The Bug we Let Live: Episode 1

 Last month, governments switched off their own websites because of two hidden flaws in software that runs a huge share of the web. The flaws were a very old kind of mistake: memory unsafety, the class of bug behind roughly 70% of the most serious security flaws Microsoft and Google have found in their own code.In this first episode, host Sarina Gandy traces the bug from a 1972 government report to Aleph One’s 1996 paper “Smashing the Stack for Fun and Profit,” meets the engineers who fought it, and hears from the people who paid the price when it got loose, from hospitals locked out by WannaCry to activists targeted through their phones.In this episode:Rob Joyce, former NSA cybersecurity leaderDavid “Dwizzzle” Weston, MicrosoftBob Lord, Chief Strategy Officer, Software Safety InstituteLauren Zabierek, Co-founder and CEO, Software Safety InstituteTarah Wheeler, cybersecurity executive and doctoral candidate, University of OxfordPavlina Pavlova, Critical CyberNicole Perlroth, author of This Is How They Tell Me the World EndsYael Grauer, formerly of Consumer ReportsAdam Shostack, threat modeling expertElias Levy (Aleph One), author of “Smashing the Stack for Fun and Profit”Crispin Cowan, creator of StackGuardChapters:00:00 Cold open: the websites that went dark02:33 You already know this bug04:19 Whose problem is this?06:32 Seventy percent07:26 WannaCry and the NHS08:49 Audrey’s story10:19 What getting hacked really means12:00 No setting to change13:03 What the bug actually is14:46 What it has cost us16:01 The 1972 warning18:26 Smashing the Stack19:51 Finding Aleph One22:43 StackGuard and the 300 Spartans24:02 Everything we tried27:09 The bug that never left29:19 NotPetya31:19 AI changes the math32:46 Whose problem is it now?The Bug We Let Live is an audio documentary from the Software Safety Institute, with generous support from Cyber Florida. Produced by Sarina Gandy. Co-produced by Rex Wilson. For more information, visit softwaresafety.org.

Emily Adams is the COO of Tampa Bay Tech Week and Managing Partner of HyLo Inno, an innovation and investment firm focused on closing gaps in the Tampa Bay tech ecosystem. In addition to consulting on accelerators, funding, and community building, she leads protected skunkworks engagements for manufacturers and growth-stage companies through Gulf Works Lab.   Her personal story explains her extraordinary success. At age seventeen, Emily escaped an Amish community that controlled everything about her life. She had only a sixth-grade education and a dream of being a "corporate woman." From there, she built a career spanning automotive manufacturing, cybersecurity, entrepreneurship, and now the innovation infrastructure of one of the fastest-growing cities in America. Emily shares what it took to save $1.5 million at Honda, what proof stacking is and why it works, and why the most underrated asset in any career pivot is the skills you already have. Jack Clabby and co-host Kayley Jerrell talk with Emily about building Tampa Bay Tech Week from scratch in four months with a team of six volunteers, what went right and wrong in year one, and why a centralized space where founders, operators, and investors can build something together had been missing from Tampa. She also explains human design, why she is a manifester, and what that means for the people around her. In the Lifestyle Polygraph, Emily talks about competing in powerlifting at the world level, what she does during downtime, why her favorite Tampa thing is cigar lounges, and why her leap of faith is far from her defining moment.  Follow Emily on LinkedIn and learn more at gulfworkslab.com and tampabaytechweek.com Presented by ThreatLockerSupported by DerscannerChapters: 00:00 Introduction to Cybersecurity and Resilience02:34 Emily Adams: A Journey of Discovery and Innovation11:14 Transitioning from Manufacturing to Cybersecurity14:23 Tampa Bay Tech Week: A New Era in Tech Events21:57 Navigating Success and Failure in Business23:36 The Power of Transferable Skills26:05 Lifestyle Polygraph: Insights into Emily's Mindset   

