Advertise on podcast: The Cyber Threat Perspective

200 episodes! Thank you to everyone who has listened, watched, and shared The Cyber Threat Perspective along the way. To mark the milestone, Brad Causey and Jordan Natter are back with Part 6 of our OWASP Top 10 series, breaking down A06: Insecure Design. These flaws show up when an application does exactly what it was designed to do, but nobody stopped to ask how that functionality could be abused. Brad and Jordan walk through what insecure design looks like in practice, share real-world war stories from pen tests and beyond, and explain how to catch these flaws before they ever reach production. In this episode: Why insecure design fell from #4 to #6 in the OWASP Top 10, and why that isn’t good newsRate limiting, user enumeration, and why secret questions are a no goHow a teenager’s AOL trial CD experiment turned into a careerAbusing rewards programs, group bookings, and first-purchase couponsTaking over insurance accounts using publicly available census dataPrevention through misuse cases, threat modeling, and DevSecOpsWhy a flaw caught in the design phase costs a fraction of one found in a pen testNeed web app pen testing? Visit https://securit360.com Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

We’re halfway through the OWASP Top 10, and this one is a favorite. Brad Causey is joined by Jordan Natter, SecurIT360’s resident web app pen tester, to cover A05: Injection. They explain how injection flaws work, why it slipped two spots on the list but is no less dangerous, and what developers can do to shut it down. Along the way, they share real stories from the field. There’s a first-ever pen test that turned a blood drive gift card app into $25,000 in gift cards and a destroyed production database. There’s a harmless-looking hub status dropdown that became a reverse shell. And there’s a username field that handed over session cookies. In this episode: What injection is and why it can happen anywhere from the browser to the data layerReflected, stored, and DOM-based cross-site scripting, and how they differSQL, NoSQL, LDAP, and why no data layer is immune to injectionWhy injection moving to #5 doesn’t make it a lower priorityHow CSP, HttpOnly cookies, CSRF tokens, and SameSite attributes break attack chainsWhy client-side validation is a usability feature, not a security controlWhitelisting vs. blacklisting, parameterized queries, and output encodingThe case for never testing in production, and backing up your staging data tooResources mentioned: OWASP Input Validation Cheat Sheet and the OWASP Cheat Sheet Series Need a web app pen test or have questions about application security? Reach out to the SecurIT360 team. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

It’s Cybersecurity Awareness Month, so we’re bringing back one of the most practical episodes in our catalog. Strong passwords are one of the basics of good security, but weak and reused credentials are still a common way attackers get in. In this episode, Brad and Spencer look at why weak passwords keep showing up in real-world compromises. They cover the habits and identity management gaps that cause them and what organizations can do to close those gaps. In this episode: Why weak passwords are still a painfully persistent problemHow poor password habits and identity gaps expose organizations to compromiseCommon mistakes attackers take advantage ofPractical defensive measures you can put in placeOriginally released November 2024. Sources: Verizon 2023 Data Breach Investigations Report: https://www.verizon.com/about/news/2023-data-breach-investigations-report1Password, Challenges of Shadow IT: https://blog.1password.com/challenges-of-shadow-it/Microsoft Digital Defense Report 2024: https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024Links: Work with us: https://securit360.comBlog: https://offsec.blog/YouTube: https://www.youtube.com/@cyberthreatpovX/Twitter: https://x.com/cyberthreatpovSpencer Alessi: https://spenceralessi.coWork with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Users will get compromised. Someone will click the link, and credentials will get stolen. The question that really matters is what happens next. In this episode, Spencer and Brad walk through the Post-Compromise Risk Framework (PRID), a simple, repeatable way for IT and security teams to judge how exposed their environment is once an attacker gets in. Using a real-world-style ClickFix scenario involving "Susie in accounting," they trace how one compromised account can lead to lateral movement, credential dumping and sensitive data exposure. They also cover why so many of those steps go undetected. In this episode: Why the assume breach mindset is the best way to measure your securityPrivileges: what can a compromised user actually do?Reach: where can they go with that access?Impact: how bad would it be?Detection: would you even know it happened?How least privilege and network segmentation map to each stepWhy PS Remoting to a domain controller goes undetected nine times out of 10Why "that couldn't happen here" is not proof, and how to verify your controls"Inspect what you expect": testing your EDR instead of trusting itPick a user, assume they're compromised, and walk the path. You'll learn more about your environment, and you'll likely find issues you didn't know were there. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

