Best Cyber Assurance Podcasts (2025)

1
Social engineering served sunny-side up. 48:57

Play Pause

4d ago48:57

48:57

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are ma…

1
Tools, Tools, Tools 39:01

5d ago39:01

39:01

If you are an MSP, there is probably at least one tool in both the physical space and the digital space that you were just awestruck when you finally got your hands on it. I sit down with Charles Love of ShowTech Solutions to talk about some tools from the wayback days and how the tools today are in some ways truly transformational in how they save…

1
Waterfall Software Development Method (noun) [Word Notes] 6:25

6d ago6:25

6:25

Please enjoy this encore of Word Notes. A software development model that relies on a series of sequential steps that flow into each other, like a series of waterfalls. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/waterfall-software-development⁠ Audio reference link: “⁠Creating Video Games - Agile Software Development,⁠” by Sara Verr…

1
Scammers hit the right notes in the wrong way. 49:06

11d ago49:06

49:06

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We s…

1
Getting Clients To Take Cybersecurity Seriously 36:31

13d ago36:31

36:31

How do you get your clients to take cybersecurity seriously? I sat down with Ann Westerheim of Ekaru to discuss strategies for helping MSP clients improve their cybersecurity posture.

1
Agile Software Development Method (noun) [Word Notes] 7:45

14d ago7:45

7:45

Please enjoy this encore of Word Notes. A software development philosophy that emphasizes incremental delivery, team collaboration, continual planning, and continual learning CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/agile-software-development⁠ Audio reference link: "⁠Velocity 09: John Allspaw and Paul Hammond, "10+ Deploys Pe,⁠" …

1
This scam is now in session. 45:05

19d ago45:05

45:05

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Joe's sto…

1
Compliance and GTIA Cybersecurity Trustmark 18:02

20d ago18:02

18:02

Getting to compliance... Do you end up with more to do because you have the GTIA Cybersecurity Trustmark Assured? I sit down with Chase Griffin with ShowTech Solutions to talk about their experience and what has transpired since achieving Assured status and how that changed their outlook on improving their compliance to a standard and setting them …

1
Pegasus (noun) [Word Notes] 8:45

21d ago8:45

8:45

Please enjoy this encore of Word Notes. The flagship product of the controversial Israeli spyware vendor, the NSO Group, use for remotely hacking mobile devices, most notably iPhones, via zero-click exploits. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/pegasus⁠ Audio reference link:⁠“Cybersecurity beyond the Headlines: A Conversatio…

1
Yeti or not, it’s a scam. 50:20

26d ago50:20

50:20

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some …

1
A Client's Journey Through Ransomware 41:22

27d ago41:22

41:22

When a client is hit with ransomware, it can be paralyzing. After the tabletop exercises carried out at #ChannelCon25, Jason Comstock of Clarity Technology Solutions explored ransomware and the path to recovery. Stay tuned to the end for Jason's after-action report.

1
Work from home, malware included. [OMITB] 32:14

27d ago32:14

32:14

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠⁠Selena Larson⁠⁠⁠, ⁠⁠⁠Proofpoint⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠DISCARDED⁠⁠⁠. Inspired by the residents of a building in New York’s exclusive upper west side, Selena…

1
Domain-based Message Authentication Reporting Conformance (DMARC) (noun) [Word Notes] 8:27

28d ago8:27

8:27

Please enjoy this encore of Word Notes. An open source email authentication protocol designed to prevent emails, spoofing in phishing, business email compromise or BEC, and other email-based attacks. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/pegasus⁠ Audio reference link:"⁠Global Cyber Alliance's Phil Reitinger talks DMARC adoptio…

1
Click for a pay bump? 30:17

1M ago30:17

30:17

In this special episode of Hacking Humans, while Joe and Maria take a well-earned summer break, we’re joined by a special guest host: Rob Allen, Chief Product Officer at ThreatLocker. Rob dives into the tactics and profile of the cybercriminal group known as Scattered Spider—a crew that’s gained notoriety for its cunning use of social engineering o…

1
Reflect on TD Community PreDay 26:25

1M ago26:25

26:25

With more than 100 attendees for a full day of networking and learning. The TD preday and another 30+ next door for MSP-Ignite peer group facilitated discussions, it was a learning and growing experience for all. I sat down with Roddy B. of ShureWeb to get his take and perspective. We went off script a few times, and I'll be sure to bring some more…

1
Shields Up (noun) [Word Notes] 7:46

1M ago7:46

7:46

Please enjoy this encore of Word Notes. A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor. CyberWir…

1
The delusional side of AI therapy. 51:54

1M ago51:54

51:54

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We've got some follow-up from…

1
Channelcon25: Preview of Preday and Cyber Track 27:34

1M ago27:34

27:34

Charles Love of ShowTech Solutions and I sit down to discuss Channelcon25. Why you should attend and a preview of some of the sessions. From MSP-Ignite and their peer group style conversations to Tech Degenerates and many other communities coming together for a Monday Pre-day and then rolling into the daily agenda, centered, of course, on sessions …