From Best Buy to Cybersecurity: Curiosity, Confidence, and Finding Your Place in TechIn this episode of No Password Required: Next Gen, Yazzel interviews Karina Rosario, Applications SOP Writer at ThreatLocker. Karina shares how her curiosity about technology led her from working at Best Buy and Geek Squad to earning her bachelor's degree in cybersecurity and beginning her career in the industry.From building a strong IT foundation to learning how important networking can be, Karina keeps it real about what it actually takes to break into cybersecurity. She talks about why a career in cyber is a “slow burn,” the value of taking chances on yourself, and how experiences from outside of cybersecurity can become some of the most valuable skills in your career.Outside of cyber mode, Karina brings plenty of personality to the conversation, from being a Nintendo and Fortnite fan to imagining her own cybersecurity sidekick in the world of Kim Possible. She also opens up about being a first-generation college graduate and her goal of becoming a voice for young women and girls entering cybersecurity.Karina’s story is a reminder that there is no single path into cybersecurity. Sometimes the experiences you least expect can become the foundation for where you’re headed next.Find Karina on LinkedIn here: https://www.linkedin.com/in/karina-r-3088691b9/Presented by ThreatLocker Supported by DerscannerChapters: 00:00 Introduction to Karina and Her Role at ThreatLocker03:00 Journey into Cybersecurity: Education and Inspiration05:51 Skills and Qualities for Success in Cybersecurity09:05 Personal Interests and Hobbies Outside of Work12:02 Empowering Women in Cybersecurity and Future Aspirations 

In this episode:Bruno's origin story: a fifteen year old in a French village of 1,200 people watches a late night TV show about two young American millionaires and wakes up his mom at midnight to announce his plan (05:47 - 07:08)Arriving in Seattle with a $10,000 loan, a backpack, and English as a work in progress (07:08 - 08:06)From MS-DOS to Windows NT to Exchange to Xbox to Hardware to HR, how a developer ends up running Microsoft's worldwide HR planning (08:06 - 09:42)The day Bill Gates walked into the shipping party and canceled the product Bruno had spent a year building, and the box he still has (09:42 - 10:57)Starting BEMO in 2010 before Office 365 or Azure existed and building a system that could deploy SharePoint in 15 minutes (11:07 - 12:07)Watching Microsoft decide to eat his lunch in 2012 and becoming the second biggest reseller of Project Online and SharePoint Online on the way out (12:07 - 13:39)The deliberate pivot to cybersecurity in 2018 and winning Microsoft Partner of the Year in 2023 (13:39 - 14:34)Why CMMC compliance is like having a child and the birthday is just the beginning (14:34 - 15:34)Opening the hood on companies that have been self-attesting perfect CMMC scores for five years and what you find inside (15:34 - 16:53)What the average SMB gets wrong about cybersecurity and why being on Copacabana beach with a laptop makes you a very effective hacker (16:53 - 18:28)AI versus AI: going from 46 agents to 21 and building a governance framework that mirrors BEMO's human staffing levels (18:28 - 20:34)Eight years working alongside his son Brandon, how he kept it professional, and why he is relieved they never had an accident (20:34 - 22:00)The Lifestyle Polygraph: éclairs, a French bakery, the 1998 World Cup, flying lessons, the Marshawn Lynch earthquake, and the leader who blocks his own employees from connecting on weekends (22:29 - 33:15) Timestamp Highlights:(05:47) The midnight promise to his mom that became a thirty-six year adventure(07:08) Arriving in Seattle with a $10,000 loan and English as a work in progress(09:42) Bill Gates walks into the shipping party(11:07) Building BEMO before Office 365 existed(12:07) Watching Microsoft eat his lunch and becoming the second biggest reseller anyway(14:34) CMMC compliance is like having a child(16:53) Why hackers love small businesses who think they are immune(18:28) From 46 AI agents to 21 and why governance matters(20:34) Eight years working with his son Brandon(23:18) His favorite French pastry is the éclair(25:59) France beats Brazil two months before his wedding(27:31) The family intervention that ended his flying lessons Resources & Links:BEMO — bemopro.comThreatLocker — Presenting sponsor of No Password RequiredDerScanner — Episode sponsorCyber Florida — The Mother Ship

