Phillip Wylie Show

The bulk of the episode is a live product demo walkthrough of an early-stage CTI platform, which substitutes feature enumeration for genuine operational insight. A handful of legitimate threat-intel concepts appear (PIRs/GIRs, diamond model, RBAC multi-tenant architecture) but are explained only at surface level and will be familiar to any practitioner in the space.

“these are your PIRs, GIRs and IRS, which are all basically intel requirements”

“it will pull all the news articles having to do with all the threat actors...it will then present those ttps and then give you the SIEM sort of queries to hunt for them. So your Sentinel queries, your QRADAR queries, your Elastic, uh, queries”

The AI-augmented threat intel aggregation concept is not novel - similar positioning exists across the CTI tooling market - and the guest's framing ('not AI in the traditional way') doesn't deliver a genuinely differentiated argument. The origin story is personal but follows a well-worn BBS/phone-phreaking nostalgia arc common in cybersecurity podcasts.

“not AI in this traditional way that people think of AI. We're using AI on the back end, using AWS bedrock to assist the analyst and make their job a lot faster”

“it's kind of along the realm of MISP and a couple of the other OSINT tools that are out there, but more geared towards teams in an enterprise with enterprise grade features”

Jason Faulhefer has genuine practitioner credentials - Navy cryptologist, founder of what he claims was an early automated vuln-scan firm (~2002), and current OT/SCADA and NERC CIP consultant for energy companies - but the episode does not meaningfully leverage this depth; it pivots almost entirely to a product pitch for his pre-launch startup.

“I'm also conducting one of the first ever SCADA and OT environments that's going into the cloud. So that's scary and exciting at the same time.”

“I became a CTR or a cryptologist where I learned code breaking and advanced cryptography”

There are concrete specifics - named APIs (VirusTotal, URLscan.io, GrayNoise, Alien Vault OTX), specific SIEM platforms, technology stack choices (AWS Bedrock, Cognito, Golang), and reasonably dated historical anecdotes - but the majority of specifics serve to describe product features rather than to substantiate broader operational claims or outcomes.

“pulling alien, alien Volat, OTX abuse, IDP, um URL house, uh CSakev, URLscan, IO, gray noise and virus total”

“I went down to that big green box at the bottom of the street kind of late at night and um, my friend, let's say, grabbed a bunch of unused numbers from the punch panel and assigned it to my grandmother's house so that I could get extra 12 lines in a hunt group”

The host contributes almost no intellectual value: questions are one-sentence softballs, there is zero pushback or follow-up on any technical claim, and a significant stretch of airtime is consumed by an off-topic mutual discussion about recently deceased friends. The origin story segment appears to have been bolted on after the closing goodbye, suggesting little editorial planning.

“Very cool. So when do you plan to publish it or um, go public with it?”

“Is there anything you'd like to share before we end?”