Grok Build Uploaded Your Entire Codebase — Without Asking

A cybersecurity career doesn’t have to mean hacking. Explore SOC, pentesting, GRC, jobs without a security clearance, and AI’s impact on the field. Frank Downs and Dr. Dustin Brewer return to your cybersecurity career questions, drawing on roughly two decades of experience each across technical work, operations, governance, and risk. The first question isn’t “How do I become a hacker?” It’s “What kind of work would I actually enjoy doing every day?” Because Hollywood conveniently leaves out the documentation. And the emails. So many emails. In this episode: • How to find a cybersecurity role that fits your interests • Why governance, risk, and compliance deserves more respect • What penetration testing actually involves • How help desk and IT experience can build a foundation • Cybersecurity career paths outside cleared government work • What companies still need humans to secure as they adopt AI We also discuss international students’ career concerns, local AI models, and protecting company data. Our AI discussion reflects professional observations—not a guarantee about future hiring or job security. For international applicants, work authorization, employer sponsorship, and security-clearance eligibility are separate questions. Immigration policies and court rulings can change; verify current requirements for your circumstances. CHAPTERS 00:00 Finding your cybersecurity career path 01:03 Which cybersecurity role fits you? 02:03 Why GRC gets overlooked 03:48 Try different roles before you commit 05:42 Can the SOC night shift work for you? 06:36 Hollywood hacking vs. the actual job 08:24 Red team vs. blue team: different mindsets 10:40 Your career interests can change 12:33 Cybersecurity without a security clearance 14:58 Private-sector paths and help desk experience 17:42 International students and H-1B concerns 19:33 How AI is changing cybersecurity careers 22:10 Securing company AI and protecting data 25:37 The rush to adopt AI 27:48 Cloud costs and bringing AI in-house 29:31 More career questions next time If you want dangerous technology explained through what it actually does to your life, subscribe. Keep on cybering. #Cybersecurity #CybersecurityCareers #CybersecurityJobs #CareerChange #GRC #SOCAnalyst #PenTesting #AISecurity #ArtificialIntelligence #LegitimateCybersecurity

Getting into cybersecurity takes more than collecting certifications. How should you weigh a degree, hands-on experience, and the skills employers need? Frank Downs and Dr. Dustin Brewer return with more cybersecurity career questions submitted by listeners and students: how to choose a specialty, what credentials actually accomplish, and which skills to build first. Last episode covered getting your foot in the door. This time, we discuss choosing your direction—and making sure your résumé has real understanding behind it. There’s also a brief, apparently unavoidable detour through Castle Grayskull. In this episode: • Choosing a cybersecurity specialty that fits the work you actually enjoy • Exploring paths beyond hacking, including security operations, engineering, and governance, risk, and compliance • Weighing degrees, certifications, and hands-on experience • Looking for cybersecurity programs that include real client work • How hiring managers use relevant certifications when reviewing applications • Vendor certifications versus broader security knowledge • Why understanding computers and networks still matters • Using Wireshark to connect networking theory with what’s actually happening We also discuss the NICE Workforce Framework, Oregon State University, UMBC, and why finding work you enjoy can help guide your next certification or career move. The warning: collecting credentials without building the understanding behind them can leave you with an expensive résumé and some uncomfortable interview questions. Connect your next step to the work you want to do—and learn how to demonstrate what you know. ▶ PREVIOUS EPISODE The Truth About Breaking Into Cybersecurity With No Experience https://www.youtube.com/watch?v=Obr55rr5E08 Media/interview: [email protected] Audio: https://legitimatecybersecurity.podbean.com/ CHAPTERS 00:00 Getting into cybersecurity: more listener questions 01:15 Cybersecurity is bigger than hacking 02:41 Choosing your specialty 06:09 Finding your path and exploring the NICE Framework 09:56 Degrees vs. certifications vs. experience 10:50 The unavoidable He-Man detour 12:45 Credentials and hands-on learning 14:21 Students working with real clients 15:42 What hiring managers look for 18:37 Are vendor certifications worth it? 23:39 Which skills should you build first? 27:04 Networking, Wireshark, and making it click 29:44 Building computers and revisiting the fundamentals 32:49 Finding your direction—and what comes next Which part of getting into cybersecurity has you stuck: choosing a specialty, deciding on a certification, or finding hands-on experience? Tell us in the comments. If you want dangerous technology explained through what it actually does to your life, subscribe. Keep on cybering. #Cybersecurity #CybersecurityCareers #CybersecurityJobs #CybersecurityCertifications #CybersecurityDegree #EntryLevelCybersecurity #CareerChange #Networking #Wireshark #LegitimateCybersecurity

