Why The Art of Security?

In cybersecurity, attackers supposedly need to get lucky only once, while defenders must be right every time. But does that familiar idea give attackers too much credit? In this episode of The Art of Security podcast, co-hosts Tyler Reguly and Josh Davies rethink the cat-and-mouse dynamic between attackers and defenders, exploring how layered security, deception, active defense, preparation, and threat intelligence can change the game. They also consider how the metaphor shifts between enterprise security and personal security, where the risks, resources, and ability to respond can look very different. It is a thoughtful, wide-ranging conversation about moving beyond reactive security, making attackers work harder, and deciding who really holds the cheese.

Most attacks do not succeed because the attacker developed a brilliant new technique. They succeed because exposed information, weak processes, insecure credentials, and avoidable shortcuts give attackers an easier path. For Cybersecurity Awareness Month, Josh Davies and Tyler Reguly examine how individuals, employees, security teams, leaders, and small businesses can introduce more friction into an attack. The goal is not to become invincible. It is to make every step more expensive, time-consuming, and risky for the attacker. In this episode of The Art of Security podcast, you'll learn: How reducing public information exposure can limit phishing, impersonation, and social engineering opportunities Why call screening, independent verification, and stronger MFA can interrupt common attack workflows How deception engineering, canary files, application allowlisting, and restricted PowerShell access create attacker friction Why security culture must empower employees to question unusual requests, regardless of the apparent sender's rank How small businesses can close significant security gaps without building a full internal security team Listen now to learn how small, practical security decisions can make you a much less attractive target. And make sure to subscribe so you don't miss out on any cyber insights!

What happens when cybersecurity programs prioritize visible activity over meaningful risk reduction? Security theater can reassure executives and end users, but that reassurance becomes dangerous when dashboards, checkbox compliance, and inflated metrics distract teams from the controls that actually reduce exposure. In this episode of The Art of Security, Josh Davies and Tyler Reguly examine the line between communicating security effectively and merely performing it. They challenge conventional thinking about security metrics, product marketing, threat hype, compliance, and the pressure to make security programs look productive. Key takeaways Why activity metrics such as alerts triaged, vulnerabilities patched, and detections created may not reflect improved security How threat hype and named vulnerabilities can redirect limited resources away from higher-priority risk Why security visibility and clearly assigned asset ownership provide a stronger foundation for meaningful measurement How security teams can demonstrate control effectiveness without relying on checkbox compliance or misleading ROI calculations Security should create confidence because controls are validated, assets are monitored, and responsibilities are clear, not because a dashboard looks impressive. 👍 Like the video if the discussion challenged how you measure security 💬 Tell us which cybersecurity metrics your team finds genuinely useful 🔔 Subscribe for practical conversations with cybersecurity practitioners and researchers

Calendar invites have become part of the trusted infrastructure of daily life, and attackers are taking advantage. In this episode, the team examines the resurgence of CalPhishing, an attack technique that uses legitimate calendar workflows, HTML content, attachments, spoofed organizers, and trusted platforms to evade defenses and compromise accounts. Fortra security engineer and FIRE team member Daud Jawad joins hosts Josh Davies and Tyler Reguly to break down the calendar phishing techniques reaching users today. They explore why these attacks can bypass traditional email security controls, how trusted workflows lower users' defenses, and why organizations may need to reconsider how they process and test calendar invitations. Key takeaways How attackers use calendar invite bodies, HTML attachments, spoofed organizers, and legitimate vendor infrastructure to deliver phishing lures Why CalPhishing can evade email authentication, filtering, browser protections, and other established security controls How calendar-based attacks can target credentials, session tokens, OAuth consent, device codes, and trusted internal workflows How organizations can reduce exposure through calendar processing controls, user education, cross-channel verification, and calendar-based phishing simulations Read Daud's related blog on Fortra.com Don't let the next threat sneak onto your calendar. Subscribe to The Art of Security podcast.

AI can accelerate red team operations, but how much autonomy is too much when production systems and sensitive data are at stake? In Episode 13 of The Art of Security, co-host Josh Davies speaks with Pieter Ceelen of Fortra's Outflank and Cobalt Strike red teams about the opportunities and risks surrounding AI-powered red teaming. They examine where AI can strengthen adversary simulation, why fully autonomous testing demands caution, and how rules of engagement must evolve as AI becomes part of offensive security operations. The conversation explores: Where AI can support reconnaissance, vulnerability research, initial access, reporting, and post-exploitation analysis Why human oversight remains critical in sensitive and production environments How red teams can balance automation, operational risk, and potential reward Whether AI will change the skills needed by the next generation of penetration testers How AI could reshape vulnerability discovery, zero-day research, and the ongoing contest between attackers and defenders Listen to the full episode for a practical perspective on using AI to advance red team operations without losing sight of judgment, accountability, or risk.