Advertise on podcast: Beers with Talos Podcast

David Bianco built the Pyramid of Pain, so we offered him some more. David joins the crew for a conversation how AI changes about his famous model, how EvidenceForge creates simulated incidents for research and training, and why his red-team entrance exam didn’t go to plan.  First, we discuss the newly disclosed PHP vulnerabilities and the potential impact there (we recorded this on day 1 of the disclosure, hence expediting the release of this episode from its normal release schedule). Later, David’s decades of experience are put to work helping Hazel hack a fictional smart toilet company.  Here's the Talos advisory about the PHP vulnerabilities https://blog.talosintelligence.com/two-critical-rces-in-php-core/

How do you get under a cybercriminal’s skin? Sometimes you expose their operations. Sometimes you make every step through a network painfully slow. And sometimes, if you’re Azim, you join a dark web forum where they’re insulting you, and help them do it. Azim and Nick join Hazel and Dave this week to discuss the fine art of frustrating adversaries, from ransomware-group paranoia to deception that wastes their time and gives defenders a chance to spot their activity. For more on this topic, check out our blog post https://blog.talosintelligence.com/the-fine-art-of-frustrating-the-adversary/ Plus: a listener question has us reflecting on the best parts of our job, we discuss the story of an insider threat whose browser history did the investigators a favor, and Dave makes a poetic tribute.

Adversaries are experimenting with AI-integrated malware, and today's guest, Talos researcher Ryan Fetterman has been looking at their working notes. He joins us to talk about CAIRN, his new open-source research toolkit for tracking that experimentation, and what he’s finding, including a C2 an implant that delegates its decisions to AI models, and malware that tries to persuade AI analysis tools to leave it alone. Putting AI in malware is one thing. Establishing whether any of it actually works takes rather more investigation. A special segment with Joe (from 7.07 to 25.25) talks about his newly published Human IR Framework (published in a personal capacity on Joe's GitHub), the experiences that led him to build it, and why “burnout” doesn’t adequately describe what certain people who work in cybersecurity can go through. Meanwhile, Dave definitely prepared his "Reason not to Quit" in advance, an attempt to make Hazel Philadelphian takes an unexpected turn towards Wales, and Bill's "Make Hazel a hacker" question sends Hazel once again into a pit of self despair.

Twenty-four hours before recording this episode, Martin Lee stopped being a Talos employee. Naturally, we made him come on the podcast anyway. Martin talks about abandoning his early career aspirations of researching human viruses and curing cancer, so he could play on the internet. He also talks about how running very long distances in crazy conditions helps him to stop himself thinking about it.  He has some words of wisdom for aspiring practitioners, and why the rest of us should occasionally close our laptops and venture outside...dangerous business, we reckon. Plus: Does saying please and thank you improve an AI’s answers? What did Agatha Christie have against Bletchley? And how quickly can a $245 million cryptocurrency theft unravel when someone starts buying Lamborghinis at a rate of one a day? Martin's blog on 'Securing the unpatchable' can be found here https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/

What does it take to become someone a cybercriminal will trust?  Talos' Azim Khodjibaev takes us inside the psychology of direct adversary engagement. At one point, he was maintaining eight different personas, some of which were talking to each other. He explains how discipline and patience help keep his cover intact, and what can provoke threat actors into revealing information.  His work has occasionally made Azim part of the story. Ransomware operators have threatened him, and one even put “Azim sucks” in their code. He shares how his research has contributed to Talos identifying prolific cybercriminals and disrupting ransomware operations (experiences that will feature in the forthcoming book "Owned"). The conversation also examines how cybercrime is changing. More inexperienced, loosely organized collectives can pull dozens of people into an active intrusion through a Telegram channel, and Azim tells the crew about one particular ransomware trend that's keeping him up at night. Before all that, we tackle a listener question about what defenders should prioritise when patching everything is impossible. Hazel tries some American snacks for the first time, Joe tests Hazel's patience with more hacker training, and Dave argues that without Yaddle, there would be no Star Wars.

