicized network where every uptime or shutdown decision is read as a signal. This audio is based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine, “Digital Consequences: Protests, Outages, and Hybrid Threats.”
The Great Unmanaged
July 16, 202618 minSeason 2 · Episode 60
When contractors, partners, and “temporary” staff never really leave your environment, their access quietly becomes part of your infrastructure. In this episode, we walk through how non-employee identities …
Show notes
When contractors, partners, and “temporary” staff never really leave your environment, their access quietly becomes part of your infrastructure. In this episode, we walk through how non-employee identities accumulate around your core systems, why joiner-mover-leaver processes that stop at the HR boundary are no longer enough, and how “temporary” access turns into permanent risk. You will hear concrete patterns from cloud and SaaS environments, where vendor portals, support logins, and one-off project accounts slowly grow into a shadow perimeter that attackers see more clearly than you do.
We then shift into the leadership moves that actually change your risk over time. The conversation covers how to design first-class lifecycles for non-employee identities, including sponsorship, expiry, and re-attestation; how to connect those mechanics to contracts, legal expectations, and third-party risk narratives for the board; and how to build a culture where turning off access is normal, not heroic. This narration is developed from “The Great Unmanaged: Contractors, Partners, and Temporary Access Gone Permanent,” a Wednesday “Headline” feature in Bare Metal Cyber Magazine.
Zero Signal
July 16, 202615 minSeason 2 · Episode 59
This narrated edition of “Zero Signal: When Telemetry Costs More Than the Risk It Mitigates” walks leaders through the uncomfortable reality that security telemetry has become one of the biggest unchecked taxes …
Show notes
This narrated edition of “Zero Signal: When Telemetry Costs More Than the Risk It Mitigates” walks leaders through the uncomfortable reality that security telemetry has become one of the biggest unchecked taxes in modern environments. We look at how logs, traces, and events grew from helpful debugging aids into a sprawling, expensive portfolio that often delivers more noise than signal. You will hear how the economic, operational, and cognitive costs of telemetry accumulate over time and why “log everything” is no longer a defensible default for mature organizations.
From there, the episode traces the key moves in the article: reframing telemetry as a risk instrument, exposing failure modes on both over-collection and over-pruning, and outlining what it means to design visibility on purpose instead of inheriting vendor defaults. We talk through tiered telemetry, business-critical journeys, and the governance decisions that keep costs and coverage in balance. Throughout, the narration stays grounded in leadership conversations and trade-offs, all based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine.
Purple Team Statecraft
July 16, 202611 minSeason 2 · Episode 58
Purple team exercises are showing up on more roadmaps, but many organizations still struggle to turn those war games into real movement on risk, architecture, and budget. In this narrated edition of “Purple …
Show notes
Purple team exercises are showing up on more roadmaps, but many organizations still struggle to turn those war games into real movement on risk, architecture, and budget. In this narrated edition of “Purple Team Statecraft: Turning Exercises into Actual Change,” you will hear how to reframe purple teaming from a technical joint exercise into a deliberate tool of statecraft. The episode walks through what it means to design scenarios around real decisions, capture evidence that survives the room, and connect findings directly to the forums where strategy and spending are actually decided.
Across the story, the narration explores how to plug purple team outputs into governance, avoid blame theater, and build a cadence that keeps the organization in motion rather than chasing novelty. You will hear concrete examples of decision-centered exercises in areas like identity, cloud, and AI adoption, as well as practical ways to measure whether purple teaming is shaping risk appetite and roadmaps instead of just generating colorful reports. This audio is developed from my Wednesday “Headline” feature in Bare Metal Cyber Magazine, giving you a leader-focused walkthrough you can absorb on the move.
Making Alerts Great Again
July 16, 202612 minSeason 2 · Episode 57
When you look past the wall of dashboards in most security operations centers, a tougher reality appears: leaders can see alert volumes and colorful charts, but they cannot always say which attacker behaviors …
Show notes
When you look past the wall of dashboards in most security operations centers, a tougher reality appears: leaders can see alert volumes and colorful charts, but they cannot always say which attacker behaviors they truly catch with confidence. In this narrated audio version of “Making Alerts Great Again: Detection Engineering, Not Dashboard Worship,” we walk through why that gap exists and what it means for security and technology leadership. You will hear a clear explanation of how detection engineering reframes the problem, turning raw telemetry from tools like security information and event management platforms and endpoint detection and response systems into deliberate, testable detections aligned with attacker behavior and business risk.
