32 - When AI Attacks – Part 2

SIM swapping is rapidly becoming one of the most common—and damaging—cyberattacks. In this episode, Efani General Manager Mark Kreitzman explains how attackers seize phone numbers through social engineering and weak carrier controls, shares his own SIM-swap incident, and reveals how quickly criminals can access accounts, cloud data, and crypto. We also cover why SMS-based MFA is no longer safe and what organizations can do to protect high-risk users and critical systems. Key topics: What SIM swapping is and why it's a rising attack vector How attackers bypass telecom security using social engineering and insider help Why SMS-based MFA is vulnerable and outdated Real-world impact: account takeovers, cloud compromise and crypto theft Enterprise risks, compliance concerns and recommended security controls How AI tools help criminals target high-value victims faster

Threat hunting is one of cybersecurity's most talked‑about, and misunderstood, disciplines. In this episode, Cole French and guest Ben Lieberman breaks down what threat hunting really looks like inside complex, high‑volume environments and why fundamentals matter more than flashy techniques. We dig into how telemetry is collected, how attackers blend into normal activity, and why red and blue teams often view threats differently.  At its core, threat hunting is about mindset: understanding attacker behavior, knowing what "normal" looks like, and cutting through massive data to spot what truly matters.  You'll learn:   Why attackers often rely on simple, well‑known techniques The challenges of working with massive telemetry and alert volume  How tools like Splunk and Security Onion help find real signals  Why red teams sometimes test the wrong things  The importance of baselining and building detections around real behavior 

As AI is reshaping the threat landscape, the timeline for vulnerability discovery has collapsed. In this episode, guest Matt Stern breaks down how attackers are using AI to find and exploit weaknesses in minutes, and what organizations must do to keep pace.  We explore how modern AI‑driven testing can scan code, APIs, and mobile apps at scale, surface logic flaws traditional tools miss and help teams secure software before release. Matt also explains how continuous AI‑powered pen testing reduces blind spots, cuts alert noise, and allows humans to focus on advanced threats.  Finally, we look at the next frontier of agentic AI — guardrails, documentation checks, and automated reviews that help organizations prepare for a world where both attackers and defenders operate at machine speed. 

Following Part 1's deep dive into GTG-1002 and the rise of autonomous cyber operations, Part 2 shifts toward what leaders must do to get ahead of next-generation AI-enabled threats. Guest Nury Turkel explains how regulatory risk forms long before official rulemaking, often emerging first through congressional hearings, agency speeches, draft legislation, and national-security analyses. Nury argues that organizations gain an advantage by tracking long-term trendlines—such as bipartisan momentum and multi-agency action—rather than reacting to headlines, and by cultivating geopolitical literacy and responsible leadership. The conversation concludes with emerging AI-related risks to the defense industrial base and practical steps leaders can take to reduce technical debt, strengthen resilience, and stay ahead of next-generation threats. References: Wall Street Journal: China Tells Its AI Leaders to Avoid U.S. Travel Over Security Concerns (paywall) Bloomberg: China Expands Travel Curbs to Top AI Talent at Private Firms (paywall) Reuters: China Restricts Overseas Travel for Top AI Talent at Alibaba, DeepSeek

AI-enabled cyber operations have moved from theory to reality, with the GTG-1002 incident marking the first widely recognized case of an AI system independently executing a multi-step intrusion. In this 2-episode conversation, Nury Turkel explains how this shift is reshaping national security—from adversaries using AI to accelerate reconnaissance and credential misuse to the growing geopolitical stakes between the U.S. and China in advanced AI development. The episode highlights how governments and organizations must rethink readiness, regulation, and innovation as AI becomes both a transformative capability and a destabilizing force in global competition. References: Wall Street Journal: The First Large-Scale Cyberattack by AI (paywall) Anthropic Report on GTG-1002: Disrupting the first reported AI-orchestrated cyber espionage campaign (download)

AI is rapidly transforming how organizations identify, classify, and protect sensitive information, yet many are only beginning to understand what this means for CMMC, CUI, and their broader security programs. In this episode, we explain why understanding your data has become one of the most urgent challenges in modern cybersecurity and how AI‑driven tools can quickly reveal hidden sensitive information. This new intelligence helps organizations accurately define the true boundaries of their enclave and reduce assumed scope by pinpointing who actually interacts with CUI. We also cover how: Traditional tools like DLP, firewalls, and endpoint security often produce overwhelming, low‑value alerts. Adding richer, context‑aware data intelligence makes policies more precise and reduces alert fatigue. Enhanced intelligence strengthens enforcement as sensitive files move across the environment. It also improves operations by identifying stale or redundant data and reducing risks as organizations adopt AI. Strong AI guardrails are essential, including managing model permissions, inputs, outputs, and using MCP server‑based controls to block improper data flow.

