THREATCON1

Recorded live at RSA Conference, THREATCON1 hosts Patrick Garrity (Security Researcher at VulnCheck) and Kimber Duke (Director of Product at VulnCheck) sit down with Piotr Kijewski, CEO of The Shadowserver Foundation, to explore the evolving landscape of cyber threats, vulnerability exploitation, and global threat intelligence.As one of the most respected nonprofit organizations in cybersecurity, Shadowserver collects and shares threat intelligence at massive scale, helping governments, ISPs, enterprises, and security teams identify compromised systems, track active exploitation, and respond to emerging cyber threats.In this conversation, Piotr shares how Shadowserver grew from a volunteer incident-response initiative into a globally trusted organization monitoring cyber activity across more than 175 countries. The discussion covers the rise of ransomware and extortion operations, the return of large-scale botnets, residential proxy networks, IoT security risks, rapidly accelerating vulnerability exploitation, and the growing challenge of AI-generated security misinformation.The team also explores how Shadowserver detects exploitation in the wild, supports law enforcement operations, assists with botnet takedowns, and helps defenders gain visibility into their external attack surface before attackers strike.Topics Covered:How Shadowserver became a global cybersecurity forceThe evolution of cybercrime over the past 20 yearsWhy exploitation is happening faster than everResidential proxy networks and IoT botnetsTracking known exploited vulnerabilities (KEVs)The challenges of securing network edge devicesAI-generated vulnerability research and "AI slop"Botnet disruptions, sinkholing, and law enforcement operationsBuilding effective cyber threat intelligence partnershipsPractical advice for security teams and defendersWhether you're a CISO, vulnerability management leader, SOC analyst, threat hunter, security researcher, or cybersecurity professional, this episode offers valuable insight into the threats shaping today's internet and the organizations working behind the scenes to make it safer.Links:Shadow Server https://www.shadowserver.org/Vulncheck https://www.vulncheck.com/THREATCON1 https://www.threatcon1.org/#CyberSecurity #ThreatIntelligence #VulnerabilityManagement #Shadowserver #RSAConference #CyberDefense #ThreatHunting #VulnCheck #Botnets #Ransomware #InfoSec #CyberThreats #THREATCON1Podcast #VulnerabilityResearch #NetworkSecurity

In this special live episode recorded at RSA Conference, ThreatCon1 hosts Patrick Garrity and Kimber Duke sit down with Cynthia Kaiser, SVP of Ransomware Research at Halcyon and former FBI Cyber Executive, alongside Johnny Collins, Director of Intelligence Operations at Halcyon.The discussion explores how ransomware has evolved from financial crime into a growing national security threat. Cynthia and Johnny share firsthand insights from decades of experience across the FBI, NSA, Mandiant, and the private sector, including the discovery of Scattered Spider, investigations into major cyber campaigns, and emerging threats tied to geopolitical conflicts.Topics include:• The evolution of ransomware and why attacks are now measured in minutes instead of days• How groups like Scattered Spider changed the cyber threat landscape• The growing overlap between nation-state operations and cybercriminal activity• Iranian-linked ransomware campaigns and their connection to geopolitical conflict• Why healthcare and critical infrastructure remain prime targets• The hidden reality of ransomware payments and repeat victimization• How public and private sector organizations can work together to disrupt cybercriminal networks• What security leaders should be doing now to prepare for the next wave of attacksWhether you're a security practitioner, threat intelligence professional, executive, or simply interested in how cyber threats are shaping global events, this conversation provides valuable insights into the rapidly evolving threat landscape.Guests:Cynthia Kaiser – SVP, Ransomware Research, Halcyon | Former FBI Cyber ExecutiveJohnny Collins – Director of Intelligence Operations, HalcyonHosts:Patrick Garrity, Security Researcher, VulnCheckKimber Duke, Director of Product, VulnCheck#CyberSecurity #Ransomware #ThreatIntelligence #Iran #ScatteredSpider #CriticalInfrastructure #HealthcareSecurity #CyberCrime #ThreatCon1 #RSAConference #Halcyon #VulnCheck

Recorded live at the RSA Conference, this episode of the THREATCON1 Podcast features a deep-dive conversation with Joe Slowik — one of the cybersecurity industry’s leading voices in cyber threat intelligence, detection engineering, and adversary operations.Hosted by Patrick Garrity and Kimber Duke from VulnCheck, the discussion explores how modern threat actors operate, why most organizations still struggle with cybersecurity fundamentals, and how defenders can build stronger, intelligence-driven security programs.ABOUT OUR GUEST:Before joining Dataminr, Joe held cybersecurity and threat intelligence roles across government and industry, including work with Dragos, Gigamon, Huntress, and MITRE. His background spans Navy cyber warfare operations, incident response, threat hunting, intrusion analysis, and large-scale detection engineering.In this episode, the conversation covers:How cyber threat intelligence actually supports real security outcomesWhy detection engineering is becoming essential for modern security teamsThe mindset defenders need to think like attackersLessons from the Black Basta ransomware chat leaksThreat hunting methodologies and operational security practicesVPN abuse, proxy infrastructure, and telecom compromise risksWhy healthcare and manufacturing continue to be high-risk targetsHow attackers prioritize targets using sales and marketing-style tacticsThe future of cybersecurity talent, hacker culture, and defensive operationsWhy strong cybersecurity still comes down to fundamentals and operational disciplineWhether you work in a SOC, lead a security team, build detection content, hunt threats, or simply want to better understand how modern cyber adversaries operate, this episode delivers practical insights from leaders working on the front lines of cybersecurity.Dataminr uses AI and real-time event discovery to help organizations detect emerging risks, cyber threats, geopolitical events, and breaking incidents faster — enabling security teams to respond before threats escalate.VulnCheck provides exploit and vulnerability intelligence designed to help organizations prioritize real-world threats, understand exploitation activity, and stay ahead of emerging vulnerabilities before attackers weaponize them.

