Threat Talks - Your Gateway to Cybersecurity Insights

A SaaS company buys enterprise ChatGPT for 800 staff and strangely only uses 30 seats. A corporate signs annual risk exemptions for five years until the exception list itself is mistaken for a working security process. Same root cause, two symptoms.Compliance is not security. Security culture is company culture. If your employees do not trust their managers, no policy you write will save you.Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Sina Yazdanmehr, Founder and Managing Director of Aplite GmbH, on why security policy depends on trust, why a signed risk acceptance is a legal act, and what a leadership cadence on security communication actually looks like.Timestamps00:00:00 Introduction00:02:20 When risk exceptions become culture00:07:50 Turning a five-year exemption list around00:09:07 Working with auditors instead of around them00:13:14 The trust gap: enterprise tools and personal accounts00:19:27 Security culture is company culture00:22:21 Wrap and what is nextKey Topics CoveredWhy employee trust in management determines whether any security policy landsHow sanctioned enterprise tools, AI included, quietly fail when context and trust are missingThe legal weight of a signed risk acceptance, and why most managers treat it as paperworkWhat a working leadership cadence on security communication actually looks likeRelated ON2IT Content & Referenced ResourcesAplite GmbH: https://aplite.dePrevious Threat Talks with Sina Yazdanmehr: https://www.youtube.com/watch?v=wBodTl_nY1wPrevious Threat Talks with Sina Yazdanmehr: https://www.youtube.com/watch?v=fBwdGXf-0dYThreat Talks: https://threat-talks.com/ON2IT (Zero Trust as a Service): https://on2it.net/AMS-IX: https://www.ams-ix.net/amsSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

The biggest security threat in your organization right now? Your sales team.AI coding tools have crossed into every department, and most organizations have no idea what's being built or deployed in their name.In this episode of Threat Talks, Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Jack Cable, CEO and Co-founder of Corridor and former lead of Secure by Design at CISA to talk about why the answer isn’t to block innovation.What's in this episode for you:The non-engineer coding problem. AI coding agents have put software creation in the hands of anyone with a laptop, and the security implications are only starting to land.Why blocking doesn't work. Teams self-provision anyway, individual accounts, zero visibility. Shadow vibe coding is far worse than sanctioned use, and organizations that block fall behind.How to actually solve it. Platform-level mitigations that prevent known vulnerability classes regardless of who wrote the code: standard auth libraries, dependency management, MFA on anything externally deployed.Timestamps00:00 – Introduction 01:41 – Where It All Started: Hacking the Air Force at 18 06:25 – What Jack Found: 350 Vulnerabilities Across Google, Facebook and the DoD 12:24 – How AI Coding Agents Changed Software Development 17:04 – How Secure Is the Code That AI Coding Agents Write 28:53 – What CISOs Need to Know About Agentic AI Security 31:50 – Next Week and Wrap-UpKey topics coveredHow software development has changed with the arrival of AI coding agentsWhy sanctioned AI coding use requires visibility into tools, licenses, and configurationsWhat the right guardrails look like for engineering teams vs. non-technical teamsResourcesCorridor: https://corridor.devThreat Talks – New US Cyber Strategy [URL]Threat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

If you're waiting for the executive orders to act, you're already behind. The U.S. has just released a new national cyber strategy.The core message is clear: stop waiting to be hit, and start making it costly to try. In this episode of Threat Talks, Caitlin Clarke, Senior Director of Cybersecurity Services at Venable and former Special Assistant to the President for Cybersecurity & Emerging Technology, join Lieuwe Jan Koning, Co-founder & CTO at ON2IT Cybersecurity to break down what the strategy actually says, and what it means for your organization. The direction is clear. The details are still coming. But the clock is already running. This episode helps you stay ahead with three clear pillars of the strategy:Pillar 1: Shaping adversary behavior – making it harder, costly and risky to target US and allied interests. Pillar 2: Regulatory simplification – deregulation, or simply harmonizing cyber incident reporting requirementsPillar 4: Securing critical infrastructure – your stack may already contain foreign technology that can be labelled as ‘adversarial’ Spoiler alert: if you haven't started your Zero Trust and post-quantum cryptography roadmaps yet, the new strategy has a message for you too. Timestamps00:00 – America's New Cyber Strategy: First Impressions 01:28 – What the US National Cyber Strategy Is Really Saying 02:52 – Pillar 1: Shaping Adversary Behavior