Enterprise Security Weekly

Default deny is an old, and very recognizable term in security. Most folks that have been in the industry for a long time will associate the concept with firewall rules. The old network firewalls, positioned between the public Internet and private data centers, however, were relatively uncomplicated and static. Most businesses had a few hundred firewall rules at most.

The idea of implementing default deny principles elsewhere were attempted, but without much success. Internal networks (NAC), and endpoints (application control 1.0) were too dynamic for the default deny approach to be feasible. Vendors built solutions, and enterprises tried to implement them, but most gave up.

Default deny is still an ideal approach to protecting assets and data against attacks - what it needed was a better approach. An approach that could be implemented at scale, with less overhead. This is what we’ll be talking to Threatlocker’s CEO and co-founder, Danny Jenkins, about on this episode. They seemed to have cracked the code here and are eager to share how they did it.

This segment is sponsored by ThreatLocker. Visit https://www.securityweekly.com/threatlocker to learn more about them!

We wanted security data? We got it! Now, what the heck do we DO with all of it?

The core challenge of security operations, incident response, and even compliance is still a data management and analysis problem. Which is why we’re seeing companies like Abstract Security pop up to address some of these challenges.

Abstract just released a comprehensive eBook on security data strategy, linked below, and you don’t even need to give up an email address to read it! In this interview, we’ll talk through some of the highlights:

• Challenges
• Myths
• Pillars of a data security strategy
• Understanding the tools available

Segment Resources

• A Leader’s Guide to Security Data Strategy eBook

In the enterprise security news,

1. new startup funding
2. what happened to the cybersecurity skills shortage?
3. tools for playing with local GenAI models
4. CVE assignment drama
5. a SIEM-agnostic approach to detection engineering
6. pitch for charity
7. a lost dog that doesn’t want to be found

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

When we use the phrase "talent gap" in cybersecurity, we're usually talking about adding headcount. For this interview, however, we're focusing on a gap that is evident within existing teams and practitioners - the often misunderstood soft skills gap.

Side note: I really hate the term "soft skills". How about we call them "fundamental business skills", or "invaluable career advancement skills"? Hmm, doesn't quite roll off the tongue the same.

Soft skills can impact everything, as they impose the limits of how we interact with our world. That goes for co-worker interactions, career advancements, and how we're perceived by our peers and community. It doesn't matter how brilliant you might be - without soft skills, your potential could be severely limited.

Did you know that soft skills issues contributed to the Equifax breach?

We'll also discuss how fear is related to some of the same limitations and challenges as soft skills.

Segment Resources:

• https://www.softskillstech.ca/
• Order the Book

You might know them from their excellent research work on groups like Scattered Spider, or their refreshing branding/marketing style, but Permiso is laying some impressive groundwork for understanding and defending against identity and cloud-based attacks. In this interview, we talk with co-founder and co-CEO Paul Nguyen about understanding the threats against some of cybercriminals' favorite attack surface, insider threats, and non-human identity compromise.

Segment Resources:

• This blog post from our threat research team on Scattered Spider shows how threat actors move laterally in an environment across identity providers, Iaas, PaaS and SaaS environments, and how this lateral movement ultimately creates blind spots for many security teams
• This great talk by Ian Ahl, from fwd:cloudsec 2024, touches on a lot of great TTPs used by attackers in IDPs and in the cloud
• Another blog, When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying
• and another, What Security Teams Can Learn From The Rippling/Deel Lawsuit: Intent Lies in Search Logs

This week, in the enterprise security news,

1. we check the vibes
2. we check the funding
3. we check runZero’s latest release notes
4. tons of free tools!
5. the latest TTPs
6. supply chain threats
7. certs won’t save you
8. GRC needs disruption
9. the latest Rippling/Deel drama

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

A successful SIEM deployment depends on a lot more than implementing the SIEM correctly. So many other things in your environment have an impact on your chances of a successful SIEM.

• Are the right logs enabled?
• Is your EDR working correctly?
• Would you notice a sudden increase or decrease in events from critical sources?
• What can practitioners do to ensure the success of their SIEM deployment?

This segment is sponsored by Graylog. Visit https://securityweekly.com/graylog to learn more about them!

In this interview, we feature some research from Geoff Cairns, an analyst at Forrester Research. This is a preview to the talk he'll be giving at Identiverse 2025 in a few months.

We won't have time to cover all the trends, but there are several here that I'm excited to discuss!

