Blue Team Diaries

A handful of non-obvious points emerge - transparency as an exploitable attack surface, and the black-box AI leaving organisations in a worse posture as attacks evolve - but large portions of the episode are padded with standard industry platitudes about hybrid models, LLMs in the SOC, and skill shifts that offer little a well-read practitioner hasn't already heard.

“as an adversary, as a bad actor, I will use that information to change my line of attack to defeat what you're telling me. So by its nature it has issues”

“The more you're just dependent on this black box against unknown attacks could leave you in actually a worse posture than if you're getting the data”

The transparency-as-attack-surface argument is the episode's most genuinely counterintuitive insight, and the adoption-by-false-positive-tolerance framing (nuclear vs. finance) is a useful organising lens, but the remaining content - hybrid AI/human models, LLMs for SOC querying, changing skill sets - is widely recycled material in any 2024 cybersecurity discussion.

“if I'm highly automated, I can set an AI attack vector to say, analyze the transparency of this AI engine and create an attack that will circumvent the uh, algorithms and protections inherent in this AI solution”

“the tolerance for I'm gonna have some false positive rate is very different among industries”

Howard Smith brings genuine 30-year investment experience in cybersecurity and delivers the episode's more substantive analysis; however, the guests are investors rather than operators who have built or run security products at scale, Liam Moran is a junior associate whose contributions are largely generic, and the host's undisclosed commercial relationship with Howard (board member of the sponsor) compromises the independence of the conversation.

“We've been investing in CyberSecurity for over 30 years and unlike some areas of technology where there's a discrete issue or problem and technology comes and solves it”

“Howard is actually on the board of directors for Samus Networks”

The 60-branch attack scenario and the nuclear-reactor false-positive example are concrete and illustrative, and there are specific tool references (Splunk, SQL, SPL) and sample natural-language queries, but the episode is entirely free of named vendors under analysis, real market data, deal sizes, or empirical research findings from the cited quarterly report.

“let's say you have, uh, a large organization with 60 branches and somebody systematically going through with an attack”

“show me all the login attempts from a new device in the last 48 hours that failed more than three times before succeeding”

The host follows a coherent thread tied to the guests' published report and lands one genuine correction when his misreading of the 'learning organisation' section is pushed back on, but the conversation is fundamentally a friendly promotional exchange - the host leads the sponsoring company, Howard sits on its board, and no claim goes unchallenged or stress-tested throughout the 41 minutes.

“Wow, thanks for that clarification. I think I might have misinterpreted that section of the report”

“in full disclosure, I should mention that Firstanalysis, uh, is an investor in Stammis Network, my company, which is a sponsor of this podcast”