SEC.co Podcast

A podcast about latest trends, techniques and learnings in cybersecurity and cyberdefense.

SEC.co Podcast is a business podcast hosted by Unknown Host, with 0 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Unknown Host hosts SEC.co Podcast, a business show with 0 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  SEC.co Podcast

  Initial Access Vectors You're Probably Ignoring in Your Security Plan

  Aug 19, 20269 min

  Strong endpoint detection, a tuned SIEM, and regular phishing simulations can still leave an organization dangerously exposed — if the less glamorous entry points never make it onto the threat model. This episode of Cybersecurity examines six initial access vectors that consistently survive risk assessments, escape budget conversations, and go undetected until it's too late. The discussion is grounded in this deep-dive on overlooked cybersecurity access vectors , and the insights apply whether you're running a lean security team or a mature enterprise program. Here's what the episode covers across the six vectors: API keys in public code repositories — How developer time pressure leads to committed secrets, why orphaned repos keep credentials alive long after a project ends, and what a layered fix looks like: pre-commit hooks, retroactive repo scanning, and pipeline-integrated key rotation. Dangling DNS records and subdomain takeovers — How deprovisioned cloud resources paired with forgotten CNAME entries hand attackers a legitimately-branded subdomain requiring no exploit — just a DNS lookup tool and patience. Quarterly zone audits and least-privilege DNS management are the prescription. Malicious OAuth consent flows — Why a look-alike OAuth app requesting broad permission scopes can grant persistent API access that survives password resets, and how to regain visibility: approved-publisher whitelisting, consent-event monitoring, and targeted end-user training. Shadow IT and unsanctioned SaaS — The risk that unauthorized workspaces (Notion, Figma, Trello, and dozens of others) create a lateral-movement foothold invisible to traditional asset scans, and why reducing friction — rather than just adding policy — is the politically sustainable solution. Unmanaged IoT and embedded office devices — Printers, badge readers, smart TVs, and conference room cameras running outdated firmware with factory-default credentials can serve as command-and-control pivot points. Proper network segmentation, NAC policies, and vendor advisory subscriptions are the baseline. Social engineering through customer support channels — Attackers who call the help desk armed with just enough context to sound credible exploit rep incentives built around speed. Out-of-band verification paths, call auditing, and positive reinforcement for flagging suspicious requests all help shift the culture. The episode closes by tying all six vectors to a single root cause: assets and processes that fell off the inventory. The recommended mindset shift — building a living, automated inventory across repositories, DNS zones, SaaS applications, IoT devices, and human workflows, with clear ownership and accountability — reframes threat modeling to ask not just where are we defended , but where would an attacker go if those defenses weren't there ? For more from the show on what happens after an attacker gets in, listen to Post-Exploitation Tactics That Still Work in 2025 . SEC

