In this episode of Business Security Weekly, Mandy