• Deepfake Detection Difficult
• Zero Trust Agentic AI
• Phishing resistant MFA adoption
• Identity Verification
• Machine Identity
• Decentralized Identity
• Post Quantum
• Shared Signals

Segment Resources:

• The Top Trends Shaping Identity And Access Management In 2025 - (Forrester subscription required)

In this week's enterprise security news,

1. Big funding for Island
2. Is DLP finally getting disrupted? By something that works?
3. We learn all about Model Context Protocol servers
4. Integrating SSO and SSH!
5. Do we have too many cybersecurity regulations?
6. Toxic cybersecurity workplaces
7. Napster makes a comeback
8. this week, we’ve got 50% less AI and 50% more co-hosts

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

What does a mature SecOps team look like? There is pressure to do more with less staff, increase efficiency and reduce costs. JP Bourget's experience has led him to believe that the answer isn't a tool upgrade, it's better planning, architecture, and process.

In this interview, we'll discuss some of the common mistakes SecOps teams make, and where to start when building the SOC of the future.

It feels like forever ago, but in the mid-2010s, we collectively realized, as an industry, that prevention was never going to be enough. Some attacks were always going to make their way through. Then ransomware got popular and really drove this point home. Detection engineering is a tough challenge, however.

Where do we start? Which attacks should we build detections for? How much of the MITRE ATT&CK matrix do we need to cover? How often do these detections need to be reviewed and updated? Wait, are any of our detections even working?

In this interview with Michael Mumcuoglu, we'll discuss where SecOps teams get it wrong. We'll discuss common pitfalls, and strategies for building more resilient and effective detections.

Again, as an industry, we need to understand why ransomware attacks keep going unnoticed, despite attackers using routine techniques and tools that we see over and over and over again.

Session Resources:

• Rethinking Threat Exposure Management: A Unified Approach to Reducing Risk

This week, JP Bourget from Blue Cycle is with us to discuss Building the SOC of the Future

Then, Michael Mumcuoglu (Moom-cuoglu) from CardinalOps joins us to talk about improving detection engineering.

In the enterprise security news,

Google bets $32B on a Wiz Kid Cybereason is down a CEO, but $120M richer EPSS version 4 is out Github supply chain attacks all over A brief history of supply chain attacks Why you might want to wait out the Agentic AI trend Zyxel wants you to throw away their (old) products HP printers are quantum resilient (and no one cares) A giant rat is my hero All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Penetration tests are probably the most common and recognized cybersecurity consulting services. Nearly every business above a certain size has had at least one pentest by an external firm.

Here's the thing, though - the average ransomware attack looks an awful lot like the bog standard pentest we've all been purchasing or delivering for years. Yet thousands of orgs every year fall victim to these attacks. What's going on here? Why are we so bad at stopping the very thing we've been training against for so long?

This Interview with Phillip Wylie will provide some insight into this! Spoiler: a lot of the issues we had 10, even 15 years ago remain today.

Segment resources:

• Phillip's talk, Optimal Offensive Security Programs from Dia de los Hackers last fall

It takes months to get approvals and remediate cloud issues. It can take months to fix even critical vulnerabilities! How could this be? I thought the cloud was the birthplace of agile/DevOps, and everything speedy and scalable in IT? How could cloud security be struggling so much?

In this interview we chat with Marina Segal, the founder and CEO of Tamnoon - a company she founded specifically to address these problems.

Segment Resources:

1. Gartner prediction: By 2025, 75% of new CSPM purchases will be part of an integrated CNAPP offering. This highlights the growing importance of CNAPP solutions. https://www.wiz.io/academy/cnapp-vs-cspm

2. Cloud security skills gap: Even well-intentioned teams may inadvertently leave their systems vulnerable due to the cybersecurity skills shortage. https://eviden.com/publications/digital-security-magazine/cybersecurity-predictions-2025/top-cloud-security-trends/

3. CNAPP market growth: The CNAPP market is expected to grow from $10.74 billion in 2025 to $59.88 billion by 2034, indicating a significant increase in demand for these solutions. https://eviden.com/publications/digital-security-magazine/cybersecurity-predictions-2025/top-cloud-security-trends/

4. Challenges in Kubernetes security: CSPMs and CNAPPs may have gaps in addressing Kubernetes-specific security issues, which could be relevant to the skills gap discussion. https://www.armosec.io/blog/kubernetes-security-gap-cspm-cnapp/

