Ridge Security in the Real World: An Offensive Security Practitioner's Perspective
Phillip Wylie ShowShow Notes
## How AI-Powered Penetration Testing Is Transforming Security Validation with Andy Simpson**Sponsored by Ridge Security**In this sponsored episode of The Phillip Wylie Show, Phillip Wylie welcomes Andy Simpson, founder of Cipher Security, for an in-depth discussion about the future of penetration testing, continuous security validation, API security, and the growing role of AI in offensive security.What makes this conversation unique is that Andy is not a Ridge Security employee. As a cybersecurity consultant and penetration testing practitioner, he evaluated multiple automated security testing platforms before selecting Ridge Security to help scale and enhance his team's testing capabilities.Drawing on decades of experience in IT, infrastructure, executive leadership, and offensive security, Andy shares his journey from working at IBM to building a successful offensive security consultancy serving organizations throughout Australia and New Zealand.The conversation explores the challenges facing modern security teams, including expanding attack surfaces, API security risks, infostealer-driven attacks, limited security resources, and the need to continuously validate security controls. Andy also demonstrates how automation and AI-driven testing are changing the way organizations identify and validate risk.## Topics Covered* Andy Simpson's cybersecurity origin story* From IBM engineer to offensive security consultant* The evolution of penetration testing* Common shortcomings in traditional API assessments* Continuous Threat Exposure Management (CTEM)* Vulnerability validation versus vulnerability identification* Automated penetration testing at scale* Attack surface management## Key Takeaways* Annual penetration testing is often insufficient for today's threat landscape.* Organizations need continuous validation of their attack surface and security controls.* API security remains one of the most overlooked areas of cybersecurity.* Security teams must focus on validating risk rather than simply identifying vulnerabilities.* Automation helps security teams scale without sacrificing visibility.* Generative AI is enabling deeper testing of business logic and application workflows.* Human expertise remains critical, but AI-powered testing is becoming an important force multiplier.* Attackers are increasingly leveraging stolen credentials and authenticated access paths, making continuous testing more important than ever.Connect with Andy Simpson:Andy's LinkedIn: https://www.linkedin.com/in/andy-simpson-nz/Cipher Security website: https://ciphersecurity.co.nz/## Episode SponsorThis episode is sponsored by Ridge Security.Connect with Ridge Security:Ridge Security website: https://ridgesecurity.aiGet a free RidgeBot Demo: https://ridgesecurity.ai/demo-request/ Ridge Security LinkedIn: https://www.linkedin.com/company/ridge-security/posts/?feedView=allRidge Security provides automated penetration testing and security validation solutions that help organizations continuously identify, validate, and prioritize security risks across networks, web applications, APIs, and cloud environments. During this episode, Andy shares his firsthand experience using Ridge Security's platform as part of his offensive security practice. ## Connect with Andy SimpsonConnect with Andy on LinkedIn to learn more about offensive security, API testing, threat exposure management, and the future of AI-powered security testing.## Listen, Subscribe, and ShareEnjoyed the episode? Subscribe to The Phillip Wylie Show, leave a review, and share this episode with your network to help others learn about the future of penetration testing and security validation.#ThePhillipWylieShow #Cybersecurity #PenTesting #OffensiveSecurity #APISecurity #AI #ArtificialIntelligence #CTEM #ThreatExposureManagement #RidgeSecurity #SecurityTesting #EthicalHacking #CyberDefense #InfoSec #CyberRisk
More from Phillip Wylie Show
What happens when someone who knows exactly how applications are built decides to start breaking them? Jarrod Rizor went from writing code and running DevOps to hacking web and mobile apps for a living, and he recently joined TrustedSec as a penetration tester. His path is a real-world playbook for anyone trying to break into offensive security.