1
Software Assurance Maturity Model (SAMM) (noun) [Word Notes] 5:43

1M ago5:43

5:43

Please enjoy this encore of Word Notes. A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks. Audio reference link: "⁠⁠OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)⁠⁠." by Pravir Chandra, OWASP MSP, 2009.…

1
Dramatic changes in UK Supply Chain Security 10:52

2M ago10:52

10:52

This episode dives deep into UK Supply Chain Cyber Security, a critical and often overlooked area in today's digital world. So, what exactly is it? It's about securing the entire network of external partners, suppliers, and third-party services that your business relies on. Imagine your company as only as strong as its weakest link. In the UK, this…

1
It’s all glitter, no gold. 47:13

2M ago47:13

47:13

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Our hosts share some follow-up, includi…

1
BEC, AI, and Recent Events 34:21

2M ago34:21

34:21

With some of the recent events in the ransomware space, I had a chance to hear firsthand from Dave Alton of Strategic Integrated Resources. I asked the question, "What is concerning you today?" This discussion has some action items that you can do with your own clients. Whether you are dealing with business email compromise, wire fraud, or are just…

1
Universal 2nd Factor (U2F) (noun) [Word Notes] 7:17

2M ago7:17

7:17

Please enjoy this encore of Word Notes. An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange. Cyberwire Glossary link: ⁠⁠https://thecyberwire.com/glossary/u2f⁠⁠ Audio reference link: “⁠⁠Rise of…

1
Convinced, compromised, and confirmed. 51:16

2M ago51:16

51:16

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠Dave Bittner⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with a ton of follow-up—from a sextortio…

1
Cyber Insurance vs Risk Management 35:48

2M ago35:48

35:48

Cybersecurity Insurance and Risk Management are generally conversations we avoid in the ITSP space, but with recent events, Matt Lee and I sit down to talk about how the two complement each other, the pitfalls, and some tips for protecting yourself through both.

1
adversary group naming (noun) [Word Notes] 10:17

2M ago10:17

10:17

Please enjoy this encore of Word Notes. A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.By N2K Networks

1
Brushed aside: The subtle scam you didn't order. 44:00

2M ago44:00

44:00

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠Dave Bittner⁠⁠, ⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up, as Joe shares with us a compl…

1
GTIA Cybersecurity Trustmark - Assured 34:13

2M ago34:13

34:13

With more than 30 ITSPs through their first assessment cycle, I wanted to take some time to get feedback on why it is an important process for any ITSP. A raw conversation with someone who will pull no punches on providing feedback as it pertains to the Trustmark and the history of what Trustmarks have come out of GTIA for its members. Charles Love…

1
The RMM protocol: Remote, risky, and ready to strike. [Only Malware in the Building] 39:25

2M ago39:25

39:25

Please enjoy this encore of Only Malware in the Building. Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠Selena Larson⁠⁠, ⁠⁠Proofpoint⁠⁠ intelligence analyst and host of their podcast ⁠⁠DISCARDED⁠⁠. Inspired by the residents of a buil…

1
BSIMM (noun) [Word Notes] 6:09

2M ago6:09

6:09

Please enjoy this encore of Word Notes. A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/bsimm⁠ Audio reference link: “⁠OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Dec…

1
The many faces of fraud. 41:58

2M ago41:58

41:58

This week, our hosts⁠⁠⁠⁠⁠⁠⁠ ⁠Dave Bittner⁠, ⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠ Space Daily show) are back sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from listener Abdussobur, who wonders if…

1
Challenges and Opportunities 33:48

2M ago33:48

33:48

The challenges and opportunities facing Managed Service Providers (MSPs) in 2025 are ever-changing, and the twists and turns keep any MSP on their toes. As I sat down with Brian Rodgers of Aeko Tech, we discussed several topics and found ourselves hitting on a recurring trend: the ever-evolving role of AI in business operations. Here are the four a…

1
OWASP vulnerable and outdated components (noun) [Word Notes] 8:04

2M ago8:04

8:04

Please enjoy this encore of Word Notes. Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version. Audio reference Link: "⁠The…

1
Episode 140: What to Do If You Fail the CISSP 7:22

2M ago7:22

7:22

Not everyone passes on the first try—but failure doesn’t define your journey. In this episode, we guide you through a structured plan for recovery if you don’t pass the CISSP exam. We cover how to interpret your exam feedback, identify weak domains, revise your study strategy, and rebuild confidence. You’ll also learn how to maintain momentum and a…

1
Episode 139: What Comes After the CISSP: Career and Certification Roadmap 8:01

2M ago8:01

8:01

Earning your CISSP opens new doors—but where you go next depends on your goals. In this episode, we explore the post-CISSP landscape, including leadership roles like CISO, and technical specializations like cloud security and digital forensics. We also review advanced certifications such as CCSP, CISM, CRISC, and the CISSP concentrations in archite…

1
Episode 138: Adaptive Testing Tips and Time Management 8:36

2M ago8:36

8:36

The CISSP exam uses Computerized Adaptive Testing (CAT), which means question difficulty and test length vary based on your performance. In this episode, we demystify the CAT format, explain how scoring works, and share strategies to manage your time across the exam. You’ll learn when to move quickly, when to slow down, and how to pace yourself und…