  ListenShow Notes
• 

  SEC.co Podcast

  Post-Exploitation Tactics That Still Work in 2025

  Aug 18, 20269 min

  Sophisticated breaches rarely hinge on novel zero-days. More often, they succeed because a handful of well-worn post-exploitation techniques continue to find gaps in enterprise defenses — year after year. This episode of Cybersecurity draws on this in-depth look at post-exploitation tactics still working in 2025 to examine exactly which methods attackers keep reaching for, why they remain effective, and what defenders can do beyond just alerting. The episode walks through six tactics — each paired with actionable defensive guidance — covering the full arc from initial foothold to cloud-native lateral movement: Living-off-the-Land Binaries (LOLBins): Attackers are chaining pre-installed, code-signed Windows tools — including WSL and IPv6-aware utilities — to blend into normal admin activity and bypass legacy egress filters. Defenders need behavioral baselines and auto-containment, not just alerting. Kerberoasting in hybrid identity environments: Syncing on-premises Active Directory with Azure AD gives attackers a bridge from an offline-cracked ticket straight into cloud control — often bypassing MFA entirely. Group Managed Service Accounts and Azure AD risk policies are the core mitigations. Cloud control-plane token theft: Cached CLI credentials and buried token files on developer workstations open a window for rapid cloud resource abuse and exfiltration before billing alerts fire. Near-real-time log streaming and just-in-time role assignment close the lag attackers depend on. Bring-Your-Own-Driver EDR tampering: Sideloading a legitimately signed but vulnerable kernel driver can blind or crash EDR agents without triggering OS-level warnings. Kernel Mode Code Signing enforcement and automated vulnerable-driver hash checking are essential countermeasures. Adversary-in-the-Middle phishing against MFA: Modern AiTM kits proxy real authentication sessions to harvest valid post-MFA cookies — some now using vision APIs to self-correct in real time. FIDO2/passkey adoption and device-posture-aware Conditional Access policies are the most durable defenses. SaaS-to-SaaS lateral movement via OAuth: Over-permissive OAuth grants between sanctioned apps let attackers hop from a low-value marketing tool to a financial data warehouse through calls that look entirely legitimate on the wire. Full OAuth inventory, least-privilege scope enforcement, and SaaS Security Posture Management (SSPM) provide the needed visibility. The episode closes by identifying the common thread across all six tactics: attackers exploit organizational gaps — between cloud and on-premises, between identity stores, between telemetry and analytics — not just technical vulnerabilities. The key takeaways center on response speed over tooling sophistication, unified telemetry with identity context, and automating repetitive security hygiene so teams can focus on hunting and strategy. For more on defending against advanced evasion techniques, listen to Payload Detonation in Cloud Sandboxes: Evasion Tactics and Defenses , a related episode exploring how attackers bypass cloud-based analysis environments. SEC

  ListenShow Notes
• 

  SEC.co Podcast

  Payload Detonation in Cloud Sandboxes: Evasion Tactics and Defenses

  Aug 17, 20268 min

  Cloud sandboxes are one of the most powerful tools in a defender's arsenal — but they come with a critical blind spot. Threat actors have systematically reverse-engineered how sandbox detonation works, embedding evasion logic directly into production malware to slip past automated analysis undetected. This episode of Cybersecurity examines the ongoing arms race between sandbox technology and the adversaries who exploit its limitations, drawing on the cloud sandbox evasion and defense analysis published by SEC. Here's what the episode covers: How cloud sandboxes work — isolated, short-lived virtual machines that detonate suspicious files or URLs, log every system call and network event, and score behavior before anything reaches a production environment. Time-based evasion — malware families that exploit short detonation windows using sleep loops, exponential back-off timers, and CPU-tick checks to stay dormant until the sandbox gives up. Environment fingerprinting — pre-execution checks that look for hypervisor driver signatures, minimal hardware profiles, generic MAC addresses, sequential hostnames, and the absence of real user artifacts like browser history or open documents. Staged payload delivery — lightweight loaders that appear benign during detonation, only pulling down the actual malicious second stage after the sandbox window has closed — often over HTTPS or legitimate cloud storage APIs. Defensive countermeasures — rotating across multiple VM templates and hypervisor backends, hardening sandbox images with realistic hardware specs and user artifacts, and injecting human-like mouse and keyboard activity to defeat fingerprinting checks. Closing the intelligence loop — cross-referencing sandbox telemetry against threat intelligence feeds and routing enriched signals into a TIP, SIEM rules, and endpoint detection policies in near real time. The episode's central argument is that sandboxes remain indispensable — but treating them as a definitive clean bill of health is the exact assumption attackers rely on. Continuous tuning, layered analysis, and a commitment to VM realism are what separate security teams that stay ahead of the evasion curve from those that don't. For more on protecting critical infrastructure from ransomware-class threats, check out the earlier episode Object Lock and Air-Gapped Backups: Building Ransomware-Proof Storage . SEC

