Scinary Information Nexus

Scinary Cybersecurity is here to "Serve and defend those who serve and defend others". To help us "serve and defend" we pull from many different sources - experts, colleagues, industry standards, etc... We hit every subject from all angles making it easy to understand while also letting us go in depth. Making this podcast perfect for cybersecurity beginners and experts alike. Come join us on our journey to constantly educate ourselves and explore the amazing things that are happening in our industry.

Scinary Information Nexus is a technology podcast hosted by Scinary Cybersecurity, with 60 episodes on record and a Required Pod Score of 80.

Scinary Cybersecurity hosts Scinary Information Nexus, a technology show with 60 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Scinary Information Nexus

  Episode 60: Cloud Persistence: Rogue MFA, OAuth and Passkeys

  Oct 2, 202640 minS3

  Welcome back to the Scinary Information Nexus! This week, the crew had to toss their planned agenda out the window. Richard, Joseph, Mario, and Brazos jump in for an emergency breakdown of an aggressive phishing wave battering K-12 school districts and higher ed institutions. Attackers are weaponizing legitimate Google Docs and using Adversary-in-the-Middle (AiTM) proxies to harvest credentials and bypass traditional MFA. Because the phishing notifications originate straight from Google's own servers, they breeze past standard SPF, DKIM, and DMARC checks. Once inside, threat actors hijack internal distribution lists to spread laterally, creating a virtual denial of service for IT teams through sheer operational attrition. Even worse, standard password resets aren't cutting it. Attackers are locking in persistent cloud access with rogue OAuth application grants, hidden MFA enrollments, and rogue device keys. We break down how this campaign works, examine the CAPTCHA fatigue driving users straight toward ClickFix social engineering lures, and share concrete hardening tactics you can implement inside Google Admin right now to lock down your domain. In this episode: Anatomy of the breach: How weaponized Google Docs bypass email authentication filters. AiTM in action: Why traditional MFA fails against adversary-in-the-middle session theft. Cloud persistence traps: How rogue OAuth permissions and device keys survive password resets. Denial of service by attrition: The hidden toll of high-velocity account takeovers on IT teams. CAPTCHA fatigue: How flagged outbound IPs prime users for ClickFix social engineering. Hardening Google Admin: Disabling student directory lookups and ditching formulaic passwords. The Google Workspace dilemma: Free EDU tiers and gated security features. Has your organization noticed a spike in AiTM phishing or Google Docs lures lately? Let us know in the comments how your team is responding! Connect with Us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 01:45 Google Docs Phishing & AiTM MFA Bypass 07:00 Cloud Persistence: Rogue OAuth & Device Keys 11:45 IT Attrition & CAPTCHA Fatigue Risks 21:15 Hardening Google Admin & Zero Trust 33:45 Google Ecosystem & Prompt Injections Cybersecurity #InfoSec #Phishing

  ListenShow Notes
• 

  Scinary Information Nexus

  Episode 59: Texas Drops TAC 219: What New AI Rules Mean for You

  Sep 25, 202650 minS3

  Welcome back to the Scinary Information Nexus! Texas is teasing us with a little "false fall" weather, and the crew is back in the studio to talk through brand-new state AI mandates, sneaky phishing tricks, and some classic hacker trivia. This week, Richard, Joseph, Mario, and Brazos break down the newly released Texas Administrative Code TAC 219. If you work in Texas local government, a state agency, or a K-12 public school district, big changes are heading your way. From naming an official AI Risk Officer and adopting the state AI code of ethics published by DIR to inventorying AI systems and handling "heightened scrutiny" assessments, we walk through what IT teams actually need to do right now. We also look at a new ransomware-as-a-service strain hitting edge devices, plus compromised Google accounts sharing docs that trigger real Google CAPTCHAs to fool users. To wrap things up on a fun note, the guys face off in a retro cyber trivia showdown featuring phreakers, Cap'n Crunch whistles, the Morris Worm, and Janet Jackson crashing hard drives. In this episode: TAC 219 explained: What Texas's new AI governance rules mean for local government and public schools Designating an internal AI Risk Officer and adopting DIR's AI code of ethics What counts as a "heightened scrutiny" AI system and how impact assessments work The compliance headaches of commercial software with built-in AI features A new Rust and C++ ransomware-as-a-service strain targeting edge devices and SSL VPNs Compromised Google accounts abusing shared docs and CAPTCHAs for phishing Cyber history trivia: Blue boxes, Cap'n Crunch, the Morris Worm, and who really coined "EDR" Is your organization prepared to inventory every AI tool you use, or does TAC 219 feel overwhelming? Let us know in the comments! Connect with us: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 04:50 Cyber News & Google Docs Phishing 11:15 TAC 219: Texas AI Governance Breakdown 37:45 Retro Hacking & Cybersecurity Trivia 48:30 Road to 500 Subscribers & Wrap-Up Cybersecurity #InfoSec #Phishing #Ransomware #TechNews #Compliance

  ListenShow Notes
• 

  Scinary Information Nexus

  Episode 58: Is Your MSP Actually Securing Your Network?

