Ahead of the Breach

What makes a vulnerability truly shocking is simplicity, once you notice the assumption everyone else missed. In this episode, Daniel shares a memorable SAML/SSO privilege escalation from a real engagement, then zooms out into what it takes to grow as a penetration tester: handling uncertainty, collaborating through roadblocks, and building the fundamentals that make creative problem-solving possible. The conversation blends war stories with practical guidance for both aspiring testers and security leaders. We cover everything from dependency risk and real-world scoping realities to why thinking like an attacker belongs early in the SDLC, not at the end.

What does navigating risk really look like at global scale? In this episode of Ahead of the Breach, host Casey Cammilleri sits down with Ryan Hays from Citi to explore how security teams operate inside one of the world’s largest financial institutions. Ryan shares real-world perspective on managing risk, building resilience, and making security decisions in environments defined by complexity, regulation, and constant threat pressure. From aligning security efforts with business priorities to adapting defenses across massive, interconnected systems, this conversation offers practical insight into what it takes to protect critical financial infrastructure at scale.

In this episode of Ahead of the Breach, host Casey Cammilleri sits down with Nikita Belikov of the Nevada Air National Guard to explore what cybersecurity looks like inside a military and critical-infrastructure environment. Nikita shares insight into defending high-stakes systems where availability, resilience, and mission readiness are non-negotiable. The conversation covers how military cyber teams think about risk, how defensive priorities differ from traditional enterprise security, and what it takes to operate effectively in an environment shaped by real-world threats and strict operational constraints. From translating security strategy into actionable defense to preparing for incidents where failure isn’t an option, this episode offers a grounded look at cyber defense from the perspective of someone protecting systems that truly matter.

Threat-intel expert Megan Squire joins Casey to expose how infostealers are fueling today’s cybercrime economy, what stolen logs reveal about real user behavior, and why this threat is exploding beneath the radar.

What if you could predict major security vulnerabilities weeks before they're publicly disclosed? Andrew Morris, Founder & Chief Architect at GreyNoise Intelligence, built a global sensor network that does exactly that by tracking internet-wide scanning patterns that spike 3-4 weeks before critical vulnerabilities become public knowledge. This transforms the chaotic noise of billions of daily internet scans into precise threat intelligence that helps organizations focus on real attacks. Andrew walks Casey through how he created what he calls the "opposite of Shodan." Instead of cataloging what's scannable on the internet, GreyNoise tracks who's doing the scanning and why. The technical challenge required learning new programming languages and building infrastructure across hostile network environments globally, but the result is a system that functions like noise-canceling headphones for cybersecurity. Topics discussed: The methodology behind building internet-wide sensor networks across multiple cloud providers and regional hosting environments. How network fingerprinting techniques using MTU overhead, TLS signatures, and protocol implementations reveal the true origins of scanning traffic through VPNs and proxies. The correlation between massive scanning spikes for specific software or hardware and vulnerability disclosures that follow 3-4 weeks later. Why embedded systems and edge devices represent the most vulnerable attack surface on the internet. Technical challenges of processing and indexing billions of daily network sessions while applying pattern matching and classification rules at line rate performance. The operational realities of maintaining distributed infrastructure in hostile network environments. How threat actors use geographic and software-specific targeting patterns that become visible only through comprehensive internet-wide monitoring capabilities. The discovery of zero day vulnerabilities through automated classification pipelines that identify previously unknown attack patterns. Why traditional threat intelligence approaches fail to distinguish between legitimate research scanning and malicious reconnaissance activities targeting organizations. Strategic approaches to handling sensor network detection and fingerprinting by adversaries, including infrastructure rotation and traffic obfuscation techniques. Listen to more episodes: Apple Spotify YouTube Website