  ListenShow Notes
• 

  SEC.co Podcast

  Object Lock and Air-Gapped Backups: Building Ransomware-Proof Storage

  Aug 16, 20268 min

  Ransomware's most reliable kill shot isn't encryption — it's destroying your ability to recover without paying. This episode of Cybersecurity tackles the two storage controls that directly neutralize that strategy: Object Lock and air-gapped backups. Drawing on this in-depth guide to immutable storage and ransomware resilience , the episode walks through how these controls work together, where teams most commonly get them wrong, and what a real recovery workflow looks like when they're implemented correctly. Here's what the episode covers: What immutability actually means — enforcement at the storage layer, not in a policy document, so compromised credentials and tired administrators hit the same wall as attackers. Object Lock modes explained — the difference between compliance mode (an absolute, administrator-proof retention window) and governance mode (auditable exceptions for documented business needs), and when to choose each. Retention period design — why setting the window too short can leave you with no clean restore points if ransomware was quietly lurking before it detonated, and how to find the right balance between recovery objectives and storage costs. Legal holds as a noisy safeguard — why holds need clear start events, documented owners, and clean close-outs, or they become a compliance liability of their own. Air gaps — physical and logical — how offline tape vaults and isolated cloud accounts with one-way data flow both achieve the same goal: forcing an attacker to cross a heavily monitored boundary before reaching your clean copies. Chain of custody from write to restore — authenticated writes into locked buckets, controlled cross-boundary transfers, tamper-evident logging at every hop, and why rehearsing a real recovery (not a slide deck) is the only way to build the muscle memory that matters on an actual incident day. The episode also covers practical pitfalls: why snapshots alone aren't a strategy, how small infrastructure-as-code misconfigurations can silently undermine retention modes, the case for dual-control approvals on any change that could weaken backup posture, and how to frame these investments clearly for leadership. If your incident response plan still relies on backups that a compromised administrator account could wipe, this episode is a direct challenge to fix that before it's tested under fire. For more on detecting adversary infrastructure, check out the episode Mapping C2 Tunnels Without Deep Packet Inspection . More resources and the full written companion to this episode are available at SEC .

  ListenShow Notes
• 

  SEC.co Podcast

  Mapping C2 Tunnels Without Deep Packet Inspection

  Aug 15, 20269 min

  Command-and-control traffic increasingly hides in plain sight — riding unusual ports, masquerading inside encrypted sessions, and deliberately blending into the background noise of modern cloud-heavy networks. This episode of Cybersecurity draws on this detailed guide to detecting C2 tunnels on non-standard ports and protocols to explain how defenders can map covert channels without ever performing deep packet inspection. The core argument is both practical and empowering: you don't need to read the message to identify the messenger. The episode walks through why attackers favor non-standard ports — buying time for lateral movement and exfiltration — and then lays out a layered detection methodology built entirely on behavioral and metadata signals. Here's what's covered: Flow record analysis: How NetFlow and IPFIX act as compact conversation summaries, revealing session timing, byte asymmetry, and repeating endpoint pairs without touching payload content. Beaconing and timing fingerprints: Why consistent check-in intervals — even with jitter applied — are statistically hard to disguise, and how simple summary statistics can surface them at scale. Packet and flow size patterns: How small, rhythmic client-to-server bursts paired with sporadic large return flows can indicate command pull and result push activity. TLS handshake metadata: Using JA3/JA4 fingerprinting and certificate characteristics (short validity, self-signed chains) to flag unusual encrypted sessions before any content is examined. DNS and QUIC telemetry: How query volume spikes, randomized subdomain patterns, and NXDOMAIN storms sketch the outline of a tunnel — and why QUIC still leaves detectable breadcrumbs despite early encryption. Correlation, asset context, and triage workflow: Why a single clue is a lead but three agreeing clues form a case — and how tagging endpoints by business role separates genuine threats from benign automation. The episode also covers visualization techniques for turning flow logs into graph-based anomaly maps, guidance on maintaining baselines that don't rot over time, and a controlled containment approach that lets analysts prove or disprove a C2 hypothesis through behavior rather than payload analysis. Common pitfalls — over-fitting on a single signal type, mistaking approved automation for malware, and under-labeling assets — each get their own treatment. Looking ahead, the discussion addresses how encrypted client hello and the continued spread of QUIC will raise the bar, and why the most durable defensive advantage is a disciplined habit of adapting telemetry collection and cross-team correlation to whatever comes next. More from the show: if you're working through governance and compliance alongside your detection engineering, our episode on NIST 800-53 vs. ISO 27001: Choosing the Right Security Framework pairs well with this one. SEC

  ListenShow Notes

Recent guests on SEC.co Podcast. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.