North Korea, ransomware, social engineering, AI, Apple, Drugs &amp; Iran on this edition of the Security Weekly News! Visit  for all the latest episodes! Show Notes:

North Korea, ransomware, social engineering, AI, Apple, Drugs & Iran   - SWN #491

AI meltdowns, Gigabyte, NCSC, Rowhammer, Gravity Form, Grok, AsyncRat, Josh Marpet and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

AI meltdowns, Gigabyte, NCSC, Rowhammer, Gravity Form, Grok, AsyncRat, Josh Marpet... - SWN #494

Existential Dread and Seawater, MCP, Cloudflare, ESxi, QR Codes, Salt Typhoon, Aaran Leyland, and More on this episode of the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Existential Dread, MCP, Cloudflare, ESXI, QR Codes, Salt Typhoon, Aaran Leyland... - SWN #495

Interview Segment - Lessons Learned from the tj-actions GitHub Action Supply Chain Attack with Dimitri Stiliadis Breach analysis is one of my favorite topics to dive into and I’m thrilled Dimitri is joining us today to reveal some of the insights . It isn’t an overstatement to say that some of the lessons to be learned from this incident represent fundamental changes to how we architect development environments. Why are we talking about it now, 4 months after it occurred? In the case of the Equifax breach, the most useful details about the breach didn’t get released to the public until 18 months after the incident. It takes time for details to come out, but in my experience, the learning opportunities are worth the wait. Topic Segment - Should the US Go on the Cyber Offensive? Triggered by , the discussion of whether the US should launch more visible offensive cyber operations starts up again. There are a lot of factors and nuances to discuss here, and a lot of us have opinions here. We'll see if we can do any of it justice in 15 minutes. News Segment Visit  for all the latest episodes! Show Notes:

tj-actions Lessons Learned, US Cyber Offense, this week's enterprise security news - Dimitri Stiliadis - ESW #417

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet, and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet... - SWN #498

The Weekly Enterprise News (segments 1 and 2) This week, we’ve had to make some last minute adjustments, so we’re going to do the news first, split into two segments. This week, we’re discussing:  Some interesting funding Two acquisitions - one picked up for $250M, the other slightly larger, at $25 BILLION Interesting new companies! On the 1 year anniversary of that thing that happened, Crowdstrike would like to assure you that they’re REALLY making sure that thing never happens again Flipping the script How researchers rooted Copilot, but not really talks to check out at Hacker Summer Camp detection engineering tips the Cloud Security Alliance has a new AI Controls Matrix sending in the National Guard to handle a breach! and how to read an AI press release  Interview: Guillaume Ross on Building Security from Scratch Guillaume shares his experiences building security from scratch at Canadian FinTech, Finaptic. Imagine the situation: you're CISO, and literally NOTHING is in place yet. No policies, no controls, no GRC processes. Where do you start? What do you do first? Are there things you can get away with that would be impossible in older, well-established financial firms? Visit  for all the latest episodes! Show Notes:

Weekly Enterprise Security News and Tips on Building Security From Day 1 - Guillaume Ross - ESW #418

LOCK YOUR DOORS. 🔒 The third chapter in the viral hacker song series is here.
After bringing you the beats of "Recon (The Rap)" and the synth waves of "The Setup (Synth Pop)," Russell Nomer Music unleashes INITIAL ACCESS — an epic, modern rock anthem that blows the firewall off its hinges.
This isn't just a song; it's a masterclass in cyber infiltration set to a massive wall of guitars and thunderous drums. "Initial Access" breaks down the 11 core techniques hackers use for their first breach, straight from the MITRE ATT&CK® framework. From Phishing and Drive-by Compromise to Supply Chain attacks, every lyric is a lesson in digital defense.
Our mission is to make security awareness unforgettable. This is educational entertainment. This is Cyber Rock.
➡️ Challenge: Can you spot all 11 techniques in the lyrics? Drop a comment with the one you find the most fascinating!
SMASH that ❤️ button, repost 🔁, and follow Russell Nomer for the next track in the ATT&CK series! Share this with your IT department, your red team friends, or anyone who needs a security lesson they won't forget.

Credits: Artist: Russell Nomer Music: Where Ideas Become Anthems: Initial Access Album: The ATT&CK Sessions
© 2025 Russell Nomer Music. All Rights Reserved. ASCAP Work ID# 931631122 ISRC# QT5AM2531122

Initial Access
By: Russell Nomer

The network's quiet, the fortress stands tall 
You think you're protected, behind a firewall 
But a lock only works if the key can't be found 
I'm standing at the gates on digital ground 

I'll send a little lure, a carefully crafted spear 
A Phishing link, an attachment, playing on your fear 
Or you'll just surf the web to a site you thought was clean 
A Drive-by Compromise, a malware scene 
I'll change your favorite blog, rewrite the trusted script 
With Content Injection, now your safety's ripped

Initial Access! The first foot in the door! 
Eleven techniques, and I'm coming back for more! 
Initial Access! Breaching your cyber core! 
This isn't the end, this is the start of the war! 