How do you get a cybersecurity job without experience—and which certifications are actually worth your money? Frank and Dustin answer. Frank Downs and Dr. Dustin Brewer tackle three career questions submitted by listeners and students: how to land your first cybersecurity job, how to choose certifications, and how to stand out to employers. Dustin’s path ran through the Coast Guard and the NSA. Frank was preparing to sell suits at Nordstrom before a recruiter called. Neither story followed a neat checklist, and that’s part of the point: there’s more than one way into cybersecurity. In this episode: • Getting started without professional cybersecurity experience • Military and civilian routes into the field • Where degrees, certifications, internships, and volunteer work fit • Network+ and Security+ as foundational options • Choosing specialized certifications around your interests and career goals • Training costs, renewal fees, and why collecting credentials can get expensive • What employers look for in résumés and interviews • Explaining the experience you actually gained through projects and internships • Why a tailored résumé matters • The certified applicant who couldn’t draw a basic home network We also discuss CyberSeek, hands-on training, government qualification requirements, and the difference between cybersecurity programs housed in business schools and computer science departments. The warning: a certification can help demonstrate knowledge, but you still need to explain—and show—what you can do. Before paying for another credential, connect it to the work you want to pursue. Media/interview: [email protected] Audio: https://legitimatecybersecurity.podbean.com/ CHAPTERS 00:00 Three cybersecurity career questions 00:57 Getting your first job without experience 01:32 Dustin’s Coast Guard route into cybersecurity 06:18 From IT training to the NSA 08:23 Security clearances and civilian transitions 10:48 Frank’s unexpected route into the NSA 14:11 There’s more than one way into cybersecurity 15:38 Degrees, certifications, and earning employer trust 18:05 Which cybersecurity certifications are worth getting? 19:31 Government requirements and hands-on exams 21:43 Training costs and the SANS discussion 23:36 Foundational and specialized certifications 26:18 CyberSeek and choosing your direction 28:18 Renewal fees and the cost of keeping certifications 30:47 Different types of cybersecurity degrees 32:15 How to stand out to employers 33:12 The applicant pile and applying early 34:14 Certifications versus demonstrated ability 35:11 The home-network interview test 36:32 Résumé requirements and relevant experience 38:54 Explaining your work without burying the reader 40:22 Tailoring résumés and writing cover letters 41:23 What’s coming in the next career discussion If you want dangerous technology explained through what it actually does to your life, subscribe. Keep on cybering. #cybersecurity #cybersecuritycareers #cybersecurityjobs #EntryLevelCybersecurity #securityplus #networkplus #CybersecurityCertifications #CareerChange #JobInterview #LegitimateCybersecurity

