Hands-On Defense: Markus Schober on DFIR, Labs, and Building Better Blue Teamers

About this episode

Markus Schober discusses the importance of hands-on training in digital forensics and incident response.

In this episode of Simply Defensive , Josh Mason and Wade Wells sit down with Markus Schober , founder of Blue Cape Security, to talk all things digital forensics, incident response (DFIR), and why hands-on training beats theory every time. We dig into: 🔹 The hidden value of building your own cyber range 🔹 How IR pros train using real attacks (and why they need red team skills) 🔹 Eric Zimmerman's forensics tools and practical lab setups 🔹 Ransomware war stories from Fortune 100 response 🔹 The role (and limitations) of AI in forensics 🔹 How to break into DFIR as a practitioner — not just a paper tiger Whether you’re building detections, teaching DFIR, or just figuring out where to start, this one’s for you. 👇 Timestamps https://www.bluecapesecurity.com/ & Resources 0:00 Intro & ThreatLocker sponsorship 2:00 Markus' journey from responder to trainer 5:00 What makes a good DFIR workshop? 7:00 Building a cyber range that doesn’t suck 10:00 Favorite open-source tools (hint: Zimmerman) 14:00 Consulting vs. in-house IR 19:00 APT10, ransomware, and real-world incidents 24:00 Can AI replace forensic analysts? 27:00 Where to find Markus' courses 29:00 Parting wisdom for…

People in this episode

Hosts: Josh Mason, Wade Wells

Guest: Markus Schober

Topics covered

• digital forensics
• incident response
• hands-on training
• cyber range
• AI in forensics
• DFIR career

Keywords

• DFIR
• cybersecurity
• forensics
• incident response
• training
• ransomware
• AI

Sponsors

ThreatLocker

Mentioned in this episode

Organizations: Blue Cape Security

Products: Eric Zimmerman's forensics tools

More episodes of Simply Defensive

• S6:E3 - Tom Dejong - Inside the BHIS SOC: Triage, Curiosity, and Career Growth · May 4, 2026 · 31 min
• S6E2: John Hammond on Security Research, Storytelling, Deception, and Getting Hired in Cybersecurity · March 17, 2026 · 39 min
• From Blue Team Challenges to AI Innovations: A Conversation with Jason Haddix · February 24, 2026 · 32 min
• From Pre-Law to FLARE: How Josh Stroschein Became Google's Malware Analyst · December 1, 2025 · 40 min
• Building Zero Trust Tools: Inside ThreatLocker with Product Manager Yuriy Tsibere · November 24, 2025 · 36 min
• Cyber Insurance Explained: What Blue Teams Need to Know Before an Incident · November 17, 2025 · 33 min