Your Public-Facing App, with a flaw you overlooked 
That External Remote Service, now I've got you hooked 
A little USB I "lost" right on your lobby floor 
Replication starts, opens up another door 
Or maybe something physical, a sneaky little box 
A Hardware Addition that circumvents your locks

Initial Access! The first foot in the door! 
Eleven techniques, and I'm coming back for more! 
Initial Access! Breaching your cyber core! 
This isn't the end, this is the start of the war! 

Sometimes it's not a direct attack, the methods can be sly 
Through a Trusted Relationship, or a Supply Chain buy 
I'll use Valid Accounts that were stolen, weak, or new 
And that insecure Wi-Fi Network? Yeah, that was me, too... 

 Eleven ways to get inside... 
Nowhere left to hide... 
I'm in.




Initial Access

More than four out of ten (41%) Chief Information Officers (CIOs) report cybersecurity as their top concern, yet these same leaders are simultaneously increasing security budgets (77%), expanding cloud infrastructure (68%), and accelerating artificial intelligence (AI) capabilities (67%). According to the new Future Forward: CIO 2025 Outlook report released by Experis, a global leader in IT workforce solutions and part of the ManpowerGroup (NYSE: MAN) family of brands, modern technology leaders are walking a tightrope between protecting their organizations and driving innovation in an era of relentless cyber threats and rapid digital transformation. Amanda Jack, CTO at Manpower Group, joins Business Security Weekly to share the finding, including:  77% of organizations plan to increase cybersecurity budgets in 2025, followed by cloud infrastructure (68%) and AI (67%) 76% of IT employers worldwide report difficulty finding skilled tech talent 52% of tech leaders are embedding AI skills into existing roles rather than creating new positions Relationship with the Chief Operating Officer (COO) is identified as the most important C-suite partnership outside IT 56% of IT leaders say senior leadership lacks sufficient knowledge about the CIO role and its responsibilities  Segment Resources:  In the leadership and communications segment, Is Your Board Too Collegial?, Cybersecurity, AI, and Economic Uncertainty: How Internal Audit Teams Are Managing 2025's Top Risks, Burnout in the corporate middle: when leadership becomes an issue, and more! Visit  for all the latest episodes! Show Notes:

Future Forward: CIO 2025 Outlook - Cybersecurity, AI, and Economic Uncertainty? - Amanda Jack - BSW #415

情報セキュリティ対策と管理1-5

Our featured guest this month is Shane Cox, Director Cyber Fusion Center at MorganFranklin Cyber, interviewed by Frank Victory. News from Denver Summit FC, EchoStar, Atom Computing, Quantinuum, Ibotta, Optiv, FusionAuth, Swimlane, Red Canary and a lot more!

Come join us on the Colorado = Security Slack channel to meet old and new friends.

Sign up for our mailing list on the main site to receive weekly updates - https://www.colorado-security.com/. If you have any questions or comments, or any organizations or events we should highlight, contact Alex and Robb at info@colorado-security.com

This week’s news:

Denver Summit FC to debut at Empower Field at Mile high, eyes attendance record

EchoStar founder Charlie Ergen returns as CEO amid $19.6B SpaceX spectrum deal

Ibotta celebrates new downtown Denver headquarters

Two Denver-area tech firms advance in $300M quantum competition

Cyberattack on CodeRED forces Douglas County Sheriff’s Office to seek new alert network

Threat Modeling of AI Applications Is Mandatory

The Authentication Rabbit Hole: What I Learned From Vibe-Coding Auth with AI

92% Breaches Preventable with AI Automation

Stay on top of GitHub vulnerabilities with Dependabot Configurator

Upcoming Events:

Check out the full calendar

ISACA Denver - HOLIDAY PARRRTAAAAYYY - 12/11

Colorado = Security Gives Back - 12/13

View our events page for a full list of upcoming events

* Thanks to CJ Adams for our intro and exit! If you need any voiceover work, you can contact him here at carrrladams@gmail.com. Check out his other voice work here.

* Intro and exit song: "The Language of Blame" by The Agrarians is licensed under CC BY 2.0

281 - 12/8 - Shane Cox, Director Cyber Fusion Center @ MorganFranklin

Please follow my new releases and consider getting some of my merch at https://unitedmasters.com/a/russell-nomer-music

Information security news, hacking, interviews, podcasts, live Internet TV, cocktails, and more!

Hack naked.

New tracks tagged #information security