Police officers used Flock Safety cameras to track exes and other personal targets. Flock’s security chief explains what its cameras record, who can search the data, and what the company says is changing now. In this episode, Frank Downs and Dr. Dustin Brewer sit down with Chris Castaldo, Chief Information Security Officer at Flock Safety, for a direct conversation about the nationwide license-plate-reader network appearing along roads, in neighborhoods, and outside private businesses. Chris previously worked in the NSA’s Tailored Access Operations, served in the U.S. Army during Operation Iraqi Freedom, and is the author of Startup Secure. The conversation covers: • Officers accused of using license-plate searches for personal tracking • Flock’s announced reduction of its default retention period from 30 days to seven days for new customers • Anomalous-search detection, account lockouts, case numbers, and audit controls • Why multi-factor authentication only recently became mandatory • What a Flock camera records when a vehicle passes • How the image travels from the roadside camera to cloud storage • How law-enforcement agencies, businesses, and HOAs can share camera observations • Who Flock says owns the data and who can search it • Whether Flock cameras collect Wi-Fi, Bluetooth, or phone identifiers • The separate Flock camera feeds exposed through a cellular-provider configuration issue • The absence of a comprehensive federal privacy law governing this technology • Whether Flock plans to add facial recognition • How some vehicle images may be used for machine-learning training • The public-safety argument involving stolen vehicles, missing people, and AMBER Alerts • Whether Frank and Dustin’s opinions changed after hearing Flock’s answers The central question is not whether this technology can help solve crimes. It can. The question is whether a system powerful enough to help locate a missing child is also powerful enough to expose the movements of innocent people—and whether companies, police departments, lawmakers, and oversight systems can keep up. EDITORIAL NOTE: Chris Castaldo represents Flock Safety. Statements concerning Flock’s products, controls, security, data handling, accuracy, and public-safety outcomes reflect the company’s position unless independently sourced. Several safeguards discussed in this interview were announced as phased changes and are not yet mandatory for every customer. Additional context and competing perspectives: Associated Press — Flock’s announced changes and the national backlash: https://apnews.com/article/flock-license-plate-cameras-surveillance-deflock-2a93bc075e2f7ffcca9e04a35d75a3fe Washington Post — investigation of officer misuse: https://www.washingtonpost.com/technology/2026/08/02/how-police-officers-used-vast-network-cameras-spy-their-exes/ Flock Safety — the company’s announcement: https://www.flocksafety.com/blog/flock-guardrails-address-lpr-privacy-concerns-and-police-transparency ACLU — criticism and competing perspective: https://www.aclu.org/news/privacy-technology/tracking-alpr-cameras/flock-safety-credibility-lost-as-it-repeatedly-lies-to-city-councils-police-departments-and-public-across-the-country Media/interview: [email protected] Audio podcast: https://legitimatecybersecurity.podbean.com/ If you want dangerous technology explained through what it actually does to your life, subscribe. Keep on cybering. CHAPTERS 00:00 Officers tracking exes—and Flock’s response 00:41 Meet Flock Safety’s security chief 01:49 What does a Flock camera capture? 03:05 From the roadside camera to the cloud 04:56 Can HOAs share camera data with police? 08:22 Police misuse and Flock’s new safeguards 12:19 Why are these changes happening now? 15:42 How officers use real-time Flock alerts 17:00 Who controls police camera data? 18:40 Who owns the images? 21:51 Could Flock cameras track phones or Wi-Fi? 26:00 Were Flock cameras exposed online? 29:14 America’s privacy-law gap 31:19 Why regulation always trails technology 33:32 Safety versus abuse 35:21 Why nobody trusts the system 37:08 Transparency portals and public audits 38:58 Will Flock add facial recognition? 39:43 The public-safety argument 41:11 Wi-Fi, Bluetooth, and camera hardware 42:33 Does Flock use images to train AI? 44:43 Chris Castaldo’s path into cybersecurity 48:11 The one security rule everyone should follow 48:25 Did this interview change our minds? #FlockSafety #FlockCameras #Privacy #Surveillance #LicensePlateReaders #ALPR #DataPrivacy #PoliceTechnology #CivilLiberties #Cybersecurity #LegitimateCybersecurity

Private equity is moving into the infrastructure beneath your internet—and the real prize may be control over who gets data first. Frank Downs and Dr. Dustin Brewer examine the undersea cables carrying the world’s communications and why financial firms increasingly see them as valuable digital real estate. These cables connect countries, financial markets, cloud services, governments, and billions of people. But when a small number of powerful organizations own the infrastructure, they may gain enormous leverage over speed, access, competition, maintenance, and the flow of information itself. In this episode: - How undersea internet cables actually work - Why private equity considers them attractive infrastructure - The “internet toll booth” business model - Why milliseconds matter in financial markets - Whether corporate ownership could create a privatized Great Firewall - Net neutrality, monopoly power, and national security - The uncomfortable question of who should own essential communications infrastructure We also get distracted by GeoCities, Second Life, Roku, Starbucks cup sizes, Zuckerberg attempting to appear human, and the Amish community that may have saved Wall Street from itself. The key warning: controlling content is powerful. Controlling the pipes beneath that content may be even more powerful. Media/interview: [email protected] Audio: https://legitimatecybersecurity.podbean.com/ Hosted by Frank Downs and Dr. Dustin Brewer. CHAPTERS 00:00 Private equity’s next target 00:44 The rise of digital real estate 02:14 How the internet crosses an ocean 03:39 What happens when one cable fails 05:06 Why Wall Street wants the seafloor 06:44 The internet toll-booth model 10:02 Controlling who gets data first 12:26 A corporate Great Firewall? 14:11 Why monopolies keep surviving 16:56 The slow death of net neutrality 21:38 The national-security problem 23:30 Who should own the internet? 26:38 What can anyone actually do? If you want dangerous technology explained through what it actually does to your life, subscribe. Keep on cybering. #underseacables #cybersecurity #internetinfrastructure #dataprivacy #PrivateEquity #NetNeutrality #InternetFreedom #DigitalInfrastructure #NationalSecurity #SubmarineCables