One threat actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, using AI to run the same playbook at scale. The fastest path to domain admin took five minutes. But out of hundreds of organizations hit, the attacker only got domain admin at 12 of them. Spencer and Tyler use GreyNoise's recent PaperCut report to make the case that the basics matter more now than they ever have. The attack itself was not novel. It used a known vulnerability, a lab environment built to test exploits, an internet scanning service, and familiar offensive tools. AI (Codex and DeepSeek) is what took it from one target to hundreds. In this episode: How the attacker built a PaperCut and Active Directory lab to test exploits before going wideWhy five minutes to domain admin is fast but not unheard of, and how certificate abuse makes it possibleThe Conti playbook comparison, and how LLMs are turning attack playbooks into automated campaignsThe toolkit: Certify, Rubeus, SpoolSample, Impacket, NetExec, BloodHound, Mimikatz, and AMSI bypassesWhy letting hosts reach GitHub directly is a red flag, and how DNS and category filtering slow attackers downThe one case where Cloudflare's WAF stopped the attackWhy the 12 domain admin compromises are a hopeful sign that hardening worksWhere to start with AD hardening: tier zero permissions, dangerous rights on broad groups, service accounts, and certificate templatesMoving past EDR alone with application control, NDR, and identity-based detectionsComparing what a security tool costs to what a compromise costsSpencer and Tyler are penetration testers at SecurIT360. If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

One French-speaking hacktivist targeted 42 organizations and got internal access to 14 of them, working alone. That is the kind of detail Anthropic's September 2026 threat intelligence report put on the record, with data spanning December 2025 through August 2026. Spencer and Tyler walk through all six generative threat groups named in it and what actually changes for defenders. Their read: the attacks themselves are familiar. Stolen credentials, unpatched edge devices, exposed services, phishing, SQL injection. What AI changed is speed, automation, and scale, and that is enough to matter. In this episode: The skill floor for hacking has dropped, and solo operators are now running campaigns that used to take a teamThreat actors vibe coding phishing kits, credential dashboards, and custom toolingAutomated vulnerability discovery and exploit development, including one workflow that produced more than a dozen potential zero-day findings in a monthWhy older models with looser guardrails are showing up in operations while frontier models refuse the same requestsCustom harnesses and multi-agent pen testing frameworks that chain traditional offensive tools under an LLMStolen AI credentials and API keys as a high-priority target, plus resellers advertising discounted access to frontier modelsOn-the-fly obfuscation and retooling that breaks signature-based detectionWhy baselining, behavioral detection, application control, and external attack surface hygiene matter more than they did a year agoGroups covered: GTG-2006, GTG-50014, GTG-10007, GTG-50020, GTG-50021, and GTG-50029. Spencer and Tyler are penetration testers at SecurIT360.  If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Replay of Episode 178, originally published April 22, 2026. We are re-running this one because it is the question we get asked most on internal pen test debriefs: of everything on the list, what actually slows an attacker down? Spencer and Tyler answer it from the attacker side, using what has and has not stopped them on real engagements. What's covered: - Application control done right, including where ThreatLocker and WDAC   actually block a payload and where they get bypassed - MFA, the Protected Users group, and least privilege as attacker-facing   controls rather than compliance checkboxes - Why mismanaged admin privileges and service accounts remain the fastest   route from foothold to domain admin - Network segmentation and zero trust, and what separates a real   implementation from a diagram - Deception techniques and EDR baselining for catching activity that   looks legitimate If you are deciding where the next dollar of your security budget goes, this is the episode that tells you what attackers hope you skip. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Interested in a pen test? Visit securit360.com. Every organization has a Joe. He is the long tenured engineer or admin who built half the environment, maintains the other half, and keeps most of it in his head. Everybody depends on him and nobody wants to challenge him. Spencer and Tyler break down key man risk in IT, drawing on hundreds of internal pen tests across law firms, banks, credit unions, manufacturing, municipalities, and SaaS organizations. In this episode: Why tribal knowledge is a security risk, not just an operations problemHow word of mouth process handoffs turn into a game of telephoneThe reason remediations stall for an extra 30 daysShadow IT that originates inside the IT teamPrivilege creep and the single account that owns the environmentWhen Joe's resistance to change is the correct callCross training that does not add more work to Joe's plateIncentives, clear ownership, and update deadlines that actually stickSeparating fact gathering from decision making so seniority does not win by defaultThis is not a knock on senior admins. It is a look at the risk that accumulates when one person carries everything, and what IT leaders can do about it. All of our content can be found at Offsec.blog. Interested in a pen test? Visit securit360.com. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Service accounts are one of the easiest paths to domain admin on an internal pen test, and one of the most neglected accounts in Active Directory. In this episode, Spencer and Tyler break down why service accounts keep falling: Kerberoasting every service account (not just the privileged ones), cracking the hashes offline, and spraying what cracks across the environment. Tyler shares a recent engagement where a non-administrative service account shared its password with a domain admin. Same password, one "SVC_" prefix apart. That spray handed over the domain. He's also seen the built-in RID 500 administrator account used as a service account on three separate engagements this year. They also get into where these credentials actually live: web.config files on open file shares, plaintext password files (present on roughly 90% of their pen tests), and one .eml attachment with the credentials sitting inside a screenshot. Then the fix list, in the order they'd actually do it: - Inventory the accounts and document where each one is used, before you touch a password - Delete the service accounts that don't need to exist - Strip privileges and restrict interactive logon rights - Get a password vault or PAM solution, and make every password long and unique - Alert on service accounts logging on interactively - Move to group managed service accounts (gMSA) where you can - Enforce 20-25 character minimums in the meantime. They've cracked 20+ character passphrases with a gaming rig, a 180 GB wordlist, and mutation rules producing roughly four quadrillion permutations Plus the three cleanup mistakes that cause the most damage, including the story of a $70 billion enterprise where one undocumented password reset turned into a 10-hour troubleshooting call. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

