Cybersecurity Where You Are (video)

In episode 212 of Cybersecurity Where You Are, Sean Atkinson speaks with Will Knebel, Sr. Penetration Tester at the Center for Internet Security® (CIS®), and Chris Eufemia, Penetration Tester II at CIS. From pushing vulnerabilities as far as possible to tailoring the language of engagement outcomes, they break down how the CIS Red Team (CRT) relies on collaboration to support its clients in strengthening their cybersecurity posture.Here are some highlights from our episode:00:30. The unconventional paths that led Will and Chris to red teaming at CIS03:42. Two surprises from supporting the public sector with red team engagements06:33. How diversity in the U.S. public sector leads entities to approach cybersecurity differently08:30. CRT's commitment to helping clients understand underlying solutions09:25. Ongoing collaboration with teams who support CIS's security best practices11:38. The most common mishap in engagements and how it creates a false sense of security16:16. Pushing vulnerabilities as far as possible, a real example, and capturing this in reports20:23. A lesson from SANS: Using AI to uncover patterns that unlock more testing vectors22:22. CRT's testing within CIS and why an understanding of consequences is vital22:48. Dedication to education: The importance of teachable moments and skills building29:45. Physical penetration testing: Examining whether someone could get into a facility33:20. Tailoring an engagement's outcomes to technical and non-technical audiences alike35:40. The rise of testing AI elements directly through red teaming36:54. How CRT continues to adapt to keep up with attackersResourcesMulti-State Information Sharing and Analysis Center®CIS Red TeamEpisode 201: The Evolution and AI Enablement of PentestingCIS Cyber Threat Intelligence TeamEpisode 210: The CIS SOC — Keeping Security Operations HumanCIS Services®CIS Critical Security Controls®CIS Benchmarks® ListExploited Protocols: Remote Desktop Protocol (RDP)Commonly Exploited Protocols: Server Message Block (SMB)If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 211 of Cybersecurity Where You Are, Sean Atkinson speaks with Joshua Palsgraf, Sr. Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS, about the scariest malware of 2026. From an infostealer that hides its command infrastructure on the Ethereum blockchain to artificial intelligence (AI) agents running chunks of intrusions, they break down what makes malware “terrifying,” why takedowns are getting harder, and what defenders can still do about it.Here are some highlights from our episode:02:08. The three factors that make malware strains "terrifying"03:39. How the expansion of "as a Service" offerings complicates malware investigations05:10. How member reporting helps to link the stages of an investigation06:31. A move to more automation: Threat actors' use of AI to run chunks of the kill chain07:38. Abuse of trusted applications and services over the development of customized tools10:04. The single scariest malware strain of 2026 and the techniques it uses to earn that title14:45. How an emerging technique calls traditional malware takedown playbooks into question16:21. The challenging, never-ending, and even fun effort of keeping up with new malware22:19. The cost of running a cybercrime operation: “A couple hundred dollars a month”23:38. Real-world examples of threat actors giving more operational control to AI agents26:31. Why essential cyber hygiene still holds sway in defending against the scariest malware29:05. Recommendations for defending against clever malware evasion techniques30:33. The Thing and Facehugger: How these malware names capture today's threat landscape32:48. Looking ahead to 2027: AI as an assistant and infrastructure beyond seizureResourcesMulti-State Information Sharing and Analysis Center®CIS Cyber Threat Intelligence TeamEpisode 159: The Scariest Malware of 2025SLTT C2 Traffic Tied to Remus Malware Distribution OperationClickFix: An Adaptive Social Engineering TechniqueEpisode 124: The Many Layers of a Malware Takedown OperationDisrupting the first reported AI-orchestrated cyber espionage campaignInside a Multi-Agent AI Framework Used to Compromise Government Entities in AsiaTaiwan says it was targeted last month in AI-driven hacking campaignCloudflare deploys protections against php2shell vulnerabilityReal-Time Indicator FeedsLiving off the Land: Threats Looming From WithinIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 210 of Cybersecurity Where You Are, Sean Atkinson speaks with Patrick Cooper, Security Operations Center (SOC) Analyst II at the Center for Internet Security® (CIS®), and Nathaniel Ludke, SOC Analyst II at CIS. Together, they take listeners inside the 24x7x365 CIS SOC, from alert prioritization and severity-based escalation to member reporting and the use of artificial intelligence (AI) for open-source intelligence, packet analysis, and SQL querying. They explain why AI is the tool and the human is the loop for U.S. State, Local, Tribal, and Territorial (SLTT) government members of the Multi-State Information Sharing and Analysis Center® (MS-ISAC®).Here are some highlights from our episode:01:20. What a typical shift for a CIS SOC analyst looks like03:29. Challenge: Supporting members while minimizing overwhelm and stress06:25. Common indicators of compromise (IOCs) as impetus to take a deeper look07:01. Prioritization: First in first out with a few noteworthy exceptions07:41. How severity of an alert affects the CIS SOC's communication with members08:51. The typical path of escalation for alerts09:36. Hot IP entries and agency notes inform false-positive judgments10:42. Designating the severity of false positives14:09. Automated (monthly), manual, historical, and other types of reports from the CIS SOC17:01. No news is good news? Why MS-ISAC members both welcome and worry about silence from the CIS SOC18:01. The CIS SOC's use of AI for open-source intelligence and information gathering20:07. Human is the loop: How AI supports packet analysis, SQL