Grok Build reportedly uploaded entire Git repositories—including files it never opened, full Git history, and deleted secrets—to xAI-controlled cloud storage. In this episode of Legitimate Cybersecurity, Frank Downs and Dr. Dustin Brewer unpack what that means for anyone allowing an AI coding agent inside a real computer. Independent researcher CerebLab captured Grok Build packaging a complete repository into a Git bundle and sending it to cloud storage after being explicitly told not to read any files. Turning off “Improve the model” did not stop the transfer in the researcher’s test. That does not prove xAI trained on the code. It exposes a different problem: “don’t train,” “don’t transmit,” and “don’t retain” are three very different promises. Frank and Dustin discuss: • Why deleted passwords and API keys can survive in Git history • How AI coding agents gain broad access to your computer • Why developers keep treating security as something to add later • The difference between a breach, a leak, and a breach of trust • Why old code can be more dangerous than current code • What developers should do now: rotate secrets, isolate projects, restrict permissions, and monitor unexpected outbound data IMPORTANT UPDATE: CerebLab reports that whole-repository uploads later stopped after xAI enabled a server-side control. SpaceXAI also promised to delete previously retained coding data and subsequently open-sourced Grok Build. This episode examines the documented behavior before that change—and the trust problem it exposed. Research and updates: https://cereblab.com/ https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123 Media/interview: mailto:[email protected] Audio podcast: https://legitimatecybersecurity.podbean.com/ CHAPTERS 00:00 — Grok Build reportedly uploaded whole repositories 01:20 — Why Git repositories are a gold mine 03:19 — Breach, leak, or breach of trust? 04:23 — What AI coding agents actually do 05:20 — Why old code still matters 08:56 — Deleted passwords can survive in Git history 10:41 — “Don’t train” vs. “don’t retain” 12:30 — When an AI codes its own connector badly 14:30 — What affected developers should do now 16:38 — AI agents are becoming highly privileged 19:31 — What system-level AI access can destroy 21:26 — The network anomaly that exposed the upload 22:19 — When bandwidth becomes a security signal 23:43 — Patch quickly—without becoming CrowdStrike 24:34 — The practical takeaway #Grok #GrokBuild #Cybersecurity #DataPrivacy #AICoding #VibeCoding #AIAgents #xAI #GitSecurity #SourceCode #ArtificialIntelligence #LegitimateCybersecurity

Hackers no longer need to steal your password. Software vulnerabilities have overtaken stolen credentials as the leading way attackers break into breached organizations. According to Verizon’s 2026 Data Breach Investigations Report, exploitation of software flaws now accounts for 31% of breach entry points. After years of companies concentrating on phishing, password security, and employee training, attackers may have found an easier target: the software itself. Frank Downs and Dr. Dustin Brewer examine why critical vulnerabilities remain exposed for months—even when patches already exist—and how artificial intelligence is changing the speed at which attackers can discover and exploit security flaws. In this episode: • Why software vulnerabilities have overtaken stolen credentials • How AI helps attackers find exploitable flaws faster • Why companies delay installing critical security patches • What the MOVEit breach revealed about patching failures • Why old printers, servers, and business applications remain dangerous • How organizations test patches without breaking production systems • Why network segmentation often becomes cybersecurity duct tape • What vulnerability scanners can—and cannot—detect • How threat intelligence, SOC teams, and vulnerability management should work together • Why the National Vulnerability Database is struggling to keep pace • What organizations can realistically do to reduce their exposure The warning is simple: your password can be perfectly secure, and an attacker may still find another way in. Media/interview: mailto:[email protected] Audio: https://legitimatecybersecurity.podbean.com/ CHAPTERS 00:00 Hackers don’t need your password 00:07 The new leading way attackers break in 01:09 AI is finding software exploits faster 02:19 MOVEit: The patch existed 02:38 Why critical vulnerabilities remain exposed 03:36 It is always the printer 04:17 Is segmentation just security duct tape? 05:00 Microsoft’s “keep an eye on it” solution 05:50 Testing security patches on Timmy 06:31 Making vulnerability management satisfying 07:10 Excel formatting becomes a professional sport 08:08 Scientists made brain cells play Doom 10:10 The vulnerability-management maturity model 11:38 Software is the weakest link again 13:26 Can AI find unknown vulnerabilities? 14:32 What AI can and cannot fix 15:41 Why vulnerability scanners miss emerging threats 18:14 Connecting SOC, threat intelligence, and vulnerability data 18:52 Why cybersecurity remains a cost center 20:01 The processes that can save an organization 21:16 A high CVSS score is not everything 21:40 Is the National Vulnerability Database falling behind? 24:27 Why old vulnerabilities remain useful to hackers 25:46 Your software is the new password #cybersecurity #hackers #databreach #SoftwareVulnerabilities #PasswordSecurity #ArtificialIntelligence #ZeroDay #PatchManagement #VulnerabilityManagement #VerizonDBIR

