Follow the White Rabbit - IT Security Podcast - English Edition

"Wake up, Neo. The Matrix has you." Welcome to the rabbit hole of cybersecurity. Instead of a red pill, we offer something much more valuable: clarity in a world of digital chaos. With cyberattacks surging globally and costing businesses billions while threatening critical infrastructure, staying ahead of the curve isn't just for IT pros - it’s a necessity for everyone. Follow the White Rabbit for your backstage pass to the frontlines of IT security. Hosted by Kofi Osae-Attah, the information security officer at Link11, we explore the strategies of modern attackers and the cutting-edge defenses that protect our digital future. Why subscribe? Global Insights: From our headquarters in Frankfurt, Germany, we discuss cyber resilience that transcends borders. Cutting-Edge Tech: Discover how AI and machine learning are revolutionizing DDoS attacks and automated defense mechanisms. Regulatory Roadmap: We demystify NIS2, the Cyber Resilience Act, and the EU AI Act to reveal what mat

Follow the White Rabbit - IT Security Podcast - English Edition is a technology podcast hosted by Link11, with 11 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Link11 hosts Follow the White Rabbit - IT Security Podcast - English Edition, a technology show with 11 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Follow the White Rabbit - IT Security Podcast - English Edition

  #11: 63% of CISOs Have Experienced Burnout. Boards Still Call It a People Problem.

  Jul 15, 202637 min

  The average CISO tenure has dropped from 26 months to six to nine months. Not because the role attracts the wrong people, but because it is structurally designed to fail. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah talks to Jeroen Schipper, Chief Security Advisor at DEFION Security about the crisis hiding in plain sight inside security leadership. Jeroen was CISO of The Hague for seven years, a city that hosts the International Criminal Court, NATO, Europol, and the Dutch royal family. He could predict cyberattacks within 48 hours of any politically sensitive event at the ICC. He knows what sustained pressure feels like from the inside and the cost when organisations refuse to treat it as a structural problem. The conversation looks at a dynamic that most boards still misread. A CISO identifies the risk, writes the analysis, hands over the signed risk acceptance letter – and still takes the blame when something goes wrong. The question that follows an incident is never "why didn't the board act?" It's always "what did the CISO miss?" That gap between responsibility and authority isn't just unfair. It's a security vulnerability. A burned-out CISO experiences what research calls risk blindness – a desensitisation caused by chronic overload that affects exactly the kind of judgment the organisation is depending on. And unlike an ER doctor, there's rarely anyone who can step in and cover. The good people leave. The revolving door keeps spinning. And every few months, one of the most critical roles in the entire risk structure starts over from scratch. He organised "Hack The Hague", which involved inviting 120 ethical hackers to attack the city's live infrastructure in the middle of City Hall. This event helped to establish long-lasting board-level commitment to security. His advice for boards is simple: talk to your CISO. Ask what they need. Ask how you can help. If that conversation happened in every boardroom, it could create the shift the profession has been waiting for. Takeaways CISO burnout is a governance issue, not a personnel issue. 63% of CISOs worldwide have experienced burnout. The role is set up to fail structurally: you are responsible for outcomes you don't control, you report to boards that see security as a cost centre and you are blamed when the risks you have flagged are not addressed. The risk acceptance letter is not a shield. When a CISO documents a risk, escalates it and gets it signed off, only to take the blame when something goes wrong, accountability without authority becomes a trap. Too many CISOs fall into this trap unwittingly. Protect the CISO to protect the organisation. A burned-out CISO develops risk blindness. When someone in your most critical security role leaves after six months, all their knowledge of your environment leaves with them. The revolving door itself is a vulnerability. Hack The Hague worked because commitment came from the top. Inviting 120 hackers to attack live city infrastructure in the middle of City Hall sounds radical. It worked because the council approved it. Start smaller – with a bug bounty programme or a responsible disclosure policy, for example – but get the buy-in first. One conversation can shift the dynamic. Boards don't need a new framework. They need to ask their CISO what they need and how they can help. Making the board the entity that owns the risk, rather than just the CISO, changes everything downstream. Subscribe to Follow the Rabbit If this episode has made you think about the weight that is being carried by one person in your organisation that was never designed to be carried by one person, share it. Subscribe on your preferred platform, leave a review and share it with every board member, CEO and security leader who still believes that CISO burnout is an HR issue. Links Jeroen Schipper – Chief Security Advisor, DEFION Security | Former CISO of The Hague | First-ever CISO of the Year, Netherlands | Linkedin Hack The Hague – Bug Bounty & Ethical Hacking Programme ENISA: NIS2 Directive – Board Accountability for Cybersecurity DORA – Digital Operational Resilience Act ISC²: CISO Burnout & Workforce Research