5. Addressing the skills gap: Investing in training to bridge the cybersecurity skills gap and leveraging CNAPP platforms that combine advanced tools are recommended strategies. https://www.fortinet.com/blog/business-and-technology/navigating-todays-cloud-security-challenges

6. Tamnoon's State of Remediation 2025 report

In this week's enterprise security news,

1. Knostic raises funding
2. The real barriers to AI adoption for security folks
3. What AI is really getting used for in the wild
4. Early stage startup code bases are almost entirely AI generated
5. Hacking your employer never seems to go well
6. should the CISO be the chief resiliency officer?
7. proof we still need more women in tech

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

2025 brings us close to an interesting milestone - ransomware attacks, in their current, enterprise-focused form, are almost a decade old. These attacks are so common today, it's impossible to report on all of them. There are signs of hope, however - ransomware payments are significantly down. There are also signs defenders are getting more resilient, and are recovering more quickly from these attacks.

Today, with Intel471's Mike Mitchell, we'll discuss what defenders need to know to protect against today's ransomware attacks. He'll share some stories and anecdotes from his experiences with customers. He'll also share some tips, and tricks for successful hunts, and how to catch attacks before even your tools trigger alerts.

Segment Resources:

• https://intel471.com/blog/how-ransomware-may-trend-in-2025

And now, for something completely different!

I've always urged the importance for practitioners to understand the underlying technology that they're challenged with defending. When we're yelling at the Linux admins and DevOps folks to "just patch it", what does that process entail? How do those patches get applied? When and how are they released in the first place?

This is often one of the sticking points when security folks get nervous about "going open source", as if 90% of the code in their environments doesn't already come from some open source project. It's a legitimate concern however - without a legal contract, and some comfort level that a paid support team is actually going to fix critical vulnerabilities, how do we develop trust or a relationship with an open source project?

In this interview, benny Vasquez, the Chair of the board of directors for AlmaLinux, will fill in some of the gaps for us, and help us understand how an open source project can not only be trusted, but in many cases may be more responsive to security teams' needs than a commercial vendor.

Segment Resources:

• benny's 'highly scientific' survey on cloud vs on-prem usage across AlmaLinux users

In the enterprise security news,

1. Why is a consulting firm raising a $75M Series B?
2. A TON of Cybereason drama just dropped
3. Skybox Security shuts down after 23 years
4. The chilling effect on security leaders is HERE, and what that means
5. IT interest in on-prem, does NOT mean they’re quitting the cloud
6. Updates on the crazy Bybit heist
7. the state of MacOS malware
8. Skype is shutting down
9. Mice with CRISPR’ed woolly mammoth fur is NOT the real life Jurassic Park anyone was expecting

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

In 2011, Marc Andreessen predicted that software would eat the world. Specifically, the prediction was that software companies would take over the economy and disrupt all industries. The economic prediction has mostly come true, with 9 out of 10 of the most highly valued companies being tech companies. The industry disruption didn't materialize in some cases, and outright failed in others.

Healthcare seems to be one of these 'disruption-resistant' areas. Ed joins us today to discuss why that might be, and what the paths towards securing the healthcare industry might look like.

Segment Resources: Ed's podcast, Risk Never Sleeps

We get a visit from Tanya Janca to discuss her latest book, Alice and Bob Learn Secure Coding!

Segment Resources:

• Tanya's latest book on Amazon
• Tanya's previous book, Alice and Bob Learn Application Security on Amazon
• Tanya's website, She Hacks Purple

This week, in the enterprise security news,

1. we’ve got some funding and acquisitions!
2. ransomware payments are DOWN 35%
3. infostealers on Macs are UP 101%
4. Bybit got hit by a $1.5B heist and shrugged it off
5. A SaaS report says AI is having no impact on pricing
6. Microsoft’s CEO says AI is generating no value
7. Google is dropping SMS as a second factor
8. Google creates a 4th state of matter instead of fixing Teams
9. What it’s like to be named “Null”

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

In this interview, we're excited to have Ilona Cohen to help us understand what changes this new US administration might bring, in terms of cybersecurity regulation. Ilona's insights come partially from her own experiences working from within the White House. Before she was the Chief Legal Officer of HackerOne, she was a senior lawyer to President Obama and served as General Counsel of the White House Office of Management and Budget (OMB).

In this hyper-partisan environment, it's easy to get hung up on particular events. Do many of us lack cross-administration historical perspective? Probably. Should we be outraged by the disillusion of the CSRB, or was this a fairly ordinary occurrence when a new administration comes in? These are the kinds of questions I'll be posing to Ilona in this conversation.

