STATUS: SECURE – The Cyber Threat Briefing

You cannot be secure if you do not know the threat. On the battlefield, the ability to communicate securely isn't a "nice to have"—it is the difference between life and death. In business, it is the difference between solvency and bankruptcy. Welcome to Status: Secure , the weekly cyber threat briefing for executives who refuse to operate in the blind. Hosted by the WatchUr6 collective, this show unites the battlefield with the boardroom. Featuring former Army Special Forces and Naval Special Warfare communications operators alongside an industry-leading CISO nominated for Cybersecurity Woman of the World . Each week, we decode the latest threats targeting Healthcare, Government Contracting, Finance, and Tech, and give you the tactical playbook to keep your lines open and your data secure. The enemy is listening. Is your status secure?

STATUS: SECURE – The Cyber Threat Briefing is a business podcast hosted by WatchUr6 - Cybersecurity, with 27 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

WatchUr6 - Cybersecurity hosts STATUS: SECURE – The Cyber Threat Briefing, a business show with 27 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #28

  028 The Meta Child-Safety Ruling, Ethical AI, and Insider Threats: A Briefing for Both Sides

  Aug 18, 202632 min

  This week's briefing comes down to one word: trust. Three stories that look separate and turn out to be the same story. We open with the largest child-safety ruling against a social media company to date — a New Mexico judge ordering Meta to pay an additional $567 million, bringing the total to $942 million, for allowing bad actors to operate on its platform. The judge called Meta a "public nuisance," comparing the platform to a polluting factory. Meta disagrees and is appealing. But the security lesson stands: platform security isn't only about the hackers outside your walls — it's about who you allow to operate inside them. From there, our CISO takes us one layer down into the ethics of AI and the integrity problem — why the "I" in the CIA triad is the security pillar quietly breaking in the AI era, and the four rules that keep an AI system honest so it can't lie to you even by accident. Then the big one: what the historic wave of layoffs means for insider threat. Why most insider incidents involve people already on their way out, why disabling an email address is nowhere near enough, and how a forgotten account can get your cyber-insurance claim denied. And finally, the other side of the briefing — a direct word to anyone who's been laid off about why retaliation turns a grievance into a criminal act, and how to redirect that energy instead. Intel Declassified in this Briefing: [00:32] The Meta child-safety ruling — $567M more, $942M total, and why it's a security story about who operates inside your walls. [03:36] Ethical AI and the integrity problem — the CIA triad and the four rules of trustworthy AI. [08:13] Three moves to keep your platform and AI on the right side of trust — plus the customer-service AI asked how to build a bomb. [12:02] Insider threat and the layoff wave — the three categories of insider risk and the $19.5M price tag. [16:52] The departure window — 245,953 tech layoffs in 2025 and why the 30 days around an exit are the most dangerous. [19:42] Why offboarding fails — the 83% who keep access, and the denied insurance claim. [22:34] A word to the laid off — don't turn a grievance into a criminal act. Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/028-meta-child-safety-ruling-ethical-ai-insider-threats/ Read the Associated Sitrep: How Trustworthy Is Your AI? A Data Integrity Standard for Your Organization: https://watchur6.com/sitrep/compliance-protocols/how-trustworthy-is-your-ai-data-integrity-standard/