Manufacturing sits at the heart of the Defense Industrial Base, yet many machine shops are only now grappling with what CMMC truly means for handling engineering data. In this episode, Paul Van Metre explains the practical challenges shops face, from managing drawings and CAD models that clearly qualify as CUI to updating decades-old processes never designed for cybersecurity. We discuss why CUI is so widespread on the shop floor, how traditional "print-and-post" workflows increase exposure, and why moving to digital, paperless processes can significantly reduce both scope and cost. Paul highlights the mindset barriers many shops encounter, the operational pressures on small manufacturers, and the hesitation some have in accepting that CMMC applies to them at all. We also explore: The shift toward cloud-based ERP systems and FedRAMP equivalency How modern ERP platforms eliminate local CUI storage, secure endpoints, and streamline compliance The high cost and risk of old on-prem ERP systems Strategies for lowering long-term CMMC costs Lessons from hundreds of ERP deployments, including when to migrate historical data versus starting fresh Listen to get a clear, realistic look at what CMMC means for machine shops, the operational decisions that matter most, and how manufacturers can modernize without overburdening the business.

Operational Technology is everywhere and yet it's often misunderstood or overlooked in traditional security planning. We sat down with OT cybersecurity expert Todd Heflin to unpack the realities of securing systems that directly interact with the physical world, where uptime, safety, and reliability are non-negotiable. With concrete examples and engineering-minded insight, this episode lays out strategies for strengthening OT security without disrupting operations. We explore: How OT differs from IT and IoT. Which frameworks actually help organizations establish a solid OT security posture. Practical considerations that come with real-world OT environments. How risk manifests when technology controls physical processes rather than just data. Frameworks like NIST SP 800-82 and ISA/IEC 62443 and explain how they shape everything from architecture to component security. And more. References NIST SP 800-82, Revision 3 ISA/IEC 62443 (purchase required)

Scoping is one of the most misunderstood yet essential parts of the CMMC ecosystem. Before organizations implement controls, buy tools, or prepare for assessments, they must first define what is in scope—their data, people, processes, and systems. When done well, scoping reduces costs, limits liability, and streamlines compliance. When done poorly, it increases the risk of assessment failures, whistleblower issues, and expensive rework. In this episode, Cole talks with cybersecurity leaders Andy Paul and RJ Williams to clarify what scoping really involves, why organizations often get it wrong, and how an enclave-based approach can simplify compliance. They explore the operational, technical, and contractual details many teams overlook, from CUI discovery and cage code challenges to the real cost drivers of CMMC. Whether you're preparing for your first assessment, refining your compliance strategy, or trying to understand how enclaves fit into your environment, this conversation offers practical guidance you can use right away. We discuss: Why scoping is the most critical step in any CMMC program. How to correctly determine where CUI resides — and why most organizations struggle. The value of minimizing scope to reduce cost, effort and assessment risk. When the enclave model works, why it works and how to implement it effectively. How DIBCAC assessors evaluate scope and why their approach differs from C3PAOs Why contracts — not IT assets — should drive scoping decisions. How people, processes and technology define an accurate compliance boundary. CAGE code complications and how enterprises can manage multi-entity compliance. How tools like Teramis support technical discovery to uncover hidden CUI and right-size environments. The business case for reducing liability, avoiding whistleblower risk and gaining competitive advantage. How segmentation, information barriers and GCC High configurations support scalable compliance. Why many organizations overspend on licensing and tools due to incorrect scoping.

Organizations often approach CMMC as a technology problem, but many assessment failures stem from foundational decisions made long before tools and configurations. In this episode, we break down the most common pitfalls we see in CMMC Level 2 assessments—from using non-compliant cloud environments to writing SSPs at the control level instead of the assessment-objective level, creating immediate and costly gaps. You will also learn about: Frequent implementation issues like inconsistent MFA, especially on critical security assets such as firewalls Why many risk assessments fall short because they are outdated, incomplete, or treated like control checklists rather than true threat evaluations. How to effectively work with MSPs and ESPs, including what a solid shared responsibility matrix should include. How assessors handle fixes during the assessment window and what qualifies under Security Requirement Reevaluation. This episode offers clear, practical guidance for any team preparing for CMMC Level 2—and looking to avoid the common false starts that derail assessments before they even begin.