Recorded live at the RSA Conference, this episode of THREATCON1 features a deep dive into the evolving world of cybersecurity with Casey Ellis, Founder of Bugcrowd.Joined by Patrick Garrity (Security Researcher) and Kimber Duke (Director of Product at VulnCheck), the conversation explores how the industry is changing—and why many of the core problems remain the same.From the rise of AI-powered capabilities to the growing importance of vulnerability disclosure programs, this episode unpacks the tension between speed, innovation, and security.🔍 What You’ll Learn- Why cybersecurity today feels “faster, louder, and more chaotic”- How AI is expanding both opportunity and risk in hacking- The evolution of bug bounty programs and ethical hacking- Why most software is built without security as a priority- The reality of vulnerability disclosure—and why it’s still broken- The importance of empathy between researchers and organizations- How community plays a critical role in modern security- The legal risks hackers face—and how initiatives like the Security Research Legal Defense Fund are changing that⚡ Key Insights- “We’re solving the same problems—just faster and louder.”- Security often comes second to shipping products quickly- Ethical hackers are now gaining a seat at the leadership table- Clear vulnerability disclosure processes can prevent real-world damage- The future of cybersecurity depends on collaboration, not silos👤 About the GuestCasey Ellis is the Founder of Bugcrowd, a pioneer in crowdsourced cybersecurity and bug bounty programs. With over a decade of experience shaping how organizations work with ethical hackers, Casey has played a key role in advancing vulnerability disclosure practices globally.🔗 Resources & Projects Mentioned Disclose.io — Improving vulnerability disclosure standards https://disclose.io Security Research Legal Defense Fund — Supporting ethical hackers facing legal challenges https://srldf.org 🎙️ About THREATCON1 THREATCON1 brings together leading voices in cybersecurity to explore the biggest challenges, ideas, and innovations shaping the industry today. https://threatcon1.org

In this live episode recorded at RSA Conference, the THREATCON1 team sits down with Joe Silva, Founder & CEO of Spektion, for a deep dive into the evolving reality of enterprise cybersecurity in the age of AI and explosive software complexity.Joe shares his unique journey from military intelligence and government service, through roles at iSight Partners, Symantec, TransUnion, and JLL as CISO, to now building a cybersecurity startup focused on redefining how organizations understand and manage exploitability.At the core of the conversation is a shift away from traditional vulnerability management and CVE-driven thinking toward runtime, behavior-based visibility. Joe explains how modern environments are increasingly filled with custom-built tools, AI-generated code, and rapidly evolving software that often falls outside traditional security models.Key topics covered include:- Why CVE-based vulnerability management is no longer enough- How runtime telemetry reveals true exploitability in real time- The growing problem of alert fatigue and the move toward “non-alerting” security models- Why most enterprise environments contain far more custom and unknown software than teams realize- The rise of AI-generated code and its impact on secure development practices- The shift from patching toward mitigation as a primary security strategy- How supply chain attacks are evolving in an AI-accelerated development world- Why memory-based vulnerabilities remain one of the most under-addressed systemic risksThe discussion also explores a forward-looking reality: security teams must increasingly operate at machine speed, focusing less on perfect prevention and more on fast detection, prioritisation, and mitigation of real exploitable conditions.A candid, practical, and forward-thinking conversation on what it truly takes to secure modern software ecosystems.

Recorded live at RSA Conference in San Francisco, Patrick Garrity and Kimber Duke from VulnCheck sit down with Saeed Abbasi, Senior Manager of Security Research at the Qualys Threat Research Unit, for a deep dive into one of the most overlooked attack surfaces in cybersecurity: network edge devices.From firewalls and VPN gateways to home routers, edge devices sit at the intersection of the internet and corporate networks — making them prime targets for attackers.In this episode, Saeed shares insights from years of vulnerability research across organizations like Trend Micro, Palo Alto Networks, and Qualys, including:• Why network edge devices are frequently targeted by attackers• The challenges organizations face when patching or replacing vulnerable infrastructure• How botnets exploit consumer routers while ransomware actors target enterprise edge devices• Why visibility and asset inventory are critical for security teams• The growing importance of risk-based vulnerability prioritization• How attackers exploit vulnerabilities within days — or even before patches are availableThe conversation also explores broader trends in vulnerability research, the evolution of exploitation timelines, and what organizations can do today to reduce risk at the edge.If you're responsible for vulnerability management, threat research, or network security, this episode offers valuable insight into how attackers are evolving — and how defenders can keep up.GuestsSaeed Abbasi – Senior Manager, Security Research, Qualys Threat Research UnitHostsPatrick Garrity – VulnCheckKimber Duke – Director of Product, VulnCheckRecorded live at RSA Conference.