  ListenShow Notes
• 

  Episode #27

  027 The Minnesota Water Hack, AI Threats at Black Hat, and the Case for Age Limits on AI

  Aug 11, 202630 min

  This week we went off script. Our CISO called in from the floor of Black Hat in Las Vegas — where she'd been invited to speak on AI and child privacy — for a wide-ranging briefing on the threats defining right now. We open with the Iranian-affiliated cyberattack that knocked a Minnesota water utility onto manual operations. The headline sounds sophisticated. The reality is the opposite: the attackers didn't break anything clever. They walked in through factory default passwords nobody changed, then locked out the real operators. The drinking water stayed safe, the blast radius was small — but the lesson is enormous, because it's the same one that applies to your organization. The most preventable vulnerability is the one you already know how to fix and haven't. Then we take you onto the Black Hat floor, where one topic swallowed everything else: securing AI. Five startups pitched a CISO panel and all five were about AI. We get into the shift from AI assistants to autonomous agents, the "how do you protect what you don't know you have" problem, and the CISO's three biggest current threats. And we close on her sharpest take of the year — that AI and social media, like driving and drinking, are dangerous enough to warrant age limits. The through-line from a water tower to a frontier AI model is the one this show returns to every week: the basics still win. Intel Declassified in this Briefing: [00:32] The Minnesota water attack — what happened, and why water is historically a hard target. [02:36] "They're testing us" — the magician's-misdirection problem with nation-state probing. [06:41] Impact and blast radius — why the security world didn't panic over this one. [08:36] Factory default passwords — the front door left open, and how the attackers walked in. [12:42] Live from Black Hat — why every startup in the room is racing to secure AI. [16:44] The three threats that matter most — ethics-free attackers, agents with no judgment, and a generation with no privacy. [21:41] The case for age limits on AI — the driving-and-drinking argument for gating dangerous technology. Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/027-minnesota-water-hack-black-hat-ai-age-limits/ Read the Associated Sitrep: The Agentic AI Security Gap — Governing Autonomous AI Before It Governs You: https://watchur6.com/sitrep/threat-intelligence/agentic-ai-security-gap-governance-guardrails/

  ListenShow Notes
• 

  Episode #26

  026 World Leaks Extortion, Quishing Attacks, and Inside the Latest Health-ISAC Threat Briefing

  Aug 4, 202622 min

  This week our CISO takes you somewhere most healthcare leaders never get to go — inside a nationwide Health-ISAC threat briefing, the healthcare sector's own member-only intelligence-sharing call, including a business continuity exercise run across more than 500 organizations. First, the two threats the sector is tracking right now. World Leaks, a data-theft extortion group that steals your data and leaks or sells it whether or not you pay, which means your backups won't save you. And quishing — QR-code phishing, alongside ClickFix and FileFix — social-engineering attacks that slip past your filters because a QR code is an image, not a scannable link, and the payload only resolves when someone scans it on a personal phone outside your controls. Then the part you can't get anywhere else: a firsthand readout of a sector-wide business continuity exercise, where a shared cloud identity provider goes down and takes much of healthcare with it. How long can you limp along on manual workarounds? Where are you in the incident-response queue when a hundred other organizations need the same responders? And why does patient safety set the recovery priority for the entire sector? The throughline: you were never meant to defend alone. Intel Declassified in this Briefing: [01:06] World Leaks and the extortion model that ignores your industry — and why backups don't save you from a leak. [03:51] Quishing, ClickFix, and FileFix: how QR-code attacks beat the URL filters that stop traditional phishing. [05:32] Three moves against both threats — treat QR codes like unknown links, assume the breach is a leak, and plug into your sector's ISAC. [06:59] What Health-ISAC actually is, why you can't just join, and the 1,200-plus alerts it sent the sector last year. [09:00] Why healthcare cyber is patient safety, not IT — the prescription that can't reach the pharmacy and the hospital with nowhere to divert. [11:16] The exercise: when a shared cloud identity provider goes down and takes the sector with it, and the incident-response queue nobody plans for. [16:22] Teach the teacher — vary who runs your continuity exercise, build a threat-intel program, know where you rank, and why it always comes back to people. Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/026-world-leaks-quishing-health-isac-threat-briefing/ Read the Associated Sitrep: When the Cloud Goes Down for Everyone — Business Continuity Planning for Healthcare's Shared-Vendor Risk: https://watchur6.com/sitrep/mission-resilience/healthcare-business-continuity-shared-cloud-vendor-risk/