  Sep 18, 202646 minS3

  Welcome back to the Scinary Information Nexus! This week, Richard, Joseph, Mario, and Hunter tackle the messy reality of third-party risk and what they call "The MSP Dilemma." First up, the guys look at an incident involving an AI translation device called Timekettle, which was caught routing local Texas government traffic back to Shenzhen, China. The vendor tried to blame "legacy IP attribution," but it's a great example of why you can't just blindly trust your tech vendors. From there, they discuss Managed Service Providers (MSPs) and a major friction point in IT: organizations need MSPs for daily operations, but most providers are built for availability, not security. Later in the episode, the team covers a massive wave of Google EDU student account compromises. Hackers are bypassing traditional MFA and email filters using tactics like AiTM (Adversary in the Middle), ClickFix, and ConsentFix. By automating these attacks and manipulating email headers, threat actors are turning basic student accounts into high-volume threats. Topics covered: The Timekettle incident: When translation devices phone home to China Why 80% of security breaches involve compromised identities The MSP Dilemma: Balancing IT availability with cybersecurity A sneak peek at Scinary's upcoming GRC tool How hackers bypass MFA on Google EDU accounts The rise of AiTM, ClickFix, and ConsentFix tactics Why NIST 800-53 emphasizes strict third-party agreements Is your IT provider actually securing your network, or just keeping the lights on? Drop your thoughts in the comments! Connect with Scinary Cybersecurity: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 01:30 The Timekettle Debacle 09:45 The MSP Dilemma 24:45 Free GRC MSP Assessments 30:45 Google EDU Compromises 45:15 Wrap-Up & Weekend Banter Cybersecurity #InfoSec #MSP #DataPrivacy #Hacking #Phishing #NetworkSecurity

  ListenShow Notes
• 

  Scinary Information Nexus

  Episode 57: Cybersecurity Myths Debunked: AI, VPNs & Cloud

  Sep 11, 202656 minS3

  Welcome back to the Scinary Information Nexus! Richard Martin is back from his month-long break, joining Joseph Hamilton, Mario Ortiz, and Brazos Wortham for a new episode. This week, we're talking about cybersecurity myths that trick organizations into wasting money and weakening their defenses. We look at the marketing hype around AI threats and the illusion of default cloud security. We also talk about why consumer VPNs aren't the privacy shields they claim to be. Plus, we explain why treating a compliance checklist like an actual security strategy is a terrible idea. To wrap things up, we chat about why tools like EDR and MFA aren't silver bullets. As always, basic security hygiene and blocking and tackling are still your best defenses. In this episode: A recent CrowdStrike vulnerability involving malicious macros Why AI is just automating old attacks, not creating new ones The truth about consumer VPNs and online anonymity Why passing a compliance audit doesn't mean you are secure The myth that small businesses are too small to be targeted Blind spots in the cloud "shared responsibility" model How the team phished eighth graders with a fake drink promo Why relying on EDR and MFA as silver bullets is a mistake Which of these security myths surprised you the most? Let us know in the comments! Connect with Scinary Cybersecurity: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 05:05 The AI Cyber Attack Myth 12:40 Do Consumer VPNs Keep You Safe? 16:50 Why Compliance Doesn't Equal Security 24:10 Why Small Businesses Are Ransomware Targets 32:00 The Shared Responsibility of Cloud Security 40:40 Phishing Overconfident 8th Graders 47:00 EDR, MFA & Supply Chain Risks Cybersecurity #InfoSec #Phishing #Ransomware #SocialEngineering

  ListenShow Notes
• 

  Scinary Information Nexus

  Episode 56: Untitled Episode

  Sep 4, 20261h 10mS3

  Welcome back to the Scinary Information Nexus! This week, Brazos and Joseph hold down the fort for a two-man episode. We review the new executive order pushing for "free" cybersecurity for critical infrastructure and question how it will actually be funded. We also debate the controversial authorization of private companies launching offensive cyber "hack-backs." Allowing private entities to retaliate against attackers could cause massive collateral damage on shared infrastructure like AWS and Cloudflare. For the main topic, we answer a viewer question: What do you do if you inherit an organization with no cybersecurity? Brazos explains the governance side with a 5-step foundational plan starting with risk analysis. Joseph offers the technical approach, advocating for immediate network segmentation to stop the bleeding. From locking down firewalls to dodging the "bystander effect," we outline how to build a security program that continuously improves. What we cover: The new executive order providing "free" cybersecurity to critical infrastructure The unintended consequences of legalizing corporate "hack-backs" Why risk analysis and strict asset inventory must happen first Governance vs. Action: When to educate leadership vs. when to lock down the firewall Why delegated authority is crucial for enforcing technical controls Deploying critical controls like MFA and backing them up with written policies Avoiding "deferred maintenance" and keeping your security program alive What is the very first thing you would do if you inherited an unsecured network? Let us know in the comments! Connect with Scinary Cybersecurity: https://www.scinary.com https://x.com/scinarycyber https://www.linkedin.com/company/scinarycyber/ 00:00 Intro 06:45 Free Cyber for Critical Infrastructure 10:15 The Dangers of Offensive Hack-Backs 15:30 Step 1: Risk Analysis & Asset Inventory 25:00 Step 2: Leadership vs Immediate Action 31:30 Step 3: Delegated Authority & IT Roles 51:30 Steps 4 & 5: Controls & Written Policies 59:30 The Final Step: Continuous Improvement Cybersecurity #InfoSec #HackBack #CriticalInfrastructure #NetworkSecurity #RiskManagement #MFA #CISA #AccessControl

  ListenShow Notes

Recent guests on Scinary Information Nexus. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.