The episode also breaks down the system and organizational side of the story in practical terms. We explore what a real detection pipeline looks like, who should own detections inside your team, and how to measure detection quality instead of just counting alerts. Along the way, you will get language to shift board and executive conversations away from screenshot theater and toward evidence-based confidence in specific detection capabilities. This narration is based on the Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed to help you think more clearly about where to invest your next unit of time, budget, and political capital in security operations.
Data Gravity Wells
July 16, 202617 minSeason 2 · Episode 56
In this narrated edition of “Data Gravity Wells: Where Sensitive Information Inevitably Sinks,” we walk through why your most critical data rarely stays inside the neat boxes on your architecture diagram …
Show notes
In this narrated edition of “Data Gravity Wells: Where Sensitive Information Inevitably Sinks,” we walk through why your most critical data rarely stays inside the neat boxes on your architecture diagram. Sensitive records drift into logs, analytics environments, collaboration suites, and emerging AI stores, quietly forming a handful of platforms that now define your real exposure. You will hear how data gravity wells emerge from integration decisions, analytics demands, and vendor ecosystems, and why they often sit outside the traditional list of “crown jewel” systems security programs are built around. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
We then move through the core sections of the article in clear, leader-focused language. You will hear how systems of record become systems of exposure, how to design a practical map of your own data gravity wells, and what it means to treat those platforms as “Tier 0 for data.” We explore trade-offs around centralization, analytics, AI initiatives, and multi-cloud integration, showing where you can intentionally bend data gravity instead of discovering new wells after an incident. By the end, you will have a mental model and a set of conversations you can bring to your own teams and board about where your sensitive information actually sinks.
The API Gold Rush
July 16, 202621 minSeason 2 · Episode 55
In this audio edition of “The API Gold Rush: Security When Everything Becomes a Service,” you get a guided walk through what happens when APIs become the default interface for everything your organization does …
Show notes
In this audio edition of “The API Gold Rush: Security When Everything Becomes a Service,” you get a guided walk through what happens when APIs become the default interface for everything your organization does. The narration unpacks how an ever-expanding API surface quietly turns into the business surface, why “just one more endpoint” keeps creating new seams of risk, and where ownership tends to fall apart between product, platform, security, and partners. It is built from my Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed for leaders who need to see the whole landscape, not just the latest incident.
You will hear how the article moves from mapping API sprawl, to the shift from features to platforms, to concrete ownership and guardrail patterns that actually scale. The description of secure-by-default “paved roads,” partner and customer APIs as a distinct exposure class, and pragmatic measurement of API health gives you a language you can use with your own teams and board. The goal is not to memorize controls, but to internalize a mental model for owning an API surface that never stops growing, while keeping delivery fast and risk explainable.
Controls Without Context
July 16, 202616 minSeason 2 · Episode 54
Compliance checklists promise clarity, but they can also turn into a parallel universe that has little to do with how your environment really works. In this narrated audio version of “Controls Without Context …
Show notes
Compliance checklists promise clarity, but they can also turn into a parallel universe that has little to do with how your environment really works. In this narrated audio version of “Controls Without Context: When Compliance Checklists Backfire,” we walk through why control catalogs feel so comforting to leaders and how they gradually drift away from modern architectures, cloud-native services, SaaS sprawl, and AI-driven workflows. You will hear how “green” status on dashboards can coexist with real attack paths that were never modeled, and why incidents so often expose gaps that compliance paperwork never even contemplated. The focus stays squarely on senior security and technology leaders who need a more honest way to talk about assurance, risk, and defensibility.
From there, the episode unpacks the key moves that reconnect controls to reality. We explore how to put architecture and data flows back at the center of assurance, how ownership and incentives shape the quality of your control set, and how to design evidence that actually teaches you something about system behavior instead of filling binders once a year. Along the way, you will hear practical patterns for making compliance a by-product of well-run systems rather than a separate bureaucracy. This narration is based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine and is designed to give you language and mental models you can use immediately with your teams, your peers, and your board.