  ListenShow Notes
• 

  Episode #25

  025 Data Extortion, Credential Attacks, and the New HIPAA Security Rule Every Executive Must Know

  Jul 28, 202615 min

  Ransomware evolved, and the evolution invalidates a defense most healthcare organizations still rely on. Attackers stopped just encrypting your data and started stealing it first. You can pay, restore from backup, and still watch your patient records get sold. The backup that used to be your leverage now solves half the problem. And they're not breaking in to do it. They're logging in — using credentials harvested at industrial scale and AI-written phishing that has none of the tells your staff was trained to catch. Healthcare is absorbing 2.3 ransomware attacks a day and has carried the most expensive breaches of any industry for fourteen straight years. The government's response is the first major HIPAA Security Rule overhaul since 2013 — and it kills the word that let organizations defer their most expensive controls for two decades: addressable. Intel Declassified in this Briefing: [00:33] The Ransomware Evolution: Why steal-and-extort broke the backup defense, and what it means when restoring your systems doesn't un-leak your patient data. [01:34] The Log In, Don't Break In Economy: 24 billion exposed credential records, AI-assisted phishing in 40 to 56 percent of sampled emails, and the Exchange flaw compounding both. [03:06] The Lock on the Door: Why credential attacks are just physical social engineering transplanted — attackers don't pick the lock, they take your keycard. [04:25] Back to the Basics: Phishing-resistant MFA on every account touching sensitive data, knowing where your data lives and minimizing it, and the gap between the patch cycle you claim and the one you run. [06:36] The New HIPAA Security Rule: The first overhaul since 2013, why Change Healthcare and 2.3 attacks a day forced it, and the elimination of required versus addressable. [09:16] What Becomes Mandatory: Encryption, MFA, segmentation, asset inventory and network map, scanning, pen testing, and 72-hour restoration — plus where our CISO thinks the rule's own floors are too low. [13:05] The Marching Orders: Run the risk analysis and map your data flows, reopen every addressable gap you deferred, and actually verify your business associates. Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/025-data-extortion-credential-attacks-new-hipaa-security-rule/ Read the Associated Sitrep: The HIPAA Security Rule Overhaul — A Readiness Roadmap for Healthcare Before the Clock Starts: https://watchur6.com/sitrep/compliance-protocols/hipaa-security-rule-overhaul-readiness-roadmap/

  ListenShow Notes
• 

  Episode #24

  024 The CMMC Phase II Suspension: What Defense Contractors Need to Do Now

  Jul 21, 202614 min

  Two days after we walked defense contractors through the CMMC certification timeline, the Department of War suspended Phase II. So we broke format for a rapid-response briefing. On July 13, 2026, the Department suspended the mandatory third-party C3PAO certification requirement that was set to take effect November 10 — effective immediately, across pending and future solicitations and contracts — and launched a 60-day review under a new CMMC Reform Task Force. Here is the part contractors are about to get wrong. The government paused a certification mechanism. It did not pause your obligation to protect federal data. Phase I self-assessments are still in place. NIST SP 800-171 and the 110 controls are still the standard. DFARS 252.204-7012 still binds you. And with third-party verification suspended, the accuracy of your own self-attestation is now your primary False Claims Act exposure, not a lesser one. "Suspended" is not "safe." It is breathing room. And the contractors who use it to get genuinely secure will be ready when the reformed program lands. Intel Declassified in this Briefing: [00:32] What the Department of War Announced: The immediate suspension of CMMC Phase II, the paused November 10 deadline, and the 60-day review under the new CMMC Reform Task Force. [02:20] The RFI Window: Why the Department CIO's Request for Information form is your chance to tell the government what the compliance burden actually looked like from a small business's side. [04:13] What Did NOT Change: Phase I self-assessments, the 110 NIST 800-171 controls, DFARS 252.204-7012, the government's right to audit, and False Claims Act exposure — all fully intact. [07:21] The C3PAO Bottleneck: How a limited assessor pool plus a hard deadline created a pricing squeeze on small businesses, and why Phase II is coming back regardless. [08:54] If You Were Mid-Certification: Why the right move is to breathe and spend deliberately rather than stop — and why you have time, but not forever. [11:05] The Marching Orders: Be honest about your self-assessment, close your gaps, submit the RFI, and watch the 60-day clock. Slow is smooth, smooth is fast. Mission Links: Verify your Security Posture: https://watchur6.com/secure Want to Hire us: https://watchur6.com/contact/ View the Show Notes: https://watchur6.com/podcast/024-cmmc-phase-2-suspension-what-defense-contractors-do-now/ Read the Associated Sitrep: CMMC Phase II Suspended — What the Department of War's Announcement Actually Means for Defense Contractors: https://watchur6.com/sitrep/compliance-protocols/cmmc-phase-2-suspended-what-it-means-defense-contractors/

  ListenShow Notes

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.