Threat Talks - Your Gateway to Cybersecurity Insights

Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!

Threat Talks - Your Gateway to Cybersecurity Insights is a news podcast hosted by Threat Talks, with 142 episodes on record and a Required Pod Score of 82.

Threat Talks hosts Threat Talks - Your Gateway to Cybersecurity Insights, a news show with 142 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Threat Talks - Your Gateway to Cybersecurity Insights

  MDR Has To Stop Mopping The Floor

  Sep 29, 202617 min

  A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR. The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached. So what did the M in MDR actually buy him? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay Area security scene, to separate what MDR vendors pitch from what MDR delivers. Buyers think MDR is one product. It is five jobs: collect the logs, enrich them, put an experienced human in the loop, remediate, and keep it all retrievable. Most vendors do two of them well, and only inside their own stack. Three questions tell you which two. All three are in the episode, and in the description below. Timestamps (00:00) - The MDR reality check: expectation versus practice (01:33) - What buyers think they are buying (03:35) - Single pane of glass, and why nobody has one (06:40) - Why no vendor is paid to support a competitor's logs (07:42) - Log retention: when everything becomes hot storage (11:06) - Three questions to ask every MDR provider (13:20) - Data sovereignty: who operationally controls your logs (15:02) - The future of MDR, and why detection alone is cleanup (15:36) - The CISO who saw everything and still got breached The three questions In practice, what does your platform do with a log it did not create? Ask for the demo on a competitor's telemetry, not your own. Is there tiered storage, or does every log stay hot for the life of the contract? When I escalate, who picks up: someone who knows my environment, or someone reading an LLM's answer back to me? Key topics covered What "managed" means to different MDR vendors, and why a human in the loop is rarely part of the deal Why EDR, NDR, XDR and DDR all get reskinned as MDR, and what that does to scope The economics of vendor data lakes: every log priced as hot storage, with no tiering to warm or cold Commercial incentives that keep cross-vendor log support shallow, and how to test for it before you buy Data sovereignty and jurisdiction as a procurement requirement, not a European footnote Related ON2IT Content & Referenced Resources: Threat Talks: https://threat-talks.com/ ON2IT Zero Trust as a Service: https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams Subscribe block Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. Follow and Support our channel! ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE ... ► APPLE: https://podcasts.apple.com/us/podcast ... Receive your Threat Talks T-shirt https://threat-talks.com/ ️ Explore the Hack's Route in Detail ️ https://threat-talks.com ️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

  ListenShow Notes
• 

  Threat Talks - Your Gateway to Cybersecurity Insights

  Lapsus$:Teenagers Hacked Microsoft.

  Sep 22, 202619 min

  A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end. The uncomfortable part is not how clever the attack was. It is how basic it was. If your help desk resets passwords without proof of identity, if your MFA is a tap-to-approve prompt, if your users carry permissions from two jobs ago, Lapsus$ did not need to be good. They only needed to try. Yuri and Rob also cover what actually stops this: password resets that require physical identification, hardware tokens for sensitive Protect Surfaces, privileged access management with a human in the loop, and why AI is both the fastest way to audit your permissions and the fastest way to recreate the same over-permissioning problem all over again. Timestamps 00:00:00 Hacking the largest companies on earth is super easy 00:01:19 Who Lapsus$ were, and why they are in jail 00:02:25 Step one: bought credentials and a phone call to the service desk 00:03:36 Password resets should be a hurdle, not a link 00:06:16 Not all MFA is equal: push fatigue, SMS and SIM swapping 00:09:03 Why your second factor does not belong in your password manager 00:11:09 Inside the network: privilege escalation, exfiltration, extortion 00:13:29 The fix: least privilege, PAM and a human in the loop 00:16:05 AI as auditor, and the agentic over-permissioning problem Key Topics Covered How Lapsus$ obtained initial access without a single novel technique: dark web credentials and social engineering of the help desk Why MFA type matters more than MFA presence, and where push approval, SMS and TOTP each break Privilege escalation as the real bottleneck for attackers, and what least privilege plus PAM changes Zero Trust Protect Surface thinking as the way to decide which control is appropriate for which data The AI double edge: faster permission audits on one side, over-permissioned agent service accounts on the other