Austin Walley - AP History Teacher Turned Cybersecurity Educator and a believer in figuring it out. Austin Walley is a cybersecurity educator at George Jenkins High School in Lakeland, Florida, where he leads the school’s cybersecurity academy. But unlike many people in the field, Austin didn’t start in technology. He started as an AP history teacher and was recruited into cybersecurity after his administrators saw something beyond technical skills: his ability to question, teach, build relationships, and connect with students. In this episode, Austin shares how he went from knowing almost nothing about cybersecurity to building and teaching an evolving cybersecurity program. He breaks down why teaching cyber means constantly rebuilding the curriculum, how to separate foundational skills from technology that will quickly become outdated, and why students don’t need to be “super, super technical” to get started. Live from CyberLaunch 2026, Austin shares his experience preparing high school students for cybersecurity careers, emphasizing the importance of teamwork and communication and how CTF competitions reveal natural leaders in the classroom. He also explains why resilience and the ability to “figure it out” may be some of the most important skills a future cybersecurity professional can develop. He also shares what it’s like when everyone assumes the cyber teacher knows everything about computers, why students from completely different backgrounds can thrive in cybersecurity, and how his school’s administrators took a chance on him and continued to support him every step of the way. Follow No Password Required Breakout room for more conversations with the innovators, creators, and game changers shaping the cybersecurity industry Chapters:  00:00 Introduction to Cybersecurity Education 02:58 Transitioning from History to Cybersecurity 05:52 Curriculum Development in a Fast-Paced Field 09:02 Student Diversity and Soft Skills in Cybersecurity 12:09 Challenges and Resilience in Cyber Competitions

In this episode: How a virus-infected Prince of Persia floppy disk on a Commodore 64 sparked a lifelong obsession with cybersecurity (03:03 - 06:45) From NYU to Yale cryptography PhD to Goldman Sachs to Gilt Groupe, and the near-miss that changed everything (03:03 - 06:45) What SecurityScorecard actually does and why the pen and paper questionnaire era had to end (06:55 - 08:18) What it looked like in the early days, including an IKEA furniture test for business partnerships (08:26 - 12:01) Why SecurityScorecard now scores every company in the world, not just twelve million organizations (12:01 - 12:29) The Gilt Groupe credit card near-miss, what the first 24 hours looked like, and why fear was the first reaction (12:50 - 17:30) What it takes to create an entire market category from scratch and why the job to be done never changes (17:48 - 20:20) The difference between the CISO version and CEO version of Alex, and what Satya Nadella said about zooming out (20:49 - 22:36) Which version of Alex people would rather have a beer with and why any job besides CEO is more fun (22:43 - 23:45) How North Korea used a fake hedge fund to try to recruit SecurityScorecard developers (24:06 - 25:47) Why the world is not becoming safer and the critical difference between robustness and resilience (25:59 - 26:42) The True Confessions keynote: why openly admitting breaches makes the whole ecosystem stronger (27:13 - 29:22) The Jaguar Land Rover breach and what it took to double a UK company's security budget overnight (27:13 - 29:22) The single most dangerous thing a board member has ever said in a meeting about cybersecurity (29:45 - 31:09) What one thing a non-technical CEO could do this week to make their CISO's life better (31:25 - 32:12) The Lifestyle Polygraph: restaurant health scores, PowerPoint ban, The Inner Game of Tennis, chess, false advertising, and podcast advice (33:07 - 41:32)   Timestamp Highlights: (03:03) Prince of Persia, a floppy disk, and the origin of a cybersecurity career (06:07) The realization that changed everything: you can do everything right and still lose (08:26) The IKEA furniture test for business partnerships (12:50) The Gilt Groupe near-miss and what the first 24 hours looked like (17:48) What it takes to create a market category from scratch (20:49) CISO vs CEO: zooming in vs zooming out (22:43) Which version of Alex would you rather have a beer with? (24:06) North Korea's fake hedge fund operation (25:59) Robustness vs resilience: why the mindset has to change (29:45) The most dangerous thing a board member has ever said (31:25) One thing every non-technical CEO should do this week (36:48) The Inner Game of Tennis and the infinite game (40:00) Chess, false advertising, and meeting his future wife   Resources & Links: SecurityScorecard — securityscorecard.com The Perfect Scorecard by Aleksandr Yampolskiy ThreatLocker — Presenting sponsor of No Password Required DerScanner — Episode sponsor Cyber Florida — The Mother Ship