In July 2026, Microsoft alone released 622 CVEs. In the 2010s, the monthly average was about a dozen. Nobody handed IT teams more time, budget, or headcount to match, and that gap is what burnout is actually made of. Somewhere in the last five to ten years, "keeping the lights on" became "and also prevent cyberattacks." Spencer Alessi and Brad Causey talk through how security landed on IT's plate, why capable admins end up feeling like they're failing, and what to do about it when hiring a dedicated security person isn't on the table. The core of the episode is a four-question framework for prioritizing when you can't do everything: - Harm: what would cause the greatest damage to the business? - Likelihood: what is most likely to actually be attacked? - Improve: what can you realistically fix with the people and tools you have today? - Accept: what risk must leadership explicitly own because your team can't address it? Brad's addition: don't start from the scan report, start from the crown jewels. Client matters if you're a law firm, financial data if you're a bank. From there, draw lines outward to whatever touches them. And executives need to get comfortable accepting risk, because zero risk tolerance isn't a strategy, it's a phrase. We also get into the language that works with leadership. "You gave me four things and I have time for two" is adversarial and doesn't give anyone enough to decide with. "I recommend A and C, here's why, and here's when B and D land if nothing else gets added" is managing up. Same for new projects: price the work honestly, including cost, timeline, and tradeoffs, then hand the decision back to the people with full business context. We close with the four things IT teams need to succeed: authority, budget, team, and support, including a trusted outside partner for the specialized work you shouldn't be doing yourself. Planning your next penetration test? Book a call with us at https://securit360.com If you enjoyed this episode, please share it with your network. See you next week. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Work with us --> https://www.securit360.com/#contact-anchor The OWASP Subtractive Security Top 10 Project --> https://github.com/OWASP/OWASP-Subtractive-Hardening-Top-10 The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Two pen testers have spent thousands of hours inside client networks, and the most common failure they see isn't a missing security product — it's an EDR nobody ever tuned. In this episode, Spencer and Tyler open up the CrowdStrike Falcon console and walk through the specific settings that decide whether your team catches an attack or never sees it. They start with the story that kicked the whole thing off: Tyler running a pen test where every AMSI bypass gets blocked and detections fire left and right, while Spencer runs nearly identical tooling against the same product at another client and the SOC sees nothing all week. Same CrowdStrike. Same version. Different checkboxes. From there it's a tactical walkthrough of Endpoint Security → Prevention Policies and the settings worth your attention: Enhanced Exploitation Visibility, which unlocks command-line and PowerShell telemetry that Microsoft disables by default; Enhanced DLL Load Visibility for side-loading attacks; WSL2 Visibility, which closes a sandbox threat actors have been using to run Kali tooling under the radar; memory scanning for in-memory C# tradecraft; Office malicious macro removal; file system containment for ransomware over SMB; vulnerable driver protection, the direct mitigation for BYOVD attacks and EDR killers; and cloud-based anomalous process execution for living-off-the-land binaries. They also cover custom IOA rule groups for blocking unauthorized RMM tools, centralized firewall policy management, device policies for USB control, and a warning on exclusions — especially wildcard paths, which Tyler calls a threat actor's best dream. The takeaway is simple: you're paying real money for EDR, and default configurations aren't giving you what you paid for. Open your console, work through the settings, test them against an IT pilot group, and enable what fits your environment. TOPICS COVERED - Why EDR vendors ship deficient defaults on purpose - Enhanced Exploitation Visibility and the telemetry gap in PowerShell attacks - DLL side-loading, WSL2 abuse, and vulnerable driver attacks - Memory scanning and in-memory tooling detection - Blocking RMM tools with custom IOA rule groups - Exclusion hygiene and the wildcard path problem - Device policies, USB blocking, and insider threat Sentinel One and Defender for Endpoint are next — let us know what else you want covered. Blog: https://offsec.blog Work with us on an internal pen test: https://securit360.com Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Most cryptographic findings on your vulnerability report will never be exploited by a real attacker. So why do they keep showing up — and why should you still fix them? In this episode of the Cyber Threat Perspective, Brad Causey and Jordan Natter break down OWASP Top 10 A04: Cryptographic Failures — the entry they openly call their least favorite on the list. They explain why SWEET32, BEAST, and the other scary-sounding named TLS vulnerabilities almost never translate into real-world compromise, why platforms like Security Scorecard and BitSight inflate their severity anyway, and where genuine cryptographic risk actually lives. Jordan also walks through a real penetration test finding: a JSON Web Token signed with HS256, an exposed configuration backup sitting on the web server, and the signing secret that turned a standard user into an administrator. In this episode: - Why A04 dropped on the OWASP Top 10 without becoming less important - The difference between exploitable risk, hygiene risk, and brand reputational risk - An honest take on Security Scorecard and BitSight scores — what they measure, what they miss, and why a perfect score can coexist with a weak password policy and no MFA - The two halves of A04: data in transit (TLS/HTTPS, integrity, tampering) and data at rest (secure storage of credentials, PII, and payment data) - What a JWT actually is, and why pen testers love pulling them apart - Real pen test story: exposed config backup → leaked JWT secret → signature tampering → privilege escalation to admin - Broken server-side signature validation and other improperly implemented cryptography - Why MD5 and SHA-1 still show up for password storage 20 years too late — and what to use instead (Argon2, scrypt, bcrypt) - HSTS, secure renegotiation, and certificate expiration as A04 subcategories - The coffee shop scenario: the full chain of conditions required to exploit SWEET32 — including roughly 250 GB of captured traffic — and why no one has ever documented it happening in the wild - Why a decade-plus-old vulnerability in your environment says more about your vulnerability management program than about your crypto - Quantum computing: how today's theoretical attacks may not stay theoretical The takeaway: classify your data, choose modern algorithms, retire deprecated protocols, and keep a functioning vulnerability management program. Not because a threat actor is sitting in your local coffee shop waiting to derive your session key — but because leaving decade-old findings in place is a signal about everything else you might be missing. Next up: OWASP A05, which Brad promises is way cooler than A04. Blog: https://securit360.com/blog/ Podcast: https://securit360.buzzsprout.com/ YouTube: https://www.youtube.com/@SecurIT360 Contact: https://securit360.com/contact/ Have a topic you want us to cover? Send it our way. Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

