Phishy Business

There are a handful of genuinely non-obvious ideas - hackers deliberately targeting companies that have never been breached, the two-report system that suppresses internal disclosure, and the dog/EDR analogy to illustrate why 30% internal breaches go undetected - but they are spread thin across 34 minutes of casual chat, dinner-party anecdotes, and surface-level observations about AI and regulation.

“Who hasn't been breached? I already know the chances of them having a very strong security posture is low. They're the ones I'm targeting.”

“30% of all breaches across all industries happen internally. So that means that the dog will not bark at somebody it knows.”

The framing of unbereached companies as hacker honeypots and the observation that neurotypicals - not neurodiverse people - struggle most with remote discipline are genuinely counterintuitive; however, the AI-cuts-both-ways point, the 'regulation is behind' take, and the Scully effect (a well-documented existing concept) are recycled territory.

“I will tell you that the neuronormals are the ones having a hard time being disciplined enough to work at home”

“I used to think hire more women, now I think represent more women in media”

Des Rock is a genuine dual-sided practitioner - founder of a pen testing firm that pivoted into a commercial SIEM product - which gives her real operational credibility; she is not a career podcast guest or pure thought-leader, though her scale and name recognition are modest.

“We were running all 24, seven and mimicking normal hackers. So there wasn't an area in which we couldn't get in”

“I've walked into a building with two coffee cups in my hand, knowing that I can infiltrate the...through, you know, the um, proximity, uh, cards”

A small set of concrete numbers appears - 11% women in cyber leadership, 22%/15% autism employment rates, the 30% internal-breach statistic, Splunk named as the sole competitor at entry - but sourcing is absent throughout, no dollar figures or client names are given, and most claims remain at the level of anecdote or assertion.

“30% of all breaches across all industries happen internally”

“only 22% of adults with autism are in full time work. And in the US that proportion drops to 15%”

The hosts set up reasonable topic pivots and have done some background research with statistics, but every guest claim is met with agreement or praise ('I love that,' 'that's mad'), no figures are challenged for sourcing, and the closing three questions are generic boilerplate that produces little additional substance.

“I love that”

“how would you introduce yourself to someone at a dinner party?”