No Password Required: Next Gen - Ep. 3 - Kieran Human How Lead Cybersecurity Engineers Actually Think  In this episode of No Password Required: Next Gen, Yazzel interviews Kieran Human, Lead Cybersecurity Engineer at ThreatLocker. From research to working directly with ThreatLocker's CEO on new security initiatives, Kieran gives an inside look at what it's really like to work on the front lines of cybersecurity. Kieran stands out as a cybersecurity professional by hares why curiosity, strong communication, and understanding the bigger picture are just as valuable as technical skills. He also reflects on one of his proudest career moments, writing a compliance white paper that earned praise from ThreatLocker's CEO Danny Jenkins, and explains how that experience reinforced the importance of research, writing, and always looking for ways to improve. Kieran also explains why Zero Trust security is becoming essential, teaches viewers a few cybersecurity terms that are guaranteed to impress at dinner, and even reveals why the Terminator would be his ultimate cybersecurity teammate!  Whether you're exploring a career in cyber or looking for practical advice from someone working in the field every day, this episode is packed with insights for the next generation of cybersecurity professionals. Presented by ThreatLocker Supported by DerScanner Follow Kieran on Linked in here: https://www.linkedin.com/in/kieran-human-5495ab170/  Chapter List: 00:00 Introduction to Cybersecurity and Career Path 02:54 Key Skills and Qualities for Success in Cybersecurity 06:07 Impact of AI and Zero Trust in Cybersecurity 06:56 Fun Insights and Closing Thoughts  

Philipp Leo — Swiss cyber expert, diplomat, and military officer, always two steps ahead of the storm No Password Required Season 7: Episode 7 - Philipp Leo Philipp Leo co-founded Leo & Muhly Cyber Advisory, a strategic advisory firm specializing in cyber risk, resilience, and geopolitics. Now consulting with governments and private firms in Switzerland and abroad, Philipp has served as a UN observer on the Korean DMZ, trained the next generation of Swiss Armed Forces cyber specialists, and taught at the University of Glasgow. He is also part of Europol's network of experts in data protection and cybercrime and has published stateside in MIT Sloan Management Review. In this episode, Philipp shares his journey from a Swiss bank he couldn't wait to leave to the Korean border, and eventually to the boardrooms of executives who still think cyber risk is someone else's problem. He breaks down the three most dangerous misconceptions executives have about cyber risk, why the CISO is too often a poster child rather than a decision-maker, and the challenges to cyber insurance in Europe. Cyber attorney Jack Clabby and co-host Kayley Jerrell talk with Philipp about his live crisis simulation that nobody can win, how to train cyber warriors, and how nation-state cyber conflict is looking more and more like the age of Caribbean pirates. In the Lifestyle Polygraph, Philipp reveals his favorite book, his eye-opening, go-to celebratory drink, and the weight of his luxury umbrella. He also shares his favorite escape when the complexity of modern life gets to be too much and introduces us to a Zurich commuting tradition that involves swimming home through a river.   In this episode: Philipp's journey from a Swiss bank he couldn't wait to leave to the Korean DMZ and eventually the boardrooms of Fortune 500 executives (00:27 - 02:22) The three most dangerous misconceptions executives have about cyber risk and why cyber risk is a corporate problem, not a technology problem (04:19 - 05:30) How Philipp's live crisis simulation works, why nobody can win it, and why that's exactly the point (05:49 - 08:47) Why cyber crisis teams have improved dramatically but leadership boards remain the weakest link (06:30 - 08:47) The CISO poster child problem: why most CISOs have the accountability without the authority (09:54 - 11:00) Why cyber insurance in Europe has largely failed to deliver and what happens when attackers find your policy before you do (11:17 - 13:44) The OFAC twist: what happens mid-exercise when a Swiss bank decides to pay and then learns the attackers are on the sanctions list (18:38 - 19:31) Training Swiss Armed Forces cyber specialists and why the first lesson is that the other side plays by no rules (19:47 - 21:37) Whether nation states can ever beat the cyber threat and why the east side of Vienna tells you everything you need to know (21:54 - 23:25) Why nation-state cyber conflict has become remarkably similar to the age of Caribbean pirates (23:46 - 24:23) The Lifestyle Polygraph: Endurance, Campari Red Bull, a three-ounce umbrella, a cabin in the Alps, and