1
Episode 137: Understanding "Best", "First", and "Most Likely" Wording 8:16

2M ago8:16

8:16

CISSP exam questions often hinge on a single word that changes everything. In this episode, we examine how to interpret qualifiers like “best,” “first,” “most appropriate,” and “least likely.” We explain what each prompt is asking you to consider—whether it’s prioritization, sequencing, or judgment—and how to choose the answer that aligns with ISC2…

1
Episode 136: How to Deconstruct CISSP Questions 7:47

2M ago7:47

7:47

CISSP exam questions are known for being complex, layered, and sometimes intentionally confusing. In this episode, we teach you how to break questions apart to find the real point being tested. You'll learn how to identify the scenario, isolate the question stem, and evaluate answer choices using elimination strategies. We also discuss common distr…

1
Episode 135: Memory Tricks and Mnemonics for the CISSP 7:52

2M ago7:52

7:52

With so much material to retain, memory tools are a CISSP candidate’s secret weapon. In this episode, we provide proven mnemonics, visual associations, and acronym expansions to help you remember everything from the OSI model and CIA triad to the phases of incident response and risk treatment options. You’ll also learn strategies for reducing cogni…

1
Episode 131: Top 10 Hardest CISSP Concepts Demystified 9:31

2M ago9:31

9:31

Some CISSP topics consistently challenge even experienced professionals. In this episode, we break down ten of the most difficult concepts on the exam—ranging from cryptographic key lifecycle and security models to risk calculations and legal frameworks. We clarify the nuances, provide examples, and share memory aids to help you master these areas.…

1
Episode 130: DevSecOps Culture and Continuous Assurance 10:42

2M ago10:42

10:42

DevSecOps is not just a toolset—it’s a culture that integrates security into every phase of the software development lifecycle. In this episode, we explore how DevSecOps breaks down silos between development, operations, and security teams. Topics include automated security testing, continuous compliance checks, secure coding training, and real-tim…

1
Episode 129: Secure APIs and Service Integration 10:23

2M ago10:23

10:23

APIs enable system integration but can expose your infrastructure to serious vulnerabilities if not secured properly. This episode focuses on how to design and manage secure APIs. We cover authentication methods (API keys, OAuth), input validation, rate limiting, logging, and error handling. You’ll also learn about common API security issues like b…

1
Episode 128: Mobile Application Security and Reverse Engineering 10:12

2M ago10:12

10:12

Mobile apps introduce unique risks due to their widespread use, diverse platforms, and limited control over user devices. In this episode, we explore mobile app security concerns, including insecure storage, weak authentication, exposed APIs, and code tampering. We also introduce reverse engineering concepts—how attackers decompile apps to uncover …

1
Episode 127: Application Whitelisting and Sandboxing 10:10

2M ago10:10

10:10

Not all applications should be allowed to run in your environment. This episode explores application control mechanisms like whitelisting and sandboxing. You'll learn how whitelisting enforces control by allowing only approved executables, and how sandboxing isolates applications to prevent them from affecting system integrity. We also discuss impl…

1
Episode 126: Version Control and Code Integrity 9:52

2M ago9:52

9:52

Version control systems track changes to code—but they also need to be protected themselves. This episode explores how tools like Git help enforce code integrity, collaboration, and traceability across development teams. We cover commit histories, branching strategies, and how to detect unauthorized or malicious changes. You’ll learn about tagging,…

1
Episode 125: Configuration Management and CI/CD Pipelines 10:27

2M ago10:27

10:27

Secure development doesn't stop at writing code—it includes how that code is built, tested, and deployed. In this episode, we explore configuration management and continuous integration/continuous delivery (CI/CD) pipelines. We discuss how insecure configurations, exposed secrets, and unmonitored automation can lead to compromise. Topics include in…

1
Episode 124: Code Repositories and Access Controls 9:53

2M ago9:53

9:53

Source code repositories are central to modern software development—and to software security. This episode covers the security considerations for using platforms like GitHub, GitLab, Bitbucket, and internal repositories. We examine access control policies, branching strategies, commit tracking, and how to detect malicious code changes. You’ll learn…

1
Episode 123: Security Testing: SAST, DAST, IAST 10:51

2M ago10:51

10:51

Security testing helps ensure software behaves as intended under hostile conditions. In this episode, we explore different application security testing methodologies, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Interactive Application Security Testing (IAST). We explain how each method work…

1
Episode 122: Buffer Overflows, SQL Injection, and Common Flaws 10:37

2M ago10:37

10:37

Many devastating cyberattacks originate from well-known coding flaws. This episode examines classic vulnerabilities including buffer overflows, SQL injection, and other input-related attacks. We explain how these issues arise, what they allow attackers to do, and how to defend against them using secure coding, bounds checking, input validation, and…

1
Episode 121: OWASP Top 10 Threats and Controls 10:59

2M ago10:59

10:59

The OWASP Top 10 is a widely recognized list of the most critical security risks to web applications. In this episode, we walk through each entry—from injection and broken authentication to cross-site scripting, insecure deserialization, and insufficient logging. You'll learn how these vulnerabilities occur, the business impact they can have, and t…