  ListenShow Notes
• 

  Threat Talks - Your Gateway to Cybersecurity Insights

  How a 19-Year-Old Hacked the NEWS Without Breaking In

  Sep 15, 202621 min

  Your Outlook account recovery will accept an authenticator code on its own. No password, no inbox, no phone number. Anyone holding that TOTP secret owns the account, and the second factor you bought to survive credential theft becomes the only thing in the way. Koen Kandelaars found one sitting in a PDF on a public help page at the NOS, the largest news organization in the Netherlands. He scanned a QR code out of an onboarding manual and had a real employee's second factor on his phone. Rob Maas, Field CTO at ON2IT, walks the full chain with the attacker himself: eleven vulnerabilities in the first responsible disclosure, a twelfth Koen estimates at 1 to 5 million euros, and the recovery flow nobody tested. Timestamps (00:00) - MFA was on. He got in anyway. (02:04) - Why the biggest news organization became the target (03:24) - Mapping the attack surface before touching anything (04:54) - Eleven findings in the first responsible disclosure (08:50) - The Media Cloud help page and the live TOTP QR code (11:19) - How the password reset removes your second factor (14:29) - The 1 to 5 million euro estimate, and what to fix Key Topics Covered Attack surface discovery against a large public broadcaster Responsible disclosure done well: response time, remediation, and recognition Where the next generation of defenders comes from, and how they choose a side Related ON2IT Content & Referenced Resources: Threat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams

  ListenShow Notes
• 

  Threat Talks - Your Gateway to Cybersecurity Insights

  The End of Reactive Security

  Sep 8, 202613 min

  You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR. Timestamps: 00:00:00 Preemptive cybersecurity: what it means for MDR 00:00:59 Why detect-and-clean-up is not enough (the leaking tap) 00:01:42 You knew the threat: block first 00:03:34 Fusing the SOC and operations teams 00:05:57 Speed, seconds, and AI versus AI 00:08:15 Data freedom and vendor lock-in 00:10:33 Dynamic policy without breaking change control Key Topics Covered: Preemptive cybersecurity as the Gartner-flagged direction, and why MDR has to move past detect-and-respond Turning known indicators of compromise into automated blocks at the endpoint, network, and cloud Collapsing the SOC and operational teams so detection and enforcement act as one Sub-second response, AI-driven attacks, and why MTTD and MTTR need to converge Data freedom and data sovereignty, and avoiding vendor cloud lock-in Related ON2IT Content & Referenced Resources: Threat Talks website: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams

  ListenShow Notes
• 

  Threat Talks - Your Gateway to Cybersecurity Insights

  NIST CSF 2.0: No CISO, No Excuse

  Sep 1, 202623 min

  The new NIST Cybersecurity Framework 2.0 is out, and most teams still ask the same question: what do I do tomorrow? Lieuwe Jan Koning sits down with NIST's Amy Mahn and Daniel Elliott to turn the framework into a concrete next step. Governance is now its own function. Profiles tell you where you are and where you need to be. And the Quick Start Guides give a 15-page answer to a problem most people think needs 300 pages. If you run security with limited resources, this episode shows you where to start and why the whole thing is free. Timestamps 00:00:00 The framework changed. What do you do tomorrow? 00:02:00 Why Govern became its own function 00:05:49 Profiles: current state, target state, gap analysis 00:08:08 Community profiles: sharing across a sector 00:10:29 Quick Start Guides and mappings to ISO 27001, SOC 2, HIPAA 00:14:24 No CISO? Where small businesses start 00:17:50 The future of CSF and how to contribute Key Topics Covered Why governance moved out of "Identify" and became its own function in CSF 2.0, and what that signals about cyber risk at board level. How organizational and community profiles turn the framework into a current-state, target-state, and gap analysis you can act on. Why CSF 2.0 stopped being a single PDF and became guides, spreadsheets, mappings, and search tools. How CSF maps to ISO 27001, SOC 2, and HIPAA so you report once instead of many times. Where a small business or an IT manager wearing every hat should actually begin. Related ON2IT Content & Referenced Resources: NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework NIST CSF Quick Start Guides: https://www.nist.gov/cyberframework/quick-start-guides National Cybersecurity Center of Excellence (NCCoE): https://www.nccoe.nist.gov/ NIST CSF contact: csf@nist.gov Threat Talks website: https://threat-talks.com/

  ListenShow Notes

Recent guests on Threat Talks - Your Gateway to Cybersecurity Insights. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.