Kaitlin Acharya joins the Beers with Talos crew to take us inside the world of threat intelligence: what happens when Talos spots something that could become a major threat, how her team tracks changes in threat actor behavior, and how intelligence moves from an investigation into detection content. She also faces some tougher questions involving tennis, Derry Girls and an evil genie. We also attempt to extract some information about Kaitlin’s former life at a certain intelligence agency. Results are limited. Our listener question asks which high school subject produces the best cybersecurity professionals. We get to that after arguing over whether it’s “math” or “maths” (it’s maths).  In Make Hazel a Hacker, Dave puts Hazel in charge of the security budget for a manufacturer of AI-enabled smart toilets. Bill’s Reason Not to Quit looks back at the people and community that make Hacker Summer Camp worth surviving, before Joe’s Corner picks up that thread with a reminder of just how much the cybersecurity community can change someone’s career.

Cybercriminals are increasingly relying on AI, but in doing so, they're creating an entirely new source of threat intelligence. This week, Talos researcher Arnaud Zobec joins Hazel, Bill, Joe and Dave to discuss what happens when attackers leave behind AI prompt logs, agent configurations and other unexpected artifacts. From jailbreak attempts to agentic workflows and accidental infrastructure leaks, the team discusses what these artifacts reveal about attacker behavior, and where/how AI is changing offensive operations and campaigns. Here's the link to that blog https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/ Also in this episode: our listener question tackles the surprising bad actor developments in over the past year, plus a bonus question on walk-on songs officially makes us a music podcast. Bill puts Hazel through her paces with an old school SOC question in 'Make Hazel a hacker'. And Dave leaves everyone with chills.

In this episode of Beers with Talos, Hazel, Bill, Dave and Joe are joined by Kendall McKay to dive into the soap opera of modern cybercrime. From rival gangs launching smear campaigns against one another to reputation systems, trusted intermediaries and dark web "customer reviews". Turns out, every ransomware operation is one passive-aggressive group chat message away from falling apart. Kendall chats to us about how AI is changing the economics of cybercrime, why it's helping inexperienced attackers get through the front door (only to leave them wondering what to do next), and how defenders can prioritize their defenses. We also discuss the rise of supply chain attacks, and where the lines between cybercrime and state sponsored activity are beginning to blur. Elsewhere in the episode, Joe once again attempts to Make Hazel a Hacker, Dave explains how a McDonald's receipt became an unlikely piece of counterintelligence, we preview Black Hat 2026, and Bill wraps everything up with his practical takeaways for defenders.

In this episode of Beers with Talos, Hazel, Bill, Dave and Joe are joined by Talos Security Research Engineer James Nutland to discuss Living Off Trusted Services (LOTS) - a growing technique where attackers use platforms such as GitHub, Google Drive, Microsoft services and Telegram for command and control, malware delivery and data exfiltration. We explore why this trend is growing, how it differs from Living Off the Land (LOTL)....and Lord of the Rings (LOTR)....why trusted services create new detection challenges, and what defenders should be monitoring. Also in this episode: Data centers in space, when physics still has to physics.A USA vs UK Independence Day food showdown.Hazel faces another round of Make Hazel a Hacker.A new Reason Not to Quit looks at the latest successes from Operation Endgame.Bill gets his own corner.Here's the LOTS project repository mentioned in the episode https://lots-project.com/

AI is accelerating vulnerability discovery, so what impact is that having on defenders? In this episode of Beers with Talos, Hazel, Bill, Joe, and Dave are joined by Nick Biasini to unpack what attackers are doing with AI-assisted vulnerability discovery, why local models rather than frontier models may be a more attractive route for them, and the vendors who are now drowning in a flood of bug reports (many of them junk) as AI sifts through decades of technical debt with nothing but time and patience. We also kick things off with a listener question about threat trends and the FIFA World Cup, which leads to a discussion about whether any of us could resist Rickrolling the entire planet. Also in this episode: Joe attempts to "Make Hazel a Hacker" and phish the Pope. Plus, we launch a new segment called “Reasons not to Quit” in which we celebrate defender wins.