Almost no one writes an application from scratch anymore, and that's exactly the problem. In Part 3 of our OWASP Top 10 series, Brad Causey and Jordan Natter break down A03: Software Supply Chain Failures, the category that climbed to #3 and topped OWASP's own community survey as the vulnerability organizations worry about most. If your team pulls in third-party libraries, buys SaaS, or lets anyone "vibe code" a project, this episode is for you. Brad and Jordan cover both sides of supply chain risk: the trusted third-party applications you deploy (SolarWinds being the case that put this category on the map) and the open-source components you pull into your own code without always knowing what's inside. They explain why AI and vibe coding are accelerating the problem, why jQuery is the modern-day Flash, and why "just upgrade the package" is rarely that simple. From there it gets practical: What a Software Bill of Materials (SBOM) is and why you need oneTransitive dependencies — the packages hiding beneath your packagesBuilding security checks into your CI/CD pipeline and shifting leftWhy a flaw caught in static analysis can cost ~$200, while the same flaw found in a pen test can cost $20,000+Why a pen test should validate your controls, not be your first line of defenseHow SecurIT360's Project Lantern and ChainGarde automate SBOM analysis against known and actively-exploited vulnerabilitiesA playbook for vetting vendors, writing accountability into contracts, and holding third parties responsible for actually fixing findingsThe takeaway: whether you're writing software or buying it, you need a way to inventory your components, check them against known vulnerabilities, and hold your vendors accountable — and most of it you can do with tools and teams you already have. Part 1 — Broken Access Control, IDOR & CORS: https://youtu.be/BwYJ-kZ3XaY Part 2 — Security Misconfigurations: https://youtu.be/Po8H140BijE Need a web app pen test? SecurIT360 | Cybersecurity From Every Angle  More content: https://offsec.blog Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com

In this episode, Spencer and Tyler discuss why deception is one of the best ways to catch threat actors. Resources Spencer's Cyber Deception WebinarSpencer's X posts on the topic of cyber deceptionhttps://thinkst.com/, https://canary.tools/@_subtee on X, @haroonmeer on Xhttps://tracebit.com/Work with Us: https://securit360.com Blog: https://offsec.blog/ Youtube: https://www.youtube.com/@cyberthreatpov Twitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇ Spencer's Links: https://spenceralessi.com