The Connectivity Cloud Podcast

The episode contains a handful of genuinely operational insights—North Korean fake-worker mechanics, threat intel as workflow vs. reporting, AI-driven 70% SOC cost reduction, and named disruption operations—but a meaningful chunk of runtime is consumed by career backstories, the host restating what guests just said, and generic AI-as-force-multiplier commentary.

“threat intelligence is being treated as reporting rather than the workflow. That's. There is a huge difference to that”

“A recent example from one of the banks in the industry which I saw, I think they reduced socentro cost by 70%”

A few genuinely contrarian angles emerge—'why write malware when Cobalt Strike already exists,' the KYE (know your employee) reframe, and the 'fear monger marketing' critique of misaligned threat prioritization—but the episode also recycles standard security advice (fix basics first, collaborate with partners, signals matter) that circulates widely in the industry.

“I can just go and download malware. Like I can go run Cobalt Strike and just send it to someone with my own hash”

“I call it fear mon, Fear monger marketing, right? Which is people are like, oh, like look at this threat”

Both guests are genuine senior practitioners—a threat intelligence lead at a major global fintech and the head of a named threat-ops unit at Cloudflare—who reference real operations they personally ran, not career speakers recycling frameworks; however, neither is operating at the CISO or C-suite level that would warrant a higher score.

“We've worked with the DCU team on several different disruption operations this year. We had the Luma operation earlier this year that was targeting, you know, just globally 10 millions of people”

“we did a secondary operation with Microsoft on another threat actor called Raccoon O365”

Named operations (Luma, Raccoon O365), specific collaborators (Microsoft DCU, GitHub, Dropbox, Health ISAC), a concrete efficiency metric (70% SOC cost reduction), and the mechanics of North Korean fake-worker schemes give the episode real texture, but most examples are anonymized, dollar figures are absent, and timelines are vague ('earlier this year,' 'a couple of weeks ago').

“the Luma operation earlier this year that was targeting, you know, just globally 10 millions of people essentially, and trying to steal credentials”

“Raccoon O365, which was a phishing, credential targeting kind of cybercrime, targeting just people on the Internet”

The host surfaces a useful reframe (KYE vs. KYC) and asks decent scene-setting questions, but repeatedly summarises guests' answers back to them verbatim, never pushes back on any claim, and relies on filler affirmations that slow the substantive exchange.

“Wow, that is a lot to unpack. That sounds really scary for organizations”

“What I hear is focus on the simple things first”