The Art of Security

Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries.In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape.While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment.Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.

The Art of Security is a technology podcast hosted by Fortra, with 21 episodes on record and a Required Pod Score of 80.

Fortra hosts The Art of Security, a technology show with 21 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #16

  Are You Making It Too Easy for Cyberattackers?

  Sep 30, 202637 minS1

  Most attacks do not succeed because the attacker developed a brilliant new technique. They succeed because exposed information, weak processes, insecure credentials, and avoidable shortcuts give attackers an easier path. For Cybersecurity Awareness Month, Josh Davies and Tyler Reguly examine how individuals, employees, security teams, leaders, and small businesses can introduce more friction into an attack. The goal is not to become invincible. It is to make every step more expensive, time-consuming, and risky for the attacker. In this episode of The Art of Security podcast, you'll learn: How reducing public information exposure can limit phishing, impersonation, and social engineering opportunities Why call screening, independent verification, and stronger MFA can interrupt common attack workflows How deception engineering, canary files, application allowlisting, and restricted PowerShell access create attacker friction Why security culture must empower employees to question unusual requests, regardless of the apparent sender's rank How small businesses can close significant security gaps without building a full internal security team Listen now to learn how small, practical security decisions can make you a much less attractive target. And make sure to subscribe so you don't miss out on any cyber insights!

  ListenShow Notes
• 

  Episode #15

  Security Theater: Feeling Safe vs. Being Secure

  Sep 16, 202633 minS1

  What happens when cybersecurity programs prioritize visible activity over meaningful risk reduction? Security theater can reassure executives and end users, but that reassurance becomes dangerous when dashboards, checkbox compliance, and inflated metrics distract teams from the controls that actually reduce exposure. In this episode of The Art of Security , Josh Davies and Tyler Reguly examine the line between communicating security effectively and merely performing it. They challenge conventional thinking about security metrics, product marketing, threat hype, compliance, and the pressure to make security programs look productive. Key takeaways Why activity metrics such as alerts triaged, vulnerabilities patched, and detections created may not reflect improved security How threat hype and named vulnerabilities can redirect limited resources away from higher-priority risk Why security visibility and clearly assigned asset ownership provide a stronger foundation for meaningful measurement How security teams can demonstrate control effectiveness without relying on checkbox compliance or misleading ROI calculations Security should create confidence because controls are validated, assets are monitored, and responsibilities are clear, not because a dashboard looks impressive. Like the video if the discussion challenged how you measure security Tell us which cybersecurity metrics your team finds genuinely useful Subscribe for practical conversations with cybersecurity practitioners and researchers

  ListenShow Notes
• 

  Episode #14

  CalPhishing: When Calendar Invites Become the Lure

  Sep 2, 202638 minS1

  Calendar invites have become part of the trusted infrastructure of daily life, and attackers are taking advantage. In this episode, the team examines the resurgence of CalPhishing, an attack technique that uses legitimate calendar workflows, HTML content, attachments, spoofed organizers, and trusted platforms to evade defenses and compromise accounts. Fortra security engineer and FIRE team member Daud Jawad joins hosts Josh Davies and Tyler Reguly to break down the calendar phishing techniques reaching users today. They explore why these attacks can bypass traditional email security controls, how trusted workflows lower users' defenses, and why organizations may need to reconsider how they process and test calendar invitations. Key takeaways How attackers use calendar invite bodies, HTML attachments, spoofed organizers, and legitimate vendor infrastructure to deliver phishing lures Why CalPhishing can evade email authentication, filtering, browser protections, and other established security controls How calendar-based attacks can target credentials, session tokens, OAuth consent, device codes, and trusted internal workflows How organizations can reduce exposure through calendar processing controls, user education, cross-channel verification, and calendar-based phishing simulations Read Daud's related blog on Fortra.com Don't let the next threat sneak onto your calendar. Subscribe to The Art of Security podcast.

  ListenShow Notes
• 

  Episode #13

  AI-Powered Red Teaming: Where Automation Works and Where It Falls Short

  Aug 19, 202633 minS1

  AI can accelerate red team operations, but how much autonomy is too much when production systems and sensitive data are at stake? In Episode 13 of The Art of Security , co-host Josh Davies speaks with Pieter Ceelen of Fortra's Outflank and Cobalt Strike red teams about the opportunities and risks surrounding AI-powered red teaming. They examine where AI can strengthen adversary simulation, why fully autonomous testing demands caution, and how rules of engagement must evolve as AI becomes part of offensive security operations. The conversation explores: Where AI can support reconnaissance, vulnerability research, initial access, reporting, and post-exploitation analysis Why human oversight remains critical in sensitive and production environments How red teams can balance automation, operational risk, and potential reward Whether AI will change the skills needed by the next generation of penetration testers How AI could reshape vulnerability discovery, zero-day research, and the ongoing contest between attackers and defenders Listen to the full episode for a practical perspective on using AI to advance red team operations without losing sight of judgment, accountability, or risk.

  ListenShow Notes
• 

  Episode #12

  Lights, Camera, Cyberattack: What Hollywood Gets Right and Wrong About Hacking

  Aug 5, 202640 minS1

  Hollywood can turn a cyberattack into glowing graphics, frantic typing, and total system control in seconds. But beneath the technical nonsense, hacker movies sometimes capture something real about cybersecurity. In this episode of The Art of Security , co-hosts Josh Davies and Tyler Reguly revisit hacker movies and shows including Hackers , WarGames , Sneakers , Mr. Robot , The Matrix Reloaded , and more. They examine what Hollywood gets right, what it gets spectacularly wrong, and the real-world security lessons hiding behind the drama. The conversation explores: Why Hackers remains a cybersecurity cult classic Whether hackers can really control traffic lights and broadcasts How real security tools and techniques appear on screen Why fictional hackers have inspired generations of practitioners Are hacker movies helping audiences understand cybersecurity, or have they been teaching us the wrong lessons all along? Listen now, then tell us : Which hacker movie gets cybersecurity right, and which one gets it completely wrong? Make sure to subscribe now so you don't miss any episodes!

  ListenShow Notes

Recent guests on The Art of Security. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.