Third-Party Truth Serum
July 16, 202620 minSeason 2 · Episode 53
When a vendor says “trust us,” what are you actually trusting? In this audio edition of Third-Party Truth Serum: Getting Real Answers from Vendors Who Say “Trust Us” — From Questionnaires to Continuous …
Show notes
When a vendor says “trust us,” what are you actually trusting? In this audio edition of Third-Party Truth Serum: Getting Real Answers from Vendors Who Say “Trust Us” — From Questionnaires to Continuous Validation and Shared Fate, we walk through why traditional third-party assurance feels so polished on paper yet so fragile in practice. You will hear how questionnaires, certifications, and audit reports became the default currency of vendor risk, why they routinely create an illusion of assurance, and what a more grounded definition of “evidence” looks like for relationships that sit in your real blast radius.
From there, the episode unpacks how to move toward continuous validation, how to structure shared-fate contracts and governance, and how to operate a serious third-party program without turning into the department of no. We close by focusing on the leadership side: framing vendor dependency in plain language for boards and regulators, choosing where to push for deeper visibility, and knowing when “yes, with conditions” is the right strategic answer. This narration is based on my Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed for security and technology leaders who need a more honest way to talk about third-party risk.
Regulation Whiplash
July 16, 202618 minSeason 2 · Episode 52
Regulation whiplash is becoming a familiar feeling for leaders caught between the Digital Operational Resilience Act (DORA), the NIS2 Directive, and new SEC cybersecurity disclosure rules. In this episode, we …
Show notes
Regulation whiplash is becoming a familiar feeling for leaders caught between the Digital Operational Resilience Act (DORA), the NIS2 Directive, and new SEC cybersecurity disclosure rules. In this episode, we walk through how a single incident can trigger three different sets of expectations, each with its own timelines, definitions, and pressures. You will hear how these regimes quietly converge on a core set of questions about operational resilience, governance, incident transparency, and third-party risk, and why treating them as separate projects only amplifies the pain when things go wrong.
From there, the episode follows the structure of the Wednesday “Headline” feature in Bare Metal Cyber Magazine, exploring friction points like “significant” versus “material” incidents, the design of a unified incident pipeline, and the evidence spine that can serve supervisors, investors, and boards at the same time. We close by looking ahead to future rule sets and how to build a regulatory operating model that can absorb new obligations without burning out your teams. The goal is not to turn you into a lawyer, but to give you a clear, leader-ready mental model for running one coherent security story across multiple regulators.
Resilience over Perfection
July 16, 202616 minSeason 2 · Episode 51
In this narrated edition of “Resilience over Perfection: Leading When ‘Secure’ Is Never Done,” we walk through why the old promise of being “secure enough” no longer matches how modern digital businesses …
Show notes
In this narrated edition of “Resilience over Perfection: Leading When ‘Secure’ Is Never Done,” we walk through why the old promise of being “secure enough” no longer matches how modern digital businesses actually operate. You will hear how familiar tools like maturity models drift into theater, why green dashboards quietly undermine trust, and how to shift board conversations toward what really matters: how the organization bends under stress and recovers from a serious hit. This episode is drawn from the Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed for senior leaders who want a more honest, usable picture of cyber risk.
From there, the narration digs into survivability as a more practical north star. We explore concrete, leader-ready measures such as demonstrated recovery performance, tolerable impact windows, and critical dependency exposure, and how they sit alongside other enterprise resilience metrics your board already knows. You will hear how to extract better signals from incidents and exercises, how to teach directors to live with permanent incompleteness without giving up on accountability, and how to lead a culture that trains for hits instead of chasing perfection. It is a practical listen for any Chief Information Security Officer (CISO) or technology executive rethinking how they tell the security story.
Autonomous Agents Unattended Risk
July 16, 202615 minSeason 2 · Episode 50
Autonomous agents are quietly shifting from helpful copilots to operational actors, and that shift becomes very real the moment a bot starts opening tickets for you. In this narrated edition of “Autonomous …
Show notes
Autonomous agents are quietly shifting from helpful copilots to operational actors, and that shift becomes very real the moment a bot starts opening tickets for you. In this narrated edition of “Autonomous Agents, Unattended Risk: When Bots Start Opening Tickets for You,” we unpack why ticketing is not a low-stakes sandbox, but a high-privilege interface into your systems of record. You will hear how autonomous agents move from suggestion to participation, how their tickets shape perception of risk and work, and why leaders need to see these bots as semi-privileged identities instead of clever experiments. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
Across the walkthrough, we explore the key sections of the article in plain language: the shift from copilots to colleagues, tickets as powerful input and output, the failure modes when automation goes sideways, and the practical design of safe autonomy levels. We close with the human side of the story, focusing on ownership, governance, and culture when agents are allowed to act unattended in IT and security workflows. The goal is to give security and technology leaders a clear mental model and vocabulary to discuss these agents with their teams, boards, and regulators, and to decide where autonomy is welcome and where it is reckless.
