Who Really Holds the Cheese? Do Attackers Only Need to Get Lucky Once?

The disgruntled insider makes a great story, but the quieter risk is the employee in transition. The new hire eager to impress, the manager carrying years of old permissions, and the departing colleague with forgotten API keys all open gaps that attackers know how to pivot through. The Art of Security hosts Tyler Reguly and Josh Davies explain how to close those gaps without destroying trust. "OAR stands for ownership, access, responsibilities. Those are the three things that you need to know before any employee leaves." ~ Tyler Reguly Inside this episode: Least privilege with intent: Limit access where it stops pivoting, and empower people everywhere else Three questions to answer before anyone leaves: What they own, what they can access, and what they're responsible for AI agents as employees: Onboard, scope, and offboard them Career announcements as an attack surface: Why naming colleagues invites impersonation Drop your thoughts on this exploit in the comments. And make sure to subscribe for threat intelligence insights.

Most attacks do not succeed because the attacker developed a brilliant new technique. They succeed because exposed information, weak processes, insecure credentials, and avoidable shortcuts give attackers an easier path. For Cybersecurity Awareness Month, Josh Davies and Tyler Reguly examine how individuals, employees, security teams, leaders, and small businesses can introduce more friction into an attack. The goal is not to become invincible. It is to make every step more expensive, time-consuming, and risky for the attacker. In this episode of The Art of Security podcast, you'll learn: How reducing public information exposure can limit phishing, impersonation, and social engineering opportunities Why call screening, independent verification, and stronger MFA can interrupt common attack workflows How deception engineering, canary files, application allowlisting, and restricted PowerShell access create attacker friction Why security culture must empower employees to question unusual requests, regardless of the apparent sender's rank How small businesses can close significant security gaps without building a full internal security team Listen now to learn how small, practical security decisions can make you a much less attractive target. And make sure to subscribe so you don't miss out on any cyber insights!

What happens when cybersecurity programs prioritize visible activity over meaningful risk reduction? Security theater can reassure executives and end users, but that reassurance becomes dangerous when dashboards, checkbox compliance, and inflated metrics distract teams from the controls that actually reduce exposure. In this episode of The Art of Security, Josh Davies and Tyler Reguly examine the line between communicating security effectively and merely performing it. They challenge conventional thinking about security metrics, product marketing, threat hype, compliance, and the pressure to make security programs look productive. Key takeaways Why activity metrics such as alerts triaged, vulnerabilities patched, and detections created may not reflect improved security How threat hype and named vulnerabilities can redirect limited resources away from higher-priority risk Why security visibility and clearly assigned asset ownership provide a stronger foundation for meaningful measurement How security teams can demonstrate control effectiveness without relying on checkbox compliance or misleading ROI calculations Security should create confidence because controls are validated, assets are monitored, and responsibilities are clear, not because a dashboard looks impressive. 👍 Like the video if the discussion challenged how you measure security 💬 Tell us which cybersecurity metrics your team finds genuinely useful 🔔 Subscribe for practical conversations with cybersecurity practitioners and researchers

Calendar invites have become part of the trusted infrastructure of daily life, and attackers are taking advantage. In this episode, the team examines the resurgence of CalPhishing, an attack technique that uses legitimate calendar workflows, HTML content, attachments, spoofed organizers, and trusted platforms to evade defenses and compromise accounts. Fortra security engineer and FIRE team member Daud Jawad joins hosts Josh Davies and Tyler Reguly to break down the calendar phishing techniques reaching users today. They explore why these attacks can bypass traditional email security controls, how trusted workflows lower users' defenses, and why organizations may need to reconsider how they process and test calendar invitations. Key takeaways How attackers use calendar invite bodies, HTML attachments, spoofed organizers, and legitimate vendor infrastructure to deliver phishing lures Why CalPhishing can evade email authentication, filtering, browser protections, and other established security controls How calendar-based attacks can target credentials, session tokens, OAuth consent, device codes, and trusted internal workflows How organizations can reduce exposure through calendar processing controls, user education, cross-channel verification, and calendar-based phishing simulations Read Daud's related blog on Fortra.com Don't let the next threat sneak onto your calendar. Subscribe to The Art of Security podcast.

AI can accelerate red team operations, but how much autonomy is too much when production systems and sensitive data are at stake? In Episode 13 of The Art of Security, co-host Josh Davies speaks with Pieter Ceelen of Fortra's Outflank and Cobalt Strike red teams about the opportunities and risks surrounding AI-powered red teaming. They examine where AI can strengthen adversary simulation, why fully autonomous testing demands caution, and how rules of engagement must evolve as AI becomes part of offensive security operations. The conversation explores: Where AI can support reconnaissance, vulnerability research, initial access, reporting, and post-exploitation analysis Why human oversight remains critical in sensitive and production environments How red teams can balance automation, operational risk, and potential reward Whether AI will change the skills needed by the next generation of penetration testers How AI could reshape vulnerability discovery, zero-day research, and the ongoing contest between attackers and defenders Listen to the full episode for a practical perspective on using AI to advance red team operations without losing sight of judgment, accountability, or risk.