Secure Networks: Endace Packet Forensics Files

The enablers-vs-behaviors framing produces a handful of genuinely useful practitioner observations, but the episode is padded with analogies, affirmations, and restatements of the same car-keys metaphor. Actual novel claims per minute are low for an 18-minute runtime.

“we as threat hunters responders are trained to look for the anomalous. What stands out against the norm. Well if that baseline norm is enablers of compromise, we start to ignore them simply because it's always been that way”

“I think AI has also created a new era of misconfigurations. We see a lot more people building stuff with AI without necessarily understanding what they're building and then just publishing it”

The 'enablers vs. behaviors' framing is a mildly useful reframe, but nearly every concrete point - Telnet is bad, NTLMv1 is risky, cleartext credentials are dangerous, AI causes new misconfigs - is standard security-community received wisdom with no contrarian or first-principles argument.

“if we play some buzzword bingo here, we can just rattle off AI and cloud really quick”

“I think it generally boils down to all right, I'm an analyst, maybe I'm new at the company, maybe I've been here for 20 years and I see telnet on the wire”

Cody Spooner has genuine IR and threat-hunting practitioner roots, but the role described is sales/systems engineering at a vendor, which introduces a promotional context and limits the depth of independent, at-scale operational perspective on offer.

“my background started out in the services side where I dove into incident response and threat hunting. And from there that was a natural trends, uh, transgression or transformation, uh, into the sales side of the world”

“The packets don't lie. It's right here.”

The episode names specific protocols (NTLMv1, Telnet, LDAP, SMBv1, HTTPS 443) and gestures at conference observations, but there are zero named customers, breach case studies, quantified metrics, or dollar figures - everything stays at the level of 'we see a lot of this' generality.

“when we see something like ntlm, um, version one on the network, well, the abilities that that attacker had to gain credentials and laterally move have opened up”

“HTTPs port 443, um, we see a lot of connections at the various conferences, both Endase and corelight support together, um, where those connections are intended to be encrypted. We can see that because they use the standard port for HTTPs, but it's all clear text”

The host selects reasonable topics but executes almost every exchange as a soft tee-up followed by effusive affirmation ('that's a great point,' 'no, absolutely,' 'no, that's a great example'), with no follow-up challenges, no probing of vendor bias, and no productive disagreement across the full episode.

“That's a great point. Uh, don't leave the door open and wonder why somebody walked in, right?”

“No, that's a great point. And you're right in the other comment you had.”