Attackers breached Target through a small air conditioning company with an unrestricted VPN into the network. Seth Loe is joined by Bob Jenner of The Network Doctor to discuss why vendor access keeps turning into the way in, what zero trust checks that a VPN never does, and how attackers spent 9 days inside an environment on a stolen password with no MFA before launching ransomware that reached 190 million people.

New episodes of Threat Aware drop weekly. Subscribe so you never miss one.

On September 22nd, someone defaced the FBI’s recruiting site and walked off with data on agents and applicants, all to pressure the Bureau into taking down a blog post. Max, Seth, Cody, and Aidan dig into how one unpatched vulnerability opened the door, why the FBI can’t hand the blame to its contractor, and the human cost under the headline.

New episodes of Threat Aware drop weekly. Subscribe so you never miss one.

The same AI that ran a snack shop into the ground and sold a Tahoe for a dollar is now cloning voices and finding software holes for whoever asks first. Aidan Brown walks from the stuff that makes you laugh to the part that doesn’t: a voice-cloned call that moved millions, and the bug-finding tools helping attackers and defenders race for the same flaws.

An attacker pastes a link into an ordinary web form and walks away with the keys to the company's whole cloud. No password, no malware. Cody Kretsinger breaks down how that kind of attack works, why it's still effective today, and the fix that's been around for years.

The news says AI agents have broken loose and infected the internet. Some of that deserves your attention, and a lot of it will send you chasing ghosts. Seth Loe breaks down how to tell the difference with a quick test he calls SCAM.

New episodes of Threat Aware drop weekly. Subscribe so you never miss one.

AI-enabled cyberattacks are already here, and the window for defenders to respond is short. That's the claim in the OpenAI open letter signed by hundreds of organizations, including direct competitors. Max, Seth, and Cody get into why you should treat this as a capital-I Incident, why technical debt bites first, whether the defender's window is real or a very good sales frame, and what Dario Amodei's subsequent pacing essay changes.

Read the open letter: https://openai.com/collective-cyberdefense/

Unauthorized Opinions is part of the Threat Aware podcast network. New episodes weekly. Subscribe and never miss one.

There's a pile of AI frameworks out there, and they're not built to compete. Some govern how you run AI, others secure the systems you ship. Aidan Brown untangles the two, shows which question each one answers, and why passing an AI audit and stopping an attack are two different jobs.

Beyond Intelligence is part of the Threat Aware podcast network. New episodes weekly. Subscribe and never miss one.

There are two kinds of MFA. One, attackers beat before breakfast. The other, they can't touch. Almost everyone's running the first one and calling it done. Cody Kretsinger pulls from his red team years to show you which is which... and how an attacker got into the account before the phone even buzzed.