Cybersecurity Where You Are

A handful of genuinely interesting claims - compiled-code vulnerability discovery timeline, dynamic APT profile shifting, authorization sprawl as the post-Zero-Trust attack surface - are buried under extended AI platitudes, policy hand-wringing, and ceremonial rambling that pads a 51-minute runtime without adding proportionate substance.

“give it three or at the very most six months and you're going to start seeing that in compiled code. Finding vulnerabilities and creating exploits for it autonomously”

“authorization sprawl is the new pivoting”

The dynamic mid-campaign APT persona switching and the authorization-sprawl framing are genuinely fresh angles; however the bulk of the episode recycles well-worn takes - AI favors attackers, compliance ≠ security, SLTTs are underfunded - that any B2B security listener has heard dozens of times.

“A single adversary dynamically shifting their APT profile in the middle of a campaign or throughout a campaign. So today they look like this North Korean actor, tomorrow they look like this Russian actor”

“AI is just going to replace the pen test puppy mill. It's going to drain the swamp of low quality pen tests”

Ed Skoudis is a legitimate top-tier offensive-security practitioner with real operational depth, and Tony Sager's NSA Red Team oversight background adds credibility; the weakness is that this is essentially a CIS house podcast with one outside guest, limiting breadth of perspective.

“Torkel Opsol from my team...he is working on a framework that is looking very promising, um, along those fronts”

“I was working on a case...I called some friends and they hooked me up with a linguistics expert in the army. And I said...she said very quickly, oh, that's Farsi”

A few concrete anchors exist - the $4 NYU pen test, Josh Wright's RSAC presentation, Torkel Opsol's named research, the Tenable survey result - but the majority of the episode operates at high abstraction with no hard metrics on adoption rates, breach costs, or prediction accuracy against a defined baseline.

“there's a professor from NYU who was talking about, he did a, I assume a fairly low level pen test using a Gentek AI for $4”

“authorization sprawl that was coined by Josh Wright, uh, sans instructor...He presented on that at RSAC last year”

Sean's questions routinely pre-answer themselves before inviting the guest to respond, and neither host challenges a single claim across 51 minutes; the conversation is collegial and supportive throughout with no productive friction or probing follow-up when Ed makes specific predictions about compiled-code exploitation timelines.

“Ed, um, in terms of what you're seeing in the space from a um, Red Team perspective. Do we see effective implementation of Zero Trust or it's not filling some of the gaps that are some of the usual uh, elements of infiltration that uh, you see”

“I know you've been doing some phenomenal things in the space. Uh, the sans course, uh, that's uh, both developed and future development in the space. The application, the offensive elements”