Hacked and Unfiltered

In Episode 11, Omar Rao breaks down why ransomware in 2026 is no longer just about encryption. It is about leverage. From active groups like Qilin, Akira, Play, Cl0p, Medusa, DragonForce, and LockBit 5.0 to the newer tactics built around identity abuse, SaaS pressure, backup targeting, and AI-assisted tradecraft, this episode explains how modern ransomware crews really operate and what enterprises need to understand before access turns into business disruption.A lot of people still think ransomware starts when the ransom note appears. That is already too late.In this episode, I break down how ransomware in 2026 really works. It is no longer just about encrypting files. It is about leverage, identity abuse, stolen access, SaaS pressure, backup targeting, and recovery denial.I also cover the groups making the most noise right now, including Qilin, Akira, Play, Cl0p, Medusa, DragonForce, and LockBit 5.0, along with the newer tactics shaping modern ransomware operations.We cover:• How ransomware groups are getting in now• Why identity and SaaS matter more than ever• How AI is speeding up attacker tradecraft• What enterprises should do before access turns into pressureIf you work in security, incident response, IAM, cloud, backup, or executive leadership, this one is worth your time.Listen, share with like-minded people, and let me know your thoughts. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com

In Episode 9, Omar Rao breaks down why identity is no longer just a login issue. It has become one of the biggest battlefields in modern cybersecurity. From compromised accounts and mailbox abuse to OAuth risk, service accounts, and lateral movement, this episode explains how attackers use trusted identities to move quietly through enterprises and why organizations need to rethink identity as a full compromise path, not just an access control feature.A lot of organizations still treat identity like a login problem. That is old thinking.In this episode, I break down why identity is now one of the biggest battlefields in cybersecurity and how one compromised account can quietly turn into privilege abuse, SaaS exposure, lateral movement, and enterprise-wide risk.We cover:• Why identity is more than authentication• How attackers use trust to move through enterprises• Where OAuth, service accounts, and mailbox access become dangerous• What enterprises should focus on right now to reduce identity riskIf you work in security, IAM, cloud, SaaS, help desk, or leadership, this episode is worth your time. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com

In this episode, Omar Rao breaks down why cyber resilience is no longer only a security team issue. It is a leadership issue. When a serious cyber incident happens, the quality of executive thinking, communication, and decision-making can shape the outcome as much as the tools on the screen. This episode explains what leaders often get wrong during cyber crises, how strong organizations respond under pressure, and what real cyber resilience looks like when the goal is not only to detect the threat, but to keep the business moving.We break down how executives, boards, and business leaders should think during a live cyber event, where decision-making often goes wrong, and what real cyber resilience looks like when the goal is not just to detect the threat, but to keep the business moving.We cover:• Why cyber incidents are leadership events, not just technical events• What executives still get wrong under pressure• What strong decision-making looks like during crisis• How boards should think about cyber resilience in a more useful wayA strong listen for founders, executives, CISOs, operators, board members, and teams focused on resilience and real-world security leadership. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com

In this episode, Omar Rao breaks down how AI is changing cybersecurity on both sides of the fight. Attackers are using it to move faster, scale phishing, improve reconnaissance, and create more convincing deception. Defenders can use it too, but only if they stop treating AI like a buzzword and start using it as an operational advantage. This episode covers how AI is accelerating threats, where DSPM fits into modern defense, and what real security teams should do now to reduce exposure before speed becomes the attacker’s biggest advantage.Attackers are using it to scale phishing, improve reconnaissance, and move faster through noisy environments. Defenders can use it too, but only if AI is tied to real operational value.We cover:• How AI helps attackers move faster• Good AI use cases for defenders• Why DSPM matters in the AI era• What leaders and security teams should do nowA strong listen for security leaders, engineers, founders, analysts, and teams focused on cyber resilience. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com

In this episode, Omar Rao breaks down how attackers are no longer limited to targeting companies directly. Instead, they are compromising the software, tools, vendors, and automation workflows organizations already trust. Using real-world style examples, this episode explains how supply chain attacks happen, why they are difficult to detect, and what security teams, leaders, and developers need to do before trusted software becomes the path to a serious breach. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com

In this first episode, Omar Rao breaks down why today’s biggest cyber risks are no longer limited to stolen data or phishing emails. From operational technology and critical infrastructure to cloud identity abuse and software supply chain compromise, this episode explains how modern attacks are becoming faster, more disruptive, and more dangerous in the real world. You will hear what these threats mean, why they matter now more than ever, and the practical actions organizations should take before a small weakness turns into a major incident. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit omarrao.substack.com