swimming home through a Zurich river (00:04 - 12:03)   Timestamp Highlights: (00:27) From Swiss banker to UN observer on the Korean DMZ (04:19) The three misconceptions executives have about cyber risk (05:49) The crisis simulation nobody can win and why that's the whole point (09:54) Why the CISO is too often a poster child without real power (11:17) Why cyber insurance in Europe has largely failed (18:38) The OFAC twist that stopped a Swiss bank mid-exercise (19:47) Training Swiss cyber warriors to understand the other side plays by no rules (21:54) Nation states vs. cyber threats: are defenders always outpaced? (23:46) How nation-state cyber conflict mirrors the age of Caribbean pirates (07:25) Always prepared: the three-ounce umbrella that nobody sees   Resources & Links: Leo & Muhly Cyber Advisory  Philipp Leo on LinkedIn ThreatLocker — Presenting sponsor DerScanner — Supporter of this podcast Cyber Florida — The Mother Ship  

In this episode: Why Rob always asks for the team nobody wants and what the turnaround process actually looks like (00:31 - 02:10) From sleeping in his car at 18 to Fortune 500 executive, and the kindness from strangers he still carries with him today (02:10 - 04:32) What a successful team turnaround actually looks like, including eight leaders in ten years and what changed (04:32 - 07:00) Servant leadership, why career leaders almost always fail, and the power of coming in with a partial idea instead of a completed thought (07:00 - 09:33) The truth about the cybersecurity job shortage and why open jobs almost never mean what you think they mean (09:33 - 11:37) Why communication skills matter more than technical ability and what happens when a technical score of 10 meets a communication score of two (11:37 - 13:22) Cyber is a marathon, not a race, and why passion got Rob a job at Disney over people with far more experience (13:22 - 15:27) Neurodiversity in the workplace, getting diagnosed with autism at 40, and why really smart doesn't get jobs anymore (15:27 - 17:51) The colleague who told Rob everyone thought he was a jerk, the boss who explained why, and the apology tour that followed (17:51 - 21:31) Getting laid off from Disney, becoming a ghost on the internet, and accidentally building the BowtieSecurityGuy brand (21:31 - 25:47) Tying self-worth to career, crying before job interviews, and the four words his wife said that changed everything (25:47 - 27:40) The 3am LinkedIn message from India that made Rob realize he was in this for life (27:40 - 29:40) Zero expectations, zero conditions, and why Rob messaged Rex about a hat with absolutely nothing to gain (29:40 - 31:40) Immersion therapy, D&D every Monday, and why a bad public speaker is more memorable than a good one (34:03 - 37:16) Rejection sensitivity dysphoria, masking, and why setting the tone in a room changes everything (37:16 - 39:23) The 3,000 manual LinkedIn messages, the algorithm daddy slap, and pricing yourself where you want to be (39:23 - 40:43) Zero expectations as a life philosophy and why people don't quit jobs, they quit bosses (40:43 - 42:27) Learning to walk three times, leg braces, and why cutting through grass almost brought Rob to tears (42:27 - 44:40) What Rob tells job seekers who have been at it for two years: you are ten nos away from your dream job (44:40 - 47:09) The cybersecurity salary reality check and why 3,500 to 4,500 people graduate with cyber degrees every single month (47:09 - 48:50) Rob's thank you to the people who know who they are, his battle buddies, and why vulnerability is a strength (48:50 - 51:28) Fail with style, the Walt Disney Haunted Mansion story, and why Rob never took no for an answer at Disney (51:28 - 56:39)   Timestamp Highlights: (00:31) Give me the team nobody wants (02:10) Homelessness at 18 and the kindness that stayed with him (07:00) Servant leadership and the power of a partial idea (09:33) The real reason there are so many open cybersecurity jobs that never get filled (11:37) Stop applying. Start connecting. (13:22) How passion got Rob hired at Disney over NSA agents (17:51) Getting diagnosed with autism at 40 (21:31) Getting laid off from Disney and accidentally building a brand (27:40) The 3am message that changed everything (34:03) D&D, immersion therapy, and why bad public speakers are more memorable (42:27) Learning to walk three times and why Rob doesn't take anything for granted (51:28) Walt Disney, the Haunted Mansion, and failing with style   Resources & Links: BowtieSecurityGuy — Rob's brand across all platforms ThreatLocker — Presenter of No Password Required Breakout Room Cyber Florida — The Mother Ship  