Tim MalcomVetter has spent 26 years moving between offense and defense, and his biggest takeaway is that the future of security comes down to speed - whoever has the fastest software wins. Tim got his start by offering to work for free at a hospital in the early days of HIPAA, which turned into his first security job. From there he moved into pen testing, including work on the point-of-sale system behind roughly one in three U.S. credit card transactions, and then into red teaming at Walmart, where engagements could run as long as eight months. Today he is the co-founder of Wirespeed and General Manager of Coalition Security. Recorded in person at Cybr.Sec.Con in Houston, this conversation with Phillip gets into what separates real red teaming from pen testing, what cyber insurance data reveals about which security controls actually work, and why so many in the industry misjudge risk. Tim also shares how his red team experience shaped his approach to automation, and why he sees the next era of attack and defense being decided in milliseconds. ========================= Connect with Tim MalcomVetter: LinkedIn: https://www.linkedin.com/in/malcomvetter WireSpeed: https://wirespeed.co ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie
License plate readers, police drones and fake cell towers are spreading fast, and two hackers are proving that anyone can detect them with about ten dollars of hardware and some open source firmware. Colonel Panic is a malware researcher and hardware builder whose hacking started with AOL dial-up and stacks of 2600 Magazine. After years in restaurants and grocery retail, he went back to school during COVID, earned his certs and turned his love of rapid prototyping into privacy tools like OUI Spy. Cooper got his start on a hand-me-down 286 in fifth grade, spent his early years teaching privacy and security to activists, and has been a public interest technologist at the Electronic Frontier Foundation for almost thirteen years, where he works on Rayhunter. Building on their DEF CON talk, "ESP32 as a Counter-Surveillance Platform," this episode covers: - How OUI Spy uses an ESP32-S3 and a buzzer to alert you when specific Bluetooth or Wi-Fi devices or drones are nearby, and what changed when Flock updated its firmware - Mesh Detect, which sends alerts over Meshtastic networks to build a sensor net for tracking drones - Rayhunter, EFF's open source firmware that turns a cheap Orbic mobile hotspot into a cell-site simulator detector - Why "I have nothing to hide" falls apart, including a Flock misread that put an innocent woman in jail for weeks - The national security risk of ALPR data piling up with vendors who have a track record of vulnerabilities - The current surveillance boom and EFF's work on litigation, activism, Privacy Badger and Certbot - Why war driving is legal, and how to get involved by building tools or showing up at city council meetings DEF CON 34 - ESP32 as counter-surveillance platform: https://www.youtube.com/watch?v=PcK-TDmzshcEFF ========================= Connect with Colonel Panic: Website: https://colonelpanic.tech https://x.com/_colonel_panic https://colonelpanic.tech/ Connect with Cooper: https://bsky.app/profile/cooperq.com EFF: https://www.eff.org ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie
Luke Canfield came up the way a lot of hardware hackers do, the geeky kid in high school everyone came to when the school's computers broke, tinkering with Windows XP and war driving with homemade Yagi antennas built out of Pringles cans. That fascination with the hardware side never left him, and today he runs Reconnaissance Drone Consulting, teaching people about a threat surface most of the security world still isn't looking at.
Zack Korman came into cybersecurity from about as far outside the field as you can get, a UK law degree and a master's in law and finance, and he now spends his days on the AI defense problems most of the industry is still catching up to. His outsider path is exactly what makes his take on the current AI moment worth hearing. Based in Norway, Zack got into code to win an argument with a professor, worked his way up to running a media company's tech department, then spent four and a half years as CTO of an Oslo cybersecurity startup building AI phishing simulations and AI insider threat detection. That work pulled him deep into the defensive side of security and into a conviction that detection is one of the most underserved areas of the field. Phillip and Zack get into why the "thousand crap alerts" model of detection is broken, the blind spots that let obvious insider threats slip past a SOC that was never even receiving the data, and Zack's work on AI agent security, including the malicious MCP server he built to prove how completely an agent can exfiltrate a company. From there the conversation turns to the thing Zack has become known for online, pushing back on inflated AI risk claims, the fallout from the Hugging Face incident, and why so many of the loudest warnings about AI in cybersecurity are coming from people who have never worked in security. They also cover frontier versus local models, why smaller models could reshape defensive work, model guardrails and offensive testing, and Zack's straightforward advice for anyone trying to fold AI into their day to day. ========================= Connect with Zack Korman: LinkedIn: https://www.linkedin.com/in/zacharyakorman/ X: https://x.com/ZackKorman ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with Suzu Labs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/