Modern attackers have abandoned obvious indicators and now mimic legitimate engineering activities so closely that traditional detection methods fail. Roger Allen, Sr. Director, Global Head of Detection & Response at Sprinklr, has watched this evolution firsthand. He gives Casey the rundown of how his team's response involves outcome-based detection strategies that focus on what attackers accomplish rather than the specific actions they take to get there. But detection is only part of the equation. From transforming UBA alerts into contextualized "events of interest" that correlate across the MITRE framework to implementing breach response scenarios that consider cloud-native production implications, Roger shares tactical approaches that bridge the gap between red team thinking and blue team operations. Topics discussed: Why focusing on what attackers accomplish rather than individual actions creates more effective monitoring as threat actors become increasingly sophisticated in mimicking legitimate engineering activities. Filling the critical 10-20% gap in security coverage through business context enrichment and custom detection logic that vendors can't provide. Converting traditional user behavior analytics from noise-generating alerts into correlated "events of interest" that map to MITRE kill chain stages for dynamic alert prioritization. Systematic approaches to removing unnecessary tools like Netcat and Telnet while creating contextual detections for essential utilities. Building tier-based response frameworks that account for production disruption risks when containing threats in environments where simply isolating hosts could shut down customer-facing services. Implementing scenario-based training that goes beyond tabletop exercises to create muscle memory for security operations teams responding to active compromises. Why having practitioners in both development and leadership chains at security vendors correlates with product effectiveness and company growth trajectories. How to distinguish between genuine artificial intelligence capabilities and rebranded automation when evaluating security tools, plus practical applications for analyst efficiency without replacement Listen to more episodes: Apple Spotify YouTube Website

What if you could predict which vulnerabilities threat actors will weaponize months before CISA adds them to their Known Exploited Vulnerabilities list? Andrew Grealy, Head of Armis Labs, has built exactly that capability, providing organizations with threat intelligence that arrives 3-12 months ahead of traditional indicators. His "left of boom" approach changes how security teams prioritize patches and allocate resources. But early warning is just the beginning, Andrew tells Casey. From mom and pop honeypots that catch nation-state actors to AI-powered supply chain attacks that slip malicious packages into enterprise applications, Andrew details how attackers are weaponizing the same AI tools that security teams use for defense. He also offers insights on the "triple threat" evolution of ransomware and practical frameworks for securing AI-generated code. Topics discussed: Building CVE early warning systems that identify threat actor targets 56% faster than CISA's Known Exploited Vulnerabilities list. Implementing "left of boom" intelligence collection through honeypots in mom and pop infrastructure. Moving beyond CVSS scores as risk indicators to prioritize patches based on actual threat actor behavior and CWE patterns. Deploying strategic security controls like WAFs to eliminate 28% of ESX server console attacks, reducing patch urgency and operational disruption. Understanding the "triple threat" ransomware evolution that combines traditional encryption with data exfiltration and AI-powered internal investigation for multiple revenue streams. Combating AI-accelerated supply chain attacks where 54% of coding assistants automatically introduce vulnerabilities into generated code. Preventing typosquatting attacks where threat actors create packages with similar name that AI tools recommend to infiltrate internal applications. Establishing approved package repositories with exact version matching and implementing coding checks throughout the development pipeline as countermeasures. Evaluating LLMs for security applications by testing with known answers first, then gradually increasing complexity to validate capabilities before deployment. Listen to more episodes: Apple Spotify YouTube Website

What happens when a covert entry specialist turns a Super Bowl hotel room into a rooftop breach point? Brent White, Sr. Principal Security Consultant & Covert Entry Specialist at Dark Wolf Solutions, offers Casey his approach to physical security testing that goes far beyond lock picking, rooted in understanding human psychology and building systematic infiltration strategies. Brent shares how his team compressed an entire backpack of penetration tools into a concealed-carry belt system that even works with swimming trunks. But the real breakthrough isn't in the gear — it's in his multi-day reconnaissance methodology that builds familiarity before attempting entry. Brent's "Post It flag" system transforms traditional physical assessments by having clients mark objects they're comfortable losing, leading to scenarios where his team wheels office chairs and $500 juice machines through bank lobbies while security guards helpfully watch their haul. This approach moves beyond simple "can you get in" to demonstrating real-world impact and exfiltration capabilities. Topics discussed: Building familiarity through multi-day reconnaissance that establishes psychological comfort before entry attempts rather than relying on cold tailgating approaches. Transitioning from backpack-based toolkits to concealed carry belt systems that house bypass tools for major door configurations, American padlock bypasses, and dimple lock rakes. Mapping regional security culture patterns where Northeast locations show higher vigilance compared to South and Midwest willingness to help strangers. Using Proxmark readers and modified Flipper Zero devices hidden in Starbucks cups to capture badge credentials during natural conversations. Implementing hybrid covert-to-overt assessment methodology that escalates until detection then transitions to educational walkthroughs with clients. Developing systematic drone security evaluation frameworks that assess radio frequencies, web interfaces, payload access, and MAVLink flight data to identify pilot locations. Creating quick-change disguise systems using wig colors matched to facial hair combined with tactical clothing featuring concealed tool pockets. Establishing post-engagement flag collection strategies where clients mark acceptable-loss items, enabling teams to wheel office chairs and expensive equipment through lobbies as proof of exfiltration capability. Understanding how sUAS government standards are forcing commercial drone manufacturers to implement stronger security measures. Navigating destructive versus non-destructive entry protocols when clients approve hinge removal and window manipulation while avoiding classified room decertification that triggers 24/7 guard requirements. Listen to more episodes: Apple Spotify YouTube Website