Shane Tews — Non-Resident Senior Fellow at AEI and the person who explained the internet to Capitol Hill No Password Required Season 7: Episode 7 – Shane Tews Shane Tews is a Non-Resident Senior Fellow at the American Enterprise Institute, where she focuses on cybersecurity, privacy, artificial intelligence, and internet governance. She is also President of Logan Circle Strategies, a strategic advisory firm working at the intersection of technology and policy. Before her think tank work, Shane helped introduce modems to the George H.W. Bush White House, walked the halls of Capitol Hill explaining the internet to blank-staring legislators, and spent years at VeriSign helping shape the foundational frameworks of how the internet would be governed. In this episode, Shane traces her unlikely path from the Bush administration to becoming one of Washington's most trusted voices on tech policy. She breaks down why regulating outcomes rather than inputs is the only sensible approach to technology governance, why the US and EU are operating from fundamentally different innovation philosophies, and why a national privacy bill is long overdue. She also explains why most organizations and individuals are far less protected than they think and why nobody knows who to call when something goes wrong. Jack Clabby and co-host Kayley Melton talk with Shane about legacy system vulnerabilities, the cybersecurity implications of agentic AI, and what policymakers absolutely must get right over the next decade. She also reflects on what the CISA reauthorization limbo means for companies that don't even know they've lost liability protection. In the Lifestyle Polygraph, Shane reveals she has 20,000 emails across eight accounts, admits she fakes laughs at bad jokes out of Midwestern politeness, shares her obsession with The Bear and Peaky Blinders, and tells us about her children's book project using Google Omni called "Shane on a Train." Follow Shane on LinkedIn and on X at @ShaneTews. Find her work at AEI.org and TechPolicyDaily.com. No Password Required is presented by ThreatLocker   In this episode: Shane's path from the George H.W. Bush White House to becoming Capitol Hill's go-to internet explainer (00:34 - 02:22) Why the Clinton-era multi-stakeholder model got internet governance right and what that means for policy today (04:40 - 06:13) The case for a national privacy bill and why 50 state standards aren't working (07:24 - 09:27) What AEI covers and how Shane thinks about riding the top of the wave across the entire tech policy stack (09:35 - 11:23) Legacy systems, vendor debt, and why outdated software is the easiest entry point for bad actors (11:30 - 13:34) The gap between how protected people think they are and how exposed they actually are, including a generational perspective on MFA (14:07 - 16:25) The biggest disconnect between everyday cyber reality and the policy world (16:59 - 20:35) Government readiness for a major cyber attack and why most people don't have a plan (20:54 - 22:32) How the US and EU innovation philosophies differ and why Europe's banking system is the real tech problem (22:41 - 25:38) The DeepSeek false narrative and where the US is leading vs. reacting on AI (25:45 - 29:21) The shift from AI features to AI coordination and what agentic AI means for cybersecurity permissions (29:28 - 32:16) What policymakers must get right on AI over the next 10 years (32:25 - 34:11) The Lifestyle Polygraph: inbox chaos, fake laughs, The Bear, and Shane on a Train (00:04 - 12:48)   Timestamp Highlights: (00:34) Shane's origin story: modems at the White House and blank stares on the Hill (04:40) Why the internet got policy right early on and what we can learn from it (07:24) The case for harmonizing breach standards with a national framework (11:30) Legacy systems and vendor debt as the easiest attack vectors (14:07) The real gap between how protected people think they are and how exposed they actually are (20:54) Government cyber readiness: do you know who to call when something goes wrong? (22:41) US vs. EU innovation: why Europe's banking system is the real tech problem (29:28) Agentic AI and the cybersecurity risks of permissions you forgot you gave (32:25) What policymakers must get right on AI over the next decade (06:44) Shane on a Train: using Google Omni to write a children's book series   Resources & Links: AEI.org — Shane's think tank home base TechPolicyDaily.com — Daily tech policy coverage ThreatLocker — Supporter of this podcast Cyber Florida — The Mother Ship