  ListenShow Notes
• 

  Follow the White Rabbit - IT Security Podcast - English Edition

  #10: 90 Minutes. One Laptop. Working Malware. AI Just Changed the Rules.

  Jul 2, 202624 min

  A security analyst experimented with a public AI, meticulously crafting malware capable of evading detection. This wasn't done by a nation state or a criminal gang; it was Northwave, a Dutch cybersecurity firm. Their CTO, Christiaan Ottow, a former ethical hacker, oversaw the experiment. In this episode of Follow the White Rabbit, Kofi Osae-Attah talks with Christiaan about the experiment's findings and his belief that we've reached a critical point he and his team predicted in September. Christiaan isn't an alarmist. He was skeptical of LLM hype, but the data changed his mind. His incident response team investigated a breach where they gained rare access to the attacker's staging server and found files documenting the AI's reasoning, plans, and execution steps. The attack used zero-day vulnerabilities, pivoted between cloud environments, and went undetected despite the victim having EDR and next-generation firewalls. The attacker didn't need hacking skills; they just needed to find a way around the AI's guardrails. This is the new baseline. The barrier to entry has collapsed, and attribution is becoming impossible as every threat actor uses the same models. The implications for defenders are stark, but Christiaan's advice is practical. Agentic AI isn't a competitive advantage; it's a baseline requirement. However, speed without structure is dangerous. Automated response needs a fine-grained authority matrix, prompt injection risks need to be engineered around, and most security teams are missing a complete, accurate inventory of their assets and identities. The organizations waiting for proof that this shift is real are about to get it. In the worst possible way. Takeaways: The inflection point has arrived. Christiaan's team predicted it would arrive in April 2026. It arrived on schedule: Anthropic's Mythos, GPT 5.5, and the first fully AI-driven attack investigated by their incident response team all occurred in the same month. AI attackers operate like an entire team. A human hacker has one area of expertise. An AI agent has them all simultaneously: software vulnerabilities, cloud misconfigurations, Windows environments, and identity exploitation. Attribution is becoming nearly impossible. Your defensive AI is also an attack surface. Prompt injection into agentic SOC systems poses a real threat. Treat your AI agent as you would software or a human employee: isolate it technically, provide guardrails, and explicitly train it on what it is allowed to do. Asset and identity inventory is now a top-tier security priority. Knowing what systems you have, what software they run, which API keys exist, and what permissions they carry used to be basic hygiene. Under AI-speed attacks, it's critical infrastructure for incident response. The question isn't whether AI changes the threat landscape. It already has. Run this thought experiment: What if the volume of attacks triples? What if the time between discovering a vulnerability and its exploitation is reduced to zero? If you can't answer these questions, you should. Subscribe to Follow the White Rabbit If this episode made the threat feel more concrete than it did an hour ago, then we've done our job. Subscribe on your preferred platform, leave a review, and share this episode with every CISO, SOC lead, and security engineer in your network. The gap between now and then is smaller than most defenders realize. Links: Christiaan Ottow , CTO, Northwave Cyber Security on Linkedin Kofi Osae-Attah Jr. | LinkedIn How AI-Driven Cyberattacks Are Changing the Threat Landscape in 2026 "The Day-Zero Normal" Rob Fuller · Chief Information Security Officer Anthropic: Project Glasswing & Mythos Preview MITRE ATT&CK: Agentic AI Threat Modeling Recommended book: The Art of Intrusion – Kevin Mitnick