A $3 pair of kids’ shoes rang up for almost $19 at checkout. Mistake, dynamic pricing, or something much creepier? In this episode of Legitimate Cybersecurity, Frank Downs and Dr. Dustin Brewer break down a viral Walmart pricing story and ask the bigger question hiding behind it: what happens when stores, apps, location tracking, purchase history, and data brokers all meet at the register? This is not just about one pair of shoes. It is about whether the price you see is still the price everyone gets — or whether companies can quietly personalize what you pay based on where you are, what device you use, what you have bought before, and what they think you are willing to tolerate. Frank and Dustin discuss the difference between normal retail mistakes, dynamic pricing, surge pricing, geofenced pricing, and surveillance pricing. They also explain why this gets especially uncomfortable when the products involved are basic needs like food, clothing, and household goods. Main discussion threads: * The Walmart shoe price story * Why a $3 price becoming almost $19 gets people angry * Digital shelf tags and app-based prices * Dynamic pricing vs. surveillance pricing * How GPS, IP addresses, cookies, shopping apps, and data brokers can affect what companies know about you * Why VPNs may not solve the real problem * Why the person at the register is not the villain * What shoppers can do when prices change before checkout The key warning: the future of shopping may not be one price for everyone. It may be one price for you. Media/interview: mailto:[email protected] Audio: https://legitimatecybersecurity.podbean.com/ Chapters: 00:00 The price changed before checkout 00:45 The $3 Walmart shoes story 02:24 The app said $3, checkout said almost $19 02:58 Retail mistake or something bigger? 04:04 Why people trust prices less now 04:50 Delivery apps and dynamic pricing 05:40 Walmart, digital tags, and checkout confusion 07:54 Are we already in the middle of surveillance pricing? 09:01 How location and devices can influence prices 10:49 Why phone GPS changes the game 11:16 Digital shelf tags and backend prices 12:12 The Sam’s Club checkout experiment 13:29 Why VPNs may not save you 14:30 Data brokers and behavioral pricing 17:00 Dynamic pricing vs. surveillance pricing 19:15 Privacy settings may not be enough 21:23 What shoppers can do 22:30 Don’t yell at the cashier 23:25 The price tag may not be the real price #Cybersecurity #Walmart #DynamicPricing #SurveillancePricing #ConsumerPrivacy #DataPrivacy #RetailTech #DataBrokers #LocationTracking #ShoppingApps #DigitalPrivacy #LegitimateCybersecurity

Your work laptop may be training the AI that eventually replaces you — and Meta just gave us a preview of how creepy that future could get. In this episode of Legitimate Cybersecurity, Frank Downs and Dr. Dustin Brewer discuss reports about Meta’s Model Capability Initiative, a program designed to collect employee computer activity such as mouse movements, clicks, keystrokes, and occasional screenshots to help train AI systems. This is not just another “employee monitoring” story. Traditional workplace monitoring was usually framed around security, compliance, or productivity. This is different: the purpose is AI training. That means your daily work behavior could become the dataset that helps AI agents learn how to navigate real software, real workflows, and real human messiness. Frank and Dustin break down why AI agents still struggle with ordinary computer tasks, why companies are desperate for human workflow data, and why “trust us” is not a privacy policy. They also discuss the reported data exposure concerns, the difference between “no indication of improper access” and actual assurance, and what this means for anyone using a corporate device for personal life. Main discussion threads: * Why Meta wanted real employee computer activity to train AI * How AI workplace monitoring differs from traditional enterprise monitoring * Why AI agents still struggle with menus, clicks, and normal workflows * The privacy problem with keystrokes, screenshots, prompts, and performance data * Why “no evidence of misuse” does not mean “nothing happened” * Whether this becomes normal as compute gets cheaper * Why you should stop using your work laptop for personal activity The big warning: if your employer owns the laptop, assume the laptop is not yours. And now, assume AI may be watching too. Media/interview: mailto:[email protected] Audio: https://legitimatecybersecurity.podbean.com/ Chapters: 00:00 Is Meta showing us the future of work? 01:36 What Meta reportedly tracked 02:16 Normal monitoring vs AI training 04:50 Why AI agents need human workflow data 08:04 Is Meta building AI for users — or for extraction? 09:31 Employees, trust, and the 30-minute opt-out problem 15:36 The data exposure issue 17:17 “No indication of improper access” is not enough 20:15 Is workplace AI surveillance here to stay? 23:42 Stop using your work laptop for personal stuff 26:31 Final warning: AI is watching #AI #Cybersecurity #Meta #EmployeeMonitoring #WorkplaceSurveillance #ArtificialIntelligence #Privacy #DataPrivacy #AIAgents #FutureOfWork #TechNews #LegitimateCybersecurity