Deepfake Governance
July 16, 202615 minSeason 2 · Episode 49
When deepfakes become cheap and convincing, the hardest question inside an enterprise is no longer “Was this compromised?” but “Did this ever really happen?” In this narrated audio version of “Deepfake …
Show notes
When deepfakes become cheap and convincing, the hardest question inside an enterprise is no longer “Was this compromised?” but “Did this ever really happen?” In this narrated audio version of “Deepfake Governance: Policy, Evidence, and the New ‘I Didn’t Say That’ Defense,” we explore how synthetic media erodes trust in real recordings, chats, and logs. You will hear how the liar’s dividend plays out in executive disputes, harassment claims, incident narratives, and market-moving conversations, and why security and technology leaders need to think about evidence integrity as seriously as they think about endpoint security or identity. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
From there, we walk through the core elements of a deepfake-aware governance model: tightening what counts as official communication, mapping the weak points in your current evidence stack, and designing authenticity architectures that favor provenance over gimmicks. We then connect those design choices to the moments that really matter: internal investigations, board briefings, regulator conversations, and public disputes where both sides can point to “proof.” Along the way, you will get language to use with legal, HR, and business leaders so you can frame deepfake governance as a strategic capability, not just another AI problem.
Red Team Blue Models
July 15, 202618 minSeason 2 · Episode 48
In this narrated edition of “Red Team, Blue Models: Adversarial Testing in an AI-First World,” we walk through what happens when “we did a red team” becomes a comforting slogan instead of real assurance. You’ll …
Show notes
In this narrated edition of “Red Team, Blue Models: Adversarial Testing in an AI-First World,” we walk through what happens when “we did a red team” becomes a comforting slogan instead of real assurance. You’ll hear how AI-first systems create a new attack surface that extends far beyond jailbreak demos, into the messy intersection of models, prompts, plugins, data, and identity. We break down why adversarial testing has to focus on attacker goals, long-lived systems, and cross-layer behaviors if you want a risk picture that actually matches the stakes for your organization. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
From there, the discussion moves into the practical choices leaders have to make. We explore what a serious AI red team function looks like, how “blue models” can continuously simulate and detect abuse, and what it takes to integrate adversarial testing into AI delivery without strangling product velocity. You’ll get leadership-level patterns for governance, evidence, and metrics that go beyond counting jailbreaks and toward measuring real exposure. If you are signing off on AI features, building AI platforms, or advising boards on AI risk, this episode gives you language and mental models you can use in the rooms where those decisions get made.
Prompt Leaks and Side Channels
July 8, 202614 minSeason 2 · Episode 47
In this audio edition of “Prompt Leaks and Side Channels: When ‘Internal Only’ Isn’t,” we walk through why hidden prompts, routing logic, and subtle model behaviors are rapidly becoming part of your exposed …
Show notes
In this audio edition of “Prompt Leaks and Side Channels: When ‘Internal Only’ Isn’t,” we walk through why hidden prompts, routing logic, and subtle model behaviors are rapidly becoming part of your exposed attack surface. You’ll hear how prompt leaks actually unfold in production systems, why side channels show up in ordinary UX and error handling decisions, and what that means for AI-enabled security programs over the next few years. The focus stays on leader-level decisions: where you encode policy, how you treat prompts as assets, and how much inadvertent transparency you are comfortable living with. This narration is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine.
We also explore a more constructive path forward: designing for bounded exposure instead of pretending prompts are perfectly secret. You’ll hear practical examples of replacing sensitive details with abstractions, normalizing error messages so they do not act as policy oracles, and treating prompt libraries with the same change control and classification you expect for critical configurations. The goal is not fear, but clarity. By the end, you should have a sharper mental model for what adversaries can learn from your prompts and side channels, and a set of questions to bring back to your own AI and security teams.

These are the latest 40 of 114 episodes. You’ll find older episodes in the podcast’s feed.

Recommended by Bare Metal Cyber

Similar podcasts

More Education podcasts

Is this your podcast?

Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.