After 21 years in cybersecurity, Phillip Wylie, Penetration Tester & Podcast Host at The Phillip Wylie Show, has learned how a critical flaw in how most organizations approach security testing when a "low-risk" vulnerability suddenly became exploitable between scheduled assessments. He shares this knowledge with Casey, and more, including why annual penetration testing creates dangerous gaps that threat actors are increasingly exploiting through non-traditional attack vectors like IoT devices. Phillip's dual perspective as both a penetration tester and IoT security professional provides unique insights into how threat actors are adapting their tactics. As traditional endpoints become harder to exploit, attackers are pivoting to security cameras, printers, and other connected devices that often maintain default credentials and poor security hygiene. His systematic approach to community building and client relationships demonstrates how technical expertise must be balanced with communication skills and ego management to create lasting security improvements. Topics discussed: The critical security gaps created by annual penetration testing schedules, demonstrated through real-world examples of vulnerabilities that became exploitable between scheduled assessments. How threat actors are pivoting to IoT devices as primary attack vectors when traditional IT endpoints become more difficult to exploit. Essential IoT security controls including credential management, firmware updates, network segmentation, and protocol security to prevent corporate network compromise through connected devices. The evolution of Windows security from insecure-by-default configurations in NT4.0 to locked-down modern systems, and how this shift has changed offensive security methodologies. Advanced penetration testing reporting strategies that build client trust through adequate documentation, proof-of-concept demonstrations, and balanced presentations of security posture. Why focusing on data discovery through network shares and file systems often provides more business-relevant findings than achieving elevated privileges like domain admin. Practical approaches to building cybersecurity communities through combined virtual and in-person engagement, including structured meetups and CTF-based learning sessions. The importance of highlighting positive security controls during assessments to provide balanced risk perspectives and maintain productive client relationships. Strategies for staying current with emerging technologies including AI adoption to avoid becoming obsolete in rapidly evolving cybersecurity landscapes. Listen to more episodes: Apple Spotify YouTube Website

Many cybersecurity programs fail because they prioritize tools over understanding what they're protecting. Brett Price, Lead Cybersecurity Consultant & vCISO at AccessIT Group, brings decades of experience to explain why data discovery and governance create more security value than any technology purchase. His approach starts with mapping critical data to business functions before implementing solutions — a methodology that has helped organizations discover everything from unsecured credit card data in S3 buckets to massive compliance gaps that traditional scanners missed entirely. Drawing from his experience as a reformed QSA and virtual CISO across multiple industries, Brett tells Casey how successful security leaders build programs around culture and relationships rather than technical controls. His framework transforms overwhelming vulnerability backlogs into focused remediation strategies by prioritizing currently exploited vulnerabilities over theoretical risks, enabling resource-constrained organizations to eliminate real attack vectors first. Topics discussed: The evolution of cybersecurity leadership from Steve Katz's appointment as Citigroup's first CSO in 1995 to today's business-aligned security executives. Why organizations fail by throwing tools at security problems without first understanding their critical data locations and business functions. Building incident response plans that include communication trees, out-of-band protocols, and muscle memory development through tabletop exercises. DSPM strategies for discovering, classifying, and protecting crown jewel data across cloud and on-premises environments. Vulnerability prioritization methodologies that focus on currently exploited vulnerabilities rather than overwhelming teams with thousands of theoretical risks. Creating security cultures through trust-building and gradual implementation rather than forcing dramatic changes that trigger organizational resistance. The limitations of compliance frameworks like PCI DSS and HIPAA that create false security by protecting only specific data types while missing broader organizational risks. Essential security metrics for boardroom reporting, including mean time to detect, mean time to resolve, and vulnerability burn-down rates. How healthcare and manufacturing industries struggle with cybersecurity implementation due to budget constraints and rapidly expanding attack surfaces. Building holistic security programs using frameworks like NIST CSF and CIS Controls that address governance, technical controls, and business alignment simultaneously. Get in touch with Brett: brettp@accessitgroup.com Listen to more episodes: Apple Spotify YouTube Website