and Cyber Deterrence 10:28 – Pillar 4: Securing Critical Infrastructure and Adversary Technology 18:07 – Pillar 2: Harmonizing Cyber Incident Reporting Requirements 22:17 – What CISOs Should Do Now: Supply Chain, Zero Trust and Post-Quantum Cryptography 27:11 – Wrap up Key Topics CoveredWhat the US national cyber strategy means for security leaders How cyber deterrence is shifting beyond pure defense Why supply chain risk is now a board-level issue What regulatory simplification means for cyber incident reporting requirements Where Zero Trust and post-quantum cryptography fit in ResourcesThreat Talks – Vendor Audit episode with Lokke Moerel: https://www.youtube.com/watch?v=hyKOxJUa4Go Threat Talks – Vendor dependency episode with Bart Groothuis: https://www.youtube.com/watch?v=Vj5Z7RYMACY Office of National Cyber Director website: https://www.whitehouse.gov/oncd/ Threat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

You don’t control the technology your business runs on.That’s an uncomfortable reality. But the truth is: your infrastructure runs on foreign technology.Your data depends on external suppliers.And if they fail – you feel it.The EU has decided to step in. In this episode of Threat Talks, Lokke Moerel (Professor of Global ICT Law at Tilburg University and leading expert in EU cybersecurity regulation) breaks down how Europe’s new cybersecurity package is reshaping supply chain security. Because this is not just about audits. From Chinese components embedded in infrastructure to US-controlled cloud services, organizations are relying on suppliers that sit outside their control. And that creates a different kind of risk. Not just technical – but strategic. The EU is now responding with a structural shift:One certification approach across Europe Clearer rules for suppliers in critical functions Separation of technical security and geopolitical risk This changes how supply chain security works.For CISOs and security leaders, the message is clear:If your cybersecurity risk mitigation strategies don’t account for dependency on external suppliers, you’re exposed. Timestamps00:00 – Your Vendor Passed the Audit—Why You’re Still Exposed01:32 – The EU Cybersecurity Landscape: What’s Changing Now04:06 – The Supply Chain Problem: Why Current Cybersecurity Risk Mitigation Strategies Fail08:39 – What This Means: New Rules for Critical Suppliers and Infrastructure17:13 – What Organizations Must Do Now to Strengthen Cybersecurity Risk Mitigation Strategies20:34 – Geopolitics vs Security: Will Certain Suppliers Be Restricted?25:07 – Innovation vs Regulation: Are We Heading for a Two-Speed Market?28:36 – Practical Next Steps: How to Prepare Your Supply Chain Today29:27 – Key Takeaways and Final Thoughts Key Topics CoveredWhy dependency on China and the US creates new supply chain risk How the EU cybersecurity package reshapes supplier accountability Why security and geopolitics are now treated separately What organizations must do to strengthen cybersecurity risk mitigation strategiesResourcesThreat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/amsThreat Talks episode Bart Groothuis: https://www.youtube.com/watch?v=Vj5Z7RYMACY EU Cybersecurity package: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_105 Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Log4j caught everyone off guard. React2Shell might be doing the same right now.Across thousands of React apps, exposure is already baked in - accelerated by vibe coding and shipped without scrutiny.In some cases, one request is all it takes.React2Shell turns that exposure into remote code execution in React and Next.js environments -triggered by a single HTTP POST request.In this episode of Threat Talks, host Rob Maas and SOC analyst Yuri Wit break down how React2Shell works, why it’s more serious than it looks, and what makes it so easy to exploit.The risk is significant, and what makes it worse is how little attention it’s getting.As developers increasingly rely on AI-generated code, applications are being shipped faster - but not always with full visibility into how components behave. That creates blind spots attackers can take advantage of, especially when serialization and deserialization flaws are involved.We cover how React2Shell works, how attackers exploit serialization and deserialization flaws, and what actions you need to take now to reduce risk.If your organization runs React or Next.js applications, assume exposure until proven otherwise - especially if this hasn’t been on your radar yet.React2Shell isn’t making Log4j headlines.That doesn’t mean the risk is smaller.Timestamps00:00 – React2Shell Introduction and Log4j Comparison00:28 – What Is React and How Vibe Coding Introduces Security Risks02:48 – How the React2Shell Vulnerability Enables Remote Code Execution05:49 – How Attackers Exploit React2Shell with a Single POST Request07:28 – Impact of React2Shell RCE on Server Privileges and Access08:18 – How to Mitigate React2Shell and the Next.js Vulnerability11:18 – Incident Response for React2Shell Exploitation13:25 – Ongoing React2Shell Risk and Why Many Apps Remain Vulnerable Key Topics CoveredHow the React2Shell and Next.js vulnerability expands the attack surface across modern web applicationsWhy vibe coding security risks are accelerating exposure without developers realizing itPractical mitigation: patching, EDR detection, WAF limitations, and reducing attack surfaceResourcesThreat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/amsThreat Talks episode on Log4j: https://www.youtube.com/watch?v=CiqNmJaak5I Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Zero Trust is easy to say. Hard to execute.Most organizations try to build it themselves.Most underestimate the complexity.Most get stuck in architecture diagrams instead of protecting what actually matters: data.If execution determines success – should you really be doing it alone?In this episode of Threat Talks, Lieuwe Jan Koning, Co-Founder and CTO at ON2IT Cybersecurity, sits down with Dr. Chase Cunningham, architect of the Zero Trust Extended (ZTX) framework, to break down what Zero Trust really requires in practice – not in theory.Zero Trust isn’t a product. It’s not a checkbox.It’s a decision about what you protect first – and how seriously you take execution.If your job is to protect critical data without drowning in complexity, this episode will recalibrate your approach.Because in the end, Zero Trust doesn’t fail on strategy.It fails on execution.Timestamps00:00 – Introduction to Zero Trust Data Protection00:50 – How Zero Trust Started at Forrester03:19 – The ZTX Framework and Structuring Zero Trust05:05 – Data at the Core of Zero Trust Data Protection08:22 – Success Factors for Effective Zero Trust Data Protection13:06 – Why Most Organizations Should Not DIY Zero Trust15:36 – Breaches, Misconfiguration, and Market Reality18:07 – How COVID Accelerated Zero Trust Adoption19:25 – Closing Thoughts on Zero Trust Fundamentals Key Topics CoveredWhere Zero Trust actually started – and how it evolved beyond network segmentationThe shift from perimeter thinking to data-first protectionWhy most internal Zero Trust programs stallThe operational discipline required to make Zero Trust workResourcesThreat Talks: https://threat-talks.com/ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/amsThreat Talks playlist on Zero Trust: https://www.youtube.com/playlist?list=PLF5mXtEG4t5wigSRB3fpyFfMYp3l1Ux2gZero Trust Dictionary: https://on2it.net/resources/zero-trust-dictionary/ Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.

Your biggest threat this year isn’t malware. It’s your own AI assistant.OpenClaw connects an LLM directly to your terminal, browser, email, and chat. It runs with your permissions. It executes tasks without hesitation.Days after launch, researchers found a One-Click RCE.Cisco called it a security nightmare.Gartner called it an unacceptable risk.OpenClaw (formerly known as Clawdbot and Moltbot) represents a new phase of agentic AI: autonomous assistants operating inside your environment with almost no guardrails.The headlines around OpenClaw have been clear: it’s a serious threat. But how should we handle agentic AIs like OpenClaw moving forward?In this Threat Talks episode, Field CTO Rob Maas and SOC analyst Yuri Wit break down what OpenClaw actually does, where AI agent security breaks, and whether or not you should deploy OpenClaw.OpenClaw is powerful. It’s useful.It’s also proof that many of us are not ready for AI agents with this level of autonomy. Before you let an AI agent into your systems, understand what happens when it runs unchecked.TimestampsKey Topics Covered· How OpenClaw works and why agentic AI changes the security model· The One-Click RCE and what it reveals about AI agent security· Malicious skills, default allow design, and autonomous privilege abuse· Realistic mitigation strategies including sandboxing and controlled environmentsResources· Threat Talks: https://threat-talks.com/ · ON2IT (Zero Trust as a Service): https://on2it.net/ · AMS-IX: https://www.ams-ix.net/ams Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Certifications play a central role in cybersecurity career development.Yet many experienced engineers find themselves failing exams they should easily pass.The problem isn’t a lack of knowledge or skills.It’s the disconnect between real-world security work, and certifications built around memorization, UI trivia, and version-specific details that will be obsolete in two months.In this episode of Threat Talks, Rob Maas (Field CTO, ON2IT) and Nicholai Piagentini(Technical Enablement Engineer, ON2IT) break down why this happens, how certification exams are designed, and how to pass any cybersecurity certification without memorization or falling for trick questions. They explore how well-written exams validate real job tasks, while poorly designed ones drift into reading comprehension, UI trivia, and version-specific details that lose value the moment the product changes.From blueprint-driven preparation to smart elimination tactics and knowing when not to overthink an answer, this is a grounded look at how to pass any certification for meaningful cybersecurity qualifications.TimestampsKey Topics Covered· Why many certification exams fail at measuring real-world cybersecurity skills· How to pass cybersecurity certification exams by focusing on concepts, not memorization· What makes a good vs bad exam (and how vendors design them)· Practical tactics for exam day, preparation strategies, and dealing with nerves Resources· Threat Talks: https://threat-talks.com/ · ON2IT (Zero Trust as a Service): https://on2it.net/ · AMS-IX: https://www.ams-ix.net/amsSubscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE...► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirthttps://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com

Detection fails without identity. When activity isn’t tied to a person, anomalies stop telling a story - they’re just signals without context. And when your logs only show IP addresses, your security team is left responding to shadows, not real risk. In this Threat Talks Deep Dive, Rob Maas (Field CTO, ON2IT) and Nicholai Piagentini (Technical Enablement Engineer, ON2IT) show how identity-based firewalling fixes that-by enforcing policy based on who the user is, not where they connect from.The result: stronger network access control, cleaner zero trust firewall enforcement, and better enterprise security decisions. (00:56) - Intro - Detection fails without identity (01:02:07) - Identity signals - users, devices, tags (02:15:43) - Why identity-based firewalls win - zero trust & threat detection (04:48:01) - Why teams skip it -“as-is” migrations & fear of complexity (07:08:13) - Terminal servers - a network access control blind spot (08:17:11) - NAT & service accounts - who is the real identity? (10:15:12) - When user ID feels impossible - the wireless workaround (11:12:12) - How to start safely - turn it on, validate, tighten policy (14:16:30) - Not optional anymore - zero trust firewall due diligence (15:30:01) - Best advice - start imperfect, identity data wins (17:09:58) - Wrap - stop guessing, know who’s acting Key Topics Covered• Why anomaly detection breaks without identity correlation in firewall logs• How identity-based policy improves network access control and reduces lateral movement• Common failure points: terminal servers, NAT, service accounts, AD timeouts• A low-risk rollout: enable for visibility first, then enforce zero trust rulesRelated ON2IT content & explicitly referenced resourceshttps://threat-talks.com/https://on2it.net/https://www.ams-ix.net/amsThreat Talks connects cyber threats to operational reality-so CISOs and architects can make decisions faster.Subscribe, follow, and turn on notifications to stay ahead of what changes enterprise security next.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

You’re Port Control. A vessel requests entry.No captain. No crew. Just autonomy.In maritime cybersecurity, the risk isn’t that the ship is autonomous.It’s that you no longer know who’s steering.Lieuwe Jan Koning (Co-Founder & CTO, ON2IT) joins Stephen McCombie (Professor of Maritime IT Security, NHL Stenden) and Hans Quivooij (CISO, Damen Shipyards) to expose the illusion of control in autonomous shipping - where technology moves fast, responsibility blurs, and regulation lags behind.(00:05) - No captain, just code: the Port Control dilemma (02:05:15) - Autonomous shipping is here - and it’s remote by design (06:15:48) - When it crashes: who owns the blame (and the bill)? (07:38:12) - Ready or not: why “keeping watch” breaks at sea (10:12:49) - Predictable = steerable: the risks most teams miss (13:49:46) - Visibility vs compromise: when the ship becomes a weapon (18:46:10) - The mindset shift: from castles to constant compromise (20:10:45) - Regulation gap: high impact, low control (21:45:50) - Too late? Only if you stay blind to real threats (01:50:19) - Stop splitting IT and OT: defend vessels like HQ (05:19:42) - Put it on the agenda: ask better questions, run scenarios (09:42:22) - Wrap: make it tangible, build security into autonomy Key Topics Covered• Why maritime cybersecurity now decides physical safety, not just data protection• How predictability in autonomous vessels creates exploitable maritime cyber risk• Where responsibility breaks down when humans leave the bridge• What cyber attacks on critical infrastructure look like once they reach the sea• What to do next to protect against cyber attacks at seaRelated ON2IT content & explicitly referenced resourcesBefore the Mayday: Cyber Attacks at Sea: https://www.youtube.com/watch?v=4rxWUmjbYOo Hack the Boat episode: https://www.youtube.com/watch?v=Xa0TJ3eRTCw Threat Talks: https://threat-talks.com/ON2IT (Zero Trust as a Service): https://on2it.net/AMS-IX: https://www.ams-ix.net/amsThreat Talks connects cyber threats to operational reality - every week.Subscribe and turn on notifications to stay ahead of emerging cyber threats across IT, OT, and critical infrastructure.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