• How the Change Healthcare breach can prompt real cybersecurity change

'Shift Left' feels like a cliché at this point, but it's often difficult to track tech and security movements if you aren't interacting with practitioners on a regular basis. Some areas of tech have a longer tail when it comes to late adopters and laggards, and application security appears to be one of these areas. In this interview, Jenn Gile catches us up on AppSec trends.

Segment Resources:

• Microsoft Defender for Cloud Natively Integrates with Endor Labs
• 2024 Dependency Management Report
• How to pick the right SAST tool

In the enterprise security news,

1. Change Healthcare’s HIPAA fine is vanishingly small
2. How worried should we be about the threat of AI models?
3. What about the threat of DeepSeek?
4. And the threat of employees entering sensitive data into GenAI prompts?
5. The myth of trillion-dollar cybercrime losses are alive and well!
6. Kagi Privacy Pass gives you the best of both worlds: high quality web searches AND privacy/anonymity
7. Thanks to the UK for letting everyone know about end-to-end encryption for iCloud!
8. What is the most UNHINGED thing you've ever seen a security team push on employees?

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

We've got a few compelling topics to discuss within SecOps today. First, Tim insists it's possible to automate a large amount of SecOps work, without the use of generative AI. Not only that, but he intends to back it up by tracking the quality of this automated work with an ISO standard unknown to cybersecurity.

I've often found useful lessons and wisdom outside security, so I get excited when someone borrows from another, more mature industry to help solve problems in cyber. In this case, we'll be talking about Acceptable Quality Limits (AQL), an ISO standard quality assurance framework that's never been used in cyber.

Segment Resources:

• Introducing AQL for cyber.
• AQL - How we do it
• An AQL 'calculator' you can play around with

We couldn't decide what to talk to Allie about, so we're going with a bit of everything. Don't worry - it's all related and ties together nicely.

• First, we'll discuss AI and automation in the SOC - Allie is covering this trend closely, and we want to know if she's seeing any results yet here.
• Next, we'll discover SecOps data management - the blood that delivers oxygen to the SOC muscles.
• Finally, we'll discuss MITRE's recent EDR evaluations - there was some contention around some vendors claiming to ace the test and we're going to get the tea on what's really going on here!

For each of these three topics, these are the blog posts they correspond with if you want to learn more:

1. Generative AI Will Not Fulfill Your Autonomous SOC Hopes (Or Even Your Demo Dreams)
2. If You’re Not Using Data Pipeline Management For Security And IT, You Need To
3. Go Beyond The MITRE ATT&CK Evaluation To The True Cost Of Alert Volumes

In this week's enterprise security news, we've got

1. 5 acquisitions
2. Tines gets funding
3. new tools and DFIR reports to check out
4. A legal precedent that could hurt AI companies
5. AI garbage is in your code repos
6. the dark side of security leadership
7. HIPAA fines are broken
8. Salt Typhoon is having a great time
9. Don't use ChatGPT for legal advice!!!!!

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Spoiler: it's probably in your pocket or sitting on the table in front of you, right now!

Modern smartphones are conveniently well-suited for identity verification. They have microphones, cameras, depth sensors, and fingerprint readers in some cases. With face scanning quickly becoming the de facto technology used for identity verification, it was a no-brainer for Nametag to build a solution around mobile devices to address employment scams.

Segment Resources:

• Company website
• Aaron's book, Loyal

Listeners of the show are probably aware (possibly painfully aware) that I spend a lot of time analyzing breaches to understand how failures occurred. Every breach story contains lessons organizations can learn from to avoid suffering the same fate. A few details make today's breach story particularly interesting:

• It was a Chinese APT
• Maybe the B or C team? They seemed to be having a hard time
• Their target was a blind spot for both the defender AND the attacker

Segment Resources:

• https://www.binarydefense.com/resources/blog/shining-a-light-in-the-dark-how-binary-defense-uncovered-an-apt-lurking-in-shadows-of-it/
• https://www.theregister.com/2024/09/18/chinesespiesfoundonushqfirm_network/

This week, in the enterprise security news,

1. Semgrep raises a lotta money
2. CYE acquires Solvo
3. Sophos completes the Secureworks acquisition
4. SailPoint prepares for IPO
5. Summarizing the 2024 cybersecurity market
6. Lawyers that specialize in keeping breach details secret
7. Scientists torture AI
8. Make sure to offboard your S3 buckets
9. extinguish fires with bass

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!