Cyber Rants

A few genuine practitioner observations are buried under heavy repetition and filler - the distinction between KnowBe4 simulations and true social engineering is worth noting, as is the point that CVE-less risks (misconfigurations, credential stuffing paths) fall outside scanner coverage. But the core argument is restated circularly throughout the episode without deepening.

“your phishing campaigns through KnowBe4 or similar platforms are good best practice and you should absolutely do those. I'm going to go out on a limb and say that is not social engineering”

“you can't vulnerability scan the GitLab looking at a. Right. Your SOC is not going to help you there.”

The hosts self-acknowledge they are not presenting new ideas ('we're not really talking about anything new'), and the arguments - compliance-driven security is reactive, humans are the weakest link, annual pen tests are checkbox exercises - are the industry's most recycled talking points. The framing of CTEM as a renamed version of existing practices is honest but itself a common critique.

“our industry is better than any other industry that I've ever seen at coming up with new terms for things that we already do”

“we're not really talking about anything new. We're talking about just working more toward the ideal state, the ideal best practices”

There is no external guest - both hosts are co-founders/practitioners at Silent Sector, a mid-market cybersecurity consultancy. They demonstrate hands-on client experience but neither brings the seniority profile (e.g., enterprise CISO, major incident responder) that would warrant a higher score on this dimension.

“In fact, I think we just had this conversation yesterday or the day before with a client about this”

“Somebody asked me, we, uh, had a team ask us the other day, Zach, like, what are some things that you've seen”

The episode is almost entirely abstract. The lone data point - '54% of breaches start with humans' - is stated without any source attribution. Change Healthcare and Cloudflare are namedropped in passing without any analysis. Recommendations remain directional ('scan more frequently,' 'do threat modeling') with no concrete timelines, cost figures, or case study depth.

“54% of, of all breaches start with the human. All right, that's, that's facts. That's like there, there's been all kinds of data, um, matrices and things”

“Ask Change Healthcare how that worked for them”

The two-host format generates no productive tension - both hosts consistently affirm each other with 'yeah, absolutely' and 'exactly,' and questions are leading setups rather than genuine probes. There is no pushback, no challenging of claims, and no moment where a point is meaningfully stress-tested.

“That's a perfect. Which also right there.”

“Yeah, absolutely. You know. Oh, uh, well”