Hazel, Dave and Joe plot to celebrate Bill's 25 years at Talos with stories and a good old fashioned roast. The team also covers the latest security headlines, including AI-assisted vulnerability research, and why attackers still can’t resist abusing trusted systems (or Roblox). They also break down the latest Cisco Talos Incident Response Quarterly Trends report, including: Phishing’s return as the top initial access vectorAI-generated credential harvesting pages built in minutesCrimson Collective activity and GitHub token exposurePre-ransomware incidents and early disruptionWhy logging (still) matters more than everRead the full report at https://blog.talosintelligence.com/ir-trends-q1-2026/ And for more guidance for defenders, check out this episode of The Talos Threat Perspective https://www.youtube.com/watch?v=wppL7JBshK8 Plus: Crossbows, Metasploit nostalgia, and why, despite everything, security fundamentals still win.

Hazel, Bill, Joe and Dave break down (sometimes in the literal sense) the 2025 Talos Year in Review which is available  now at blog.talosintelligence.com/2025yearinreview The team, supported as always by the Turkey Lurkey Man, dives into the biggest cybersecurity trends of the year, including: ·       The rapid weaponization of vulnerabilities ·       Why identity abuse showed up everywhere  ·       Ransomware trends ·       A rise in APT investigations ·       What defenders should prioritize heading into the year ahead Before that, we discuss the cyber activity tied to the situation in the Middle East (full details on our blog https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east). There’s also an alarming amount of discussion about glutes. And gravy. Download the full 2025 Talos Year in Review: blog.talosintelligence.com/2025yearinreview

It's the one, the only, it's Matt Olney! We are delighted to have Matt back to talk with the crew about about the most random things, including TikTok diagnosing us with ADHD, inspiring vtubers, K-Pop Demon Hunters, ransomware in hospitals (the serious bit), attacker use of AI, why 1999-era tricks are still undefeated, and an entirely reasonable number of desserts. We recorded this episode on 20 February - please see the Talos blog for the latest on the developing situation in the Middle East https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/ Links to some things Matt mentioned: The MapMen: https://www.youtube.com/@JayForeman Ironmouse: https://www.youtube.com/watch?v=P1_2JehaKOw&list=RDP1_2JehaKOw&start_radio=1

Guess who’s back? Hazel, Bill and Joe welcome back fresh-from-parental-leave Dave Liebenberg, who has returned with a new baby, and some truly chaotic Thanksgiving opinions.     We kick things off with the security headlines. Joe gets spicy about a recent “AI-orchestrated cyber campaign” report.  Dave brings us the poetic news that AI models can apparently be jailbroken with a well-placed limerick. Hazel challenges the others to a guessing game about just how much cyberattacks cost the UK, and Bill discusses what’s top of mind for organizations right now.   But really, you know what you’re here for: the annual RanksGiving extravaganza. Dave boldly ranks his top five Thanksgiving dishes (with a new twist for this year, because apparently we need to re-engage the ‘youth’ before they’re lost to TikTok forever.) Cue the outrage, the gravy discourse, and a heartfelt (touching on amorous) defense of gluttony from Bill.   Happy holidays everyone! May your gravy be thick and your cyber incidents few. See you in 2026!

Talos' Vice President Christopher Marshall (the “real Marshall,” much to Joe’s displeasure) joins Hazel, Bill, and Joe for a very real conversation about leading people when the world won’t stop moving. We start with Marshall’s days in the Navy’s nuclear program and the art of translating deeply technical work for non-technical leaders. We then get into how he joined Talos (“you WILL do this for me”), why being right beats being first, and how to keep a team steady and mission focussed when the news cycle is anything but. Marshall also talks about the decisions that shaped his life and career, what he’s had to let go of as he’s moved up, and the gloriously nerdy hobbies that keep him grounded.