Episodes

On today’s episode we talk about what security teams can learn about OT security from the Death Star. Guest John Burns recaps his CYBR.SEC.CON talk “The Empire Had a SOC — And Still Got Blown Up Twice”. We jump off from this delightfully nerdy framing to get into serious matters around OT security, including problems... Read more »

In this double-header episode, JJ and Drew talk with two cybersecurity experts. First up, Jayson E Street talks about how to make security awareness training effective and engaging. Instead of having employees sit through a video or lecture, or get scolded for failing a phishing test, Jayson’s approach, which he calls Silver Teaming, engages employees... Read more »

Our October news roundup is a boiling cauldron of consternation. The FBI and the Pentagon suffered breaches, serious exploits are targeting network gear, and researchers discover a lone threat actor who successfully hit hundreds of sites with the help of AI agents. Infostealer malware is impersonating brands such as LastPass to trick users into downloading... Read more »

Sponsor HPE Networking comes to Packet Protector to talk about zero trust inline segmentation. This is a feature available in Juniper switches that can segment LAN traffic using group policy tags without the complexity associated with VXLAN or other segmentation mechanisms. On today’s show we dig into how inline segmentation works, common use cases, how... Read more »

AI models have proven very effective at finding software vulnerabilities. This has dramatically increased the number of people (and agents) who can find bugs. But the number of experts who can verify and validate those bugs, and write fixes, has stayed exactly the same. On today’s Packet Protector we talk with Trey Ford, Chief Strategy... Read more »

Today’s Packet Protector is a sponsored show that sits very nicely at the networking/security intersection. Our sponsor is NetCore, which makes the Unimus network configuration management software. Unimus supports network automation, configuration management and backup, change management, and auditing and compliance. We dive into how Unimus provides visibility into both the running config and the... Read more »

Today we talk about trying and failing. More specifically, guest Keith Tokash wrote a pair of blogs on Packet Pushers about taking, but not passing, the CCIE Security written exam. Failure’s a hard thing to talk about, particularly in this age where every public utterance on LinkedIn feels like it has to document one’s ever-upward... Read more »

If it feels like everything is on fire, today’s News Roundup will not dispel that feeling. We discuss consumer routers that ship with factory-installed backdoors, US law enforcement agencies shutting down hacking domains, and how a threat actor tied to China is targeting Cisco IOS-XR routers. Android-based auto infotainment systems are susceptible to malware, OpenAI... Read more »

Coruna and DarkSword are exploit frameworks that have successfully targeted Apple iPhones to steal cryptocurrency and harvest data including messages, email, location data, and browsing history. On today’s show we trace the provenance of these exploits (Coruna was originally developed by a contractor for the US government), their rapid evolution in the cyber underworld, and... Read more »

If you’ve been spinning up AI tools — Claude Desktop, Cursor, Copilot, and so on — there’s a decent chance that API keys, credentials, and access tokens are sitting in plaintext on your laptop. With MCP, every quickstart guide tells you to paste your credentials right into a config file. That was a bad habit... Read more »

Zack Whittaker is a journalist for TechCrunch and author of the newsletter “This Week In Security.” He recently wrote a post describing how he uses Burp Suite, an open source penetration testing tool, to see what data apps are collecting from users, and what other sites those apps share that data with. Zack joins JJ... Read more »

Today we’re doing a crossover episode with the folks at Cybr.Sec.Media to talk about CYBR.SEC.CON, a community-driven security conference that JJ and Drew will be attending in Houston, TX September 15 and 16 2026. We talk with conference founders Michael Farnum and Sam Van Ryder about the origins of the event, and get into our... Read more »

Packet Protector uncorks another News Roundup! We talk about attackers capturing hotels’ captive portals to steal Microsoft credentials, and the OpenAI-attacking-Hugging Face story and how it ties into a broader industry effort to keep the US government from blocking access to open weight AI models from China. Nvidia and the Linux Foundation launch separate AI... Read more »

There’s always been a gap between the discovery of a security issue and the time it takes to remediate. Now AI models can autonomously find weak points and chain together actions to exploit them. How does AI change the notion of “fast enough” for network defense? On today’s sponsored episode we dig into how FireMon... Read more »

Unless you’ve intentionally migrated to all-IPv6, you’re operating in a dual-stack environment. And if you haven’t accounted for v6 in your monitoring and security, you leave yourself open to risks. Today we dig into some of those risks, including VPN breakouts and how attackers can use unmanaged v6 to bypass security tools. Our guest is... Read more »

Drew talks with Joao Soares, Lead IT Security Consultant, about a project Joao undertook to automate firewall rule changes. Firewall changes can be fraught in any environment, but Joao also had to contend with working in the highly-regulated energy sector. They walk through how the project went from proof-of-concept to being widely used in production,... Read more »

Looks like it’s going to be a long, hot cybersec summer. The latest news roundup covers how Microsoft 365 Copilot got turned into a data exfiltration tool, why the FortiBleed attack is about much more than compromised firewalls, and how North Korea exploited a single npm maintainer account to poison more than a hundred software... Read more »

Machine identities now outnumber human identities in the enterprise 109 to 1 — and most of them are running without the governance controls you’d never skip for a human employee. Service accounts, API keys, tokens, workload credentials, and a fast-growing population of autonomous AI agents: all of them need access, all of them can be... Read more »

MACsec (IEEE 802.1AE) encrypts Ethernet frames hop-by-hop at Layer 2 — before traffic even hits IP — making it one of the strongest protections you can put on wire. It’s been in the standards for years, hardware support is widespread, and yet most organizations aren’t running it. JJ and Drew dig into why: the hardware... Read more »

The Verizon Data Breach Investigations Report (DBIR) is a postmortem of a year’s worth of cyber incidents and breaches, and a snapshot of how well organizations are responding to actual threats. Drew and JJ share highlights from the 2026 installment, including: For the first time, vulnerability exploits top the list for initial access What a... Read more »

Starting an investigation—be it for troubleshooting, problem diagnosis, threat hunting, incident response, and so on—is fairly straightforward. There’s a question or thesis you’re pursuing, you have logs and data sources to check, and you have tools to deploy. But if you don’t find anything, does that mean there was nothing to find? Are you sure... Read more »

HPE has announced new features in its Juniper Mist portfolio. On today’s sponsored Packet Protector, we dig into those features, including a dry run option that lets organizations test and refine Network Access Control (NAC) policies before pushing them out, a policy validation feature that can identify shadow NAC rules, and a microsegmentation capability aimed... Read more »

JJ and Drew unpack an overstuffed suitcase of infosec stories in today’s News Roundup. Microsoft’s Edge password manager stores credentials in plaintext and Microsoft says “Yup”, the Linux kernel takes a one-two punch from Dirty Frag and Fragnesia, and a new industry coalition takes critical infrastructure protection private. A Taiwanese radio enthusiast allegedly brings high-speed... Read more »

ThreatLocker takes an opinionated approach to Zero Trust. The company, our sponsor for today’s episode, starts with application control. It uses endpoint software that runs on PCs and servers to allow or deny applications to run. It can also monitor and control the behavior of allowed applications. ThreatLocker has extended its platform to include network... Read more »