Most security architecture programs struggle to demonstrate their value because they focus on creating diagrams rather than driving implementation. Parthasarathi Chakraborty, Former Deputy CISO at Natixis CIB, shares his approach to transforming security architecture from theoretical frameworks to measurable business impact. With experience across Fortune 15 banks to mid-market companies, Partha gives Casey a peek into how his "architectural assurance function" bridges the critical gap between security requirements and engineering implementation, reducing incidents, accelerating deployment times, and proving security's ROI to business leaders. Topics discussed: Why many organizations have security architecture in name only, with PowerPoint diagrams and Word documents that provide little practical guidance to engineering teams. How to turn high-level security principles into detailed engineering specifications that developers can actually implement. Tracking how architecture maturity reduces time-to-market for applications, minimizes configuration drift, and decreases security incidents. Building a specialized team with both technical depth and breadth to validate whether engineering implementations adhere to security requirements. Incorporating compliance standards, threat data, and security operations insights to create risk-based architectural requirements that address real-world threats. Codifying security blueprint requirements into cloud security posture management systems to detect and remediate drift automatically. Ensuring security requirements remain simple enough for teams to adopt while still addressing critical risks. Navigating initial resistance through clear communication, demonstrating value, and creating structured roles and responsibilities. Creating feedback loops between security architecture, engineering teams, and assurance functions to continuously improve both requirements and implementation. Evolving from reactive patching toward proactive security design that prevents vulnerabilities from reaching production. Listen to more episodes: Apple Spotify YouTube Website

When Tim Silverline received a pentest report that was essentially a clean bill of health with zero evidence of actual testing, he knew his security program had a problem. As Vice President of Security at Rocket Lawyer, this experience sparked a complete transformation from annual security theater to continuous, evidence-based testing that provides actionable intelligence — with Sprocket! In his chat with Casey, recorded at RSA 2025, Tim shares hard-earned insights about building effective security programs in established organizations while navigating the complexities of rapid AI development and multi-compliance requirements. Tim touches on how static analysis tools create more noise than value, explaining how packages flagged as critical vulnerabilities often aren't even loaded into memory or used in exploitable ways. His solution involves runtime analysis with eBPF sensors that monitor actual execution rather than theoretical package inventories. He also discusses the unique challenges of implementing SOC 2 controls in an 18-year-old company versus a startup, emphasizing the critical importance of executive alignment before attempting cultural transformation. Topics discussed: The limitations of traditional annual penetration testing and why continuous testing provides better coverage for organizations with rapid deployment cycles. How runtime analysis with eBPF sensors eliminates false positives by monitoring actual code execution rather than static package inventories that generate noise. The strategic approach to managing SOC 2 compliance implementation in established organizations, focusing on executive alignment before attempting cultural transformation. Advanced attack surface management techniques that extend beyond hosted applications to include third-party platforms and exposed API keys. The challenge of staying ahead of AI development from a security perspective, particularly as interconnected AI models create complex data flow patterns difficult to audit. Why clean penetration test reports with no evidence of actual testing indicate vendor problems rather than strong security posture. The evolution from static vulnerability scanning to context-aware prioritization based on actual exploitability and system exposure. Strategies for integrating security findings into development workflows through two-way JIRA integration and regular cross-team security reviews. The growing complexity of non-human identity management as DevOps practices increase the proliferation of API keys and service accounts across cloud environments. How the NextJS vulnerability response demonstrates the value of runtime monitoring for rapidly identifying which instances actually use vulnerable middleware configurations. Listen to more episodes: Apple Spotify YouTube Website