querying, and more22:20. AI enablement, not replacement: Keeping security operations human23:42. How AI can function as an additional security threat25:23. Hallucination risk and the SOC analyst “spidey sense”26:25. Relationships with MS-ISAC members: The "lost art" of knowing when something's offResourcesThe CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber MaturityCIS Cyber Incident Response TeamCIS Cyber Threat Intelligence TeamCybersecurity ServicesYou Have a Cybersecurity Incident. Now What?Episode 190: Separating Mythos AI Fact from FictionCIS Controls v8.1 Incident Response Policy TemplateIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 209 of Cybersecurity Where You Are, Sean Atkinson argues that most organizations prepare for operational failure like they're bracing for a hurricane while most adversaries are playing chess. Drawing on security chaos engineering and game theory, he walks through a structured approach that blends threat modeling, internal red teaming, and constructive disagreement to empirically test and strengthen a defensive posture.Here are some highlights from our episode:00:33. The RSA Conference 2025 presentation behind this episode00:48. How artificial intelligence (AI) is only accelerating adversaries' evolution01:23. Hurricanes and chess: Analogies for different types of disaster preparedness04:03. Overview of chaos engineering and game theory05:01. Understanding threat vectors in our environment and how MITRE ATT&CK can help05:50. Why adversaries "need a vote" when planning for failure07:03. Red teaming and the need for penetration testing as part of an internal process07:50. Going beyond technology to understand business objectives and strategy08:51. Continuity as a consideration for continually adapting and updating controls10:12. Transition from three separate threat silos to multidimensional threats10:45. Game theory: It's not just a tabletop exercise (TTX)12:15. Goalkeeper: An analogy for addressing "predictability of weakness"13:52. Testing where our weaknesses are: An important element of chaos engineering14:58. Accounting for biases and finite resources when evaluating strengths and weaknesses17:56. Vulnerability identification: An example of how a strength can become a weakness22:25. The need to resist getting too sophisticated with internal red teaming too quickly24:23. Rigor for pushing back against tired adages like "it's never happened to us before"26:22. An implementation strategy focused on communication27:00. Dr. Tyler Moore's Return on Security Investment and the consequences of doing nothing28:03. Debate and commit: A leadership principle for getting the most out of disagreement30:42. Start small, provide notice to those affected, and consider a "surprise audit"32:12. Minimize the blast radius, build hypotheses, balance bias, and other best practices37:38. Parting thoughts of how to break down this approachResourcesEpisode 208: Secure Harness Engineering for Agentic AIGame Theory Informed Security ChaosBook - Security Chaos Engineering: Sustaining Resilience in Software and SystemsCIS Community Defense Model v3.0: Turning Threat Intelligence Into ActionCIS Red Team Services and Exploit DemoPenetration TestingCIS Critical Security Control 18: Penetration TestingMS-ISAC Guide to DDoS AttacksEpisode 121: The Economics of Cybersecurity Decision-MakingEpisode 166: Foundations of Actuarial Science in Cyber RiskCIS Leadership PrinciplesNetflix TechBlogIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 208 of Cybersecurity Where You Are, Sean Atkinson breaks down secure harness engineering for agentic artificial intelligence (AI). Noting the risks posed by AI agents acting without oversight, he highlights "episodes" as auditable elements that help to provide feedback, and he walks through 15 controls spread across five stages as a way to engineer an AI harness with security in mind. He also differentiates secure harness engineering from prompt engineering, guardrails, frameworks, logs, and universal wrappers for AI agents.Here are some highlights from our episode:01:23. The need for a control system in light of agent escape incidents02:19. Analogy of a financial analyst to understand why separation of duties is important02:57. Revolution and then evolution: How AI models have changed exponentially since 202204:54. Where secure harness engineering has a capability05:42. Making decisions traceable: The need for an evidence chain to build controls effectively07:15. Smartphones: A parallel for understanding the value of each new AI model11:20. Engineering controls, not standard policies for all models12:22. Secure harness engineering vs. prompt engineering12:51. Models' evolving role: How it invites new security questions to be posed15:16. AI agents without oversight: The insider persona with which defenders need to contend16:02. The need for determinism and an effective diagram to build for it18:22. Definition of secure harness engineering19:36. Episodes and the importance of log assessment in mediating model capability20:42. Reality verification: A feedback loop that gets into the concept of forensic assessment21:27. Questions to ask as you get into an AI agent's evidence chain22:56. Moving through intent, authority, reasoning, synthesis, decision, and enforcement25:38. Side effects: What they are and how they actualize risk27:16. Verification and audit: How they empower you to look at control opportunities28:49. Five stages and 15 controls for secure harness engineering29:47. What secure harness engineering is and is not32:11. Three questions to help you get started32:52. An important question for the futureResourcesArtificial Intelligence (AI) Agents Companion GuideThe Secure Harness: A Governance Architecture for Agentic AIWhen Agent Capability Outruns Control: Lessons from the July 2026 OpenAI and Hugging Face IncidentEpisode 202: Delineating AI Security and CybersecurityHarness Engineering & Agent OrchestrationOWASP Top 10 for Large Language Model ApplicationsIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].