  ListenShow Notes
• 

  Follow the White Rabbit - IT Security Podcast - English Edition

  #09: Hype vs. Reality: What AI in the SOC Actually Looks Like

  Jun 17, 202622 min

  Right now, everyone's selling AI-powered security operations. The pitch sounds great: faster detection, smarter triage, and less noise. However, if your logging is disorganized, your playbooks don't exist, and no one is responsible for the process, AI won't improve your SOC. It'll just make it faster at doing the wrong thing. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Erik Van Buggenhout, NVISO co-founder and SANS instructor, to cut through the hype and discuss what AI in the SOC looks like in practice. Erik is an AI optimist but, more importantly, he's a realist. He has spent years building security operations at scale and knows exactly where automation succeeds and where it falls short. His take? Up to 70% of incoming alerts can be automated without AI. Static playbooks, when built and maintained properly, do most of the heavy lifting, cheaply and reliably. AI earns its place where context matters, such as in dynamic environments, nuanced triage, and situations where a rigid playbook runs out of answers. The sweet spot isn't AI everywhere. It's AI where judgment is needed and automation everywhere else. However, the conversation goes deeper than tools. Who's accountable when an AI agent makes a wrong decision? What will happen to the career path of junior analysts when L1 work disappears? Why does the security industry keep rebranding the same problems with new buzzwords every three years? Erik doesn't sugarcoat any of it, which is exactly what makes this episode worth your time. Takeaways: AI won't fix a broken SOC. Garbage in, garbage out—faster. Before buying any AI tooling, first sort out your log sources, processes, and ownership. Seventy percent automation is already possible without AI. Static playbooks that are properly maintained can handle most of the alert volume. AI is the next layer, not the foundation. AI genuinely adds value through context. Managed service providers can't know every customer environment in detail. AI coupled with retrieval-augmented generation can provide that context on a large scale without requiring humans to memorize everything. Humans remain accountable. AI agents operate with identities and permissions, but responsibility ultimately rests with the person operating them. Having a human in the loop isn't optional; it's a structural necessity. The industry's buzzword cycle is exhausting and confusing. SIEM became XDR, and now XDR is becoming AI SOC. Same problem, new name. Erik argues for a more pragmatic and less dramatic approach to what's actually changing. Listen in and subscribe to Follow the White Rabbit. If this episode made you think twice about that AI SOC pitch in your inbox, good! Subscribe on your preferred platform and leave a review. It only takes 30 seconds, and it helps us reach those who need to hear this the most. Share it with your security team, your CISO, or anyone who's been handed an AI tool without a plan. Links: You'll find Erik on Linkedin and here more about NVISO . If you want to dive deeper: SOC-CMM – SOC Capability Maturity Model SANS Institute – Purple Teaming & SOC Courses MITRE ATT&CK – Detection & Response Framework Gartner on AI in Security Operations (2024)

  ListenShow Notes
• 

  Follow the White Rabbit - IT Security Podcast - English Edition

  #08: AI Isn't Just Changing How We're Attacked. It's Changing What We Believe Is Real.

  Jun 3, 202633 minS0

  <p>Most security teams are having the AI conversation about faster phishing, smarter malware, and automated attacks. However, a larger shift is occurring that barely makes it onto SOC dashboards. AI is now being used to industrialize disinformation on a scale no human-run operation could ever match. There are millions of AI agents, with no upper limit on volume, and the public can't tell what's real anymore. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah sits down with Anett Mádi-Nándor, president of the Women4Cyber Foundation and CEO of CyEx.hu, to discuss the in...

  ListenShow Notes
• 

  Follow the White Rabbit - IT Security Podcast - English Edition

  #07: Your Next Hire Might Be a North Korean Spy

  May 21, 202627 minS0

  <p>North Korea is infiltrating Fortune 500 companies with fake employees. They create authentic LinkedIn profiles, excel in remote interviews, collect salaries, and secretly steal intellectual property, cryptocurrency, and system access. This isn't a future threat. It's happening right now across more than 40 countries. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah sits down with Kritika Roy, a senior threat intelligence researcher at DCSO in Berlin. Together, they map the threat landscape that most security teams only partially see.</p><p>Kritika's work sits at the intersection of geopolitics and cybersecurity — and that intersection is where the fu...

  ListenShow Notes

Recent guests on Follow the White Rabbit - IT Security Podcast - English Edition. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.