In this episode of the THREATCON1 Podcast, Patrick Garrity is joined by Ryan Dewhurst, Head of Threat Intelligence at WatchTowr, for a deep dive into the rapidly evolving world of vulnerabilities, threat intelligence, and real-world exploitation.Ryan shares the story of his journey through cybersecurity — from creating the widely used Damn Vulnerable Web Application (DVWA) and the WPScan vulnerability database, to building projects like KevIntel, and now leading threat intelligence efforts at WatchTowr.The conversation explores how modern attackers operate, why time-to-exploit is shrinking, and why internet-facing infrastructure like routers, firewalls, VPNs, and edge devices has become a primary target for threat actors.Patrick and Ryan also discuss the growing scale of the vulnerability landscape, the limitations of traditional scoring systems like CVSS, and why organizations must move toward context-driven vulnerability prioritization instead of simply chasing severity scores.Along the way, they examine how threat intelligence teams detect exploitation in the wild using honeypot networks, reverse engineering, and vulnerability research — and what defenders should be paying attention to as the cybersecurity landscape continues to accelerate.If you’re interested in emerging threats, exploited vulnerabilities, and the future of cyber defense, this episode is packed with insights.Topics covered in this episode• Ryan Dewhurst’s path from DVWA and WPScan to WatchTowr• The rise of exploited vulnerability intelligence• Why attackers are increasingly targeting network edge devices• The shrinking time-to-exploit window• Zero-day vs end-day vulnerabilities in real attacks• Detecting exploitation with honeypots and threat telemetry• Why CVSS scores alone aren’t enough• The growing challenge of managing vulnerability volume• What cybersecurity teams should expect in the years ahead🎧 Subscribe to the THREATCON1 Podcast for more conversations with cybersecurity researchers, threat intelligence leaders, and industry experts exploring the evolving threat landscape.

In this episode of the THREATCON1 Podcast, Tom Bain and Patrick Garrity sit down with Lillian Lang, Senior Manager of Cyber Threat Intelligence at Chevron, to explore how modern cyber threats are evolving—and what defenders must do to stay ahead.Lillian shares her journey from federal intelligence work after 9/11 to protecting critical infrastructure in the private sector, offering a rare inside look at:How nation-state actors target the energy industryThe real impact of supply-chain vulnerabilities and zero-day exploitsWhy third-party risk and business continuity are now core security concernsThe growing role of AI in cyber defense—and the new risks it introducesWhat cyber threat intelligence teams actually do inside global enterprisesThis conversation delivers practical insight for cybersecurity professionals, technology leaders, and anyone interested in how critical infrastructure is defended in an increasingly complex threat landscape.Subscribe for more conversations with the people shaping the future of cybersecurity.

In this episode of the THREATCON 1 Podcast, hosts Tom Bain and Patrick Garrity sit down with Cynthia Kaiser, SVP at Halcyon and former FBI cyber executive, to explore the rapidly evolving world of ransomware, AI-driven threats, and national-security-level cyber defense.Drawing on two decades inside the FBI—including briefing the President’s Daily Intelligence Brief—Cynthia shares frontline insight into how cyber threats have changed, why ransomware is moving faster than ever, and what organizations must do now to stay protected.In this conversation:How AI is reshaping ransomware attacks and social engineeringWhy today’s cyber threats blur the line between espionage and warfareThe growing gap between government capability and private-sector technologyWhat “assume breach” really means in modern cybersecurityWhen (if ever) paying a ransom makes sensePractical strategies to contain attacks and protect critical infrastructureThis is a must-watch discussion for security leaders, IT professionals, policymakers, and anyone concerned about the future of cyber defense.About Cynthia KaiserCynthia is an award-winning cyber executive, former FBI leader, and SVP at Halcyon focused on stopping ransomware and advancing threat intelligence. She has been featured in major global media and previously served as a President’s Daily Brief intelligence briefer across two U.S. administrations.Subscribe for more conversations with the people shaping the future of cybersecurity.

Tom and Patrick chat with Neil Robinson, Head of Security Engineering and Cybersecurity, Virgin Money. Neil shares his perspectives on tracking and managing emerging cyber threats in the financial services industry, gives us an alternate role or the CISO - The Chief "Translation" Officer, and provides some ways in which he focuses in on reducing noise, creating more effective signal, and how he sees the "AI slop" affecting that signal-to-noise ratio from some intel providers. Finally, Neil make an enormously salient point on how trust factors into threat actor tracking across a targeted "Top 10" threat actors who matter in the financial industry.