2025 was the year detection stopped being enough.Because attacks stopped behaving the way detection was built to handle.OT systems were hit with real-world consequences. AI stopped being just a productivity tool and became an attacker. And SOCs discovered - often painfully - that speed alone still means reacting too late.In this special end-of-year Threat Talks episode, Lieuwe Jan Koning is joined by Luca Cipriano, Yuri Wit, and Rob Maas, all in ugly Christmas sweaters, to unpack why the cybersecurity trends of 2025 represent a structural break, not a gradual evolution.They trace how attackers scaled faster than defenders, why SOC automation became unavoidable, and how preemptive security and Zero Trust execution are emerging as the only way to regain control.This isn’t a recap for curiosity.It’s a map of how we got here - and what must change in 2026 to stay ahead.(00:00) - Introduction: why 2025 felt fundamentally different (01:31) - - 05:12 The threat landscape shifts: OT security and real-world impact (05:12) - - 07:27 A new normal: how AI changed daily security work (07:27) - - 09:31 The most surprising attacks of 2025 (09:31) - - 20:00 Inside the SOC: scale, speed, and analyst fatigue (20:00) - - 22:15 “There are protections against AI… right?” (22:15) - - 20:23 Zero Trust redefined: can it handle AI-driven attacks? (30:23) - - 32:04 Why prevention matters more than ever (32:04) - - 41:06 Looking ahead: predictions for cybersecurity in 2026 Key Topics Covered• How AI-powered attacks and autonomous malware altered attacker economics• Why OT security and critical infrastructure moved to the front line• Where SOC automation helps - and where it creates false confidence• Why preemptive security and Zero Trust shift defense from reaction to controlRelated ON2IT Content & Referenced ResourcesI-Soon episodehttps://www.youtube.com/watch?v=Rkp4OWOcCeU&t=1sSalesloft supply chain attack episodehttps://www.youtube.com/watch?v=_asJ2AN7cbAPromptLock malware episodehttps://www.youtube.com/watch?v=lKcUwLPBC8kMCP security episodehttps://www.youtube.com/watch?v=IkV6jkuYz5gZero Trust episodes playlisthttps://www.youtube.com/playlist?list=PLF5mXtEG4t5wigSRB3fpyFfMYp3l1Ux2gZero Trust infographic (PDF)https://on2it.s3.us-east-1.amazonaws.com/250429_Infographic_ZT.pdfThreat Talks is built for CISOs and security leaders navigating real trade-offs—not vendor promises.Subscribe for grounded insight on Zero Trust execution, AI-driven threats, SOC automation, and preemptive security from practitioners in the field.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Attackers are abusing a WSUS flaw - Microsoft’s Windows Server Update Services - to detonate PowerCat, spawn reverse shells, and plant ShadowPad. All from the update server your entire Windows estate trusts by default.One weak crypto key and a broken deserialization function let attackers hit your WSUS server with unauthenticated SYSTEM-level code execution. Chinese APT groups are already exploiting it to drop malware in memory, blend into legitimate WSUS traffic, and pivot deeper into the network.Yes WSUS patch exists, but even if you patch it today, the real problem remains:Your WSUS server is a high-value target with high-trust pathways - and most environments expose it far more than they think.Watch host Lieuwe Jan Koning - with Blue Team expert Rob Maas and Red Team lead Luca Cipriano - break down how the exploit works, how attackers chain it into real-world intrusions, and the Zero Trust fixes that actually matter.(00:00) - Intro (01:03) - What is a WSUS server? (02:48) - The WSUS vulnerability (05:49) - What is deserialization? (08:17) - What to do about this vulnerability (10:52) - How attackers are exploiting it (18:42) - Real-world harm (19:16) - Final advice & defense strategy Key Topics Covered• How one WSUS flaw enables unauthenticated RCE as SYSTEM• The attack chain: crafted payload → deserialization → PowerCat → ShadowPad• Why update servers are high-value pivot points for APT groups• How Chinese APTs weaponized this vulnerability in real-world intrusions• Zero Trust protections: segmentation, egress control, EDR/XDR detection• How to secure Microsoft Windows Server Update Services (WSUS patching best practices)Episodes Mentioned• China Nexus Barracuda Hack: https://www.youtube.com/watch?v=4X9AmBhOmSA• APT Sand Eagle: https://youtu.be/U5qdERmvEwg?si=kdsCJDNkGjs6Lklz• APT 44 / Seashell Blizzard: https://youtu.be/JqA0Irspxrc?si=nnJpz7VnLtz38LN4• APT Handala: https://youtu.be/XYf-SMhQdDc?si=WpIE0h9Q-pokz0MDGuest & Host LinksRob Maas (Field CTO, ON2IT): https://threat-talks.com/the-hosts/Luca Cipriano (CTI & Red Team Lead, ON2IT): https://threat-talks.com/the-hosts/Additional ResourcesThreat Talks: https://threat-talks.com/ON2IT (Zero Trust as a Service): https://on2it.net/AMS-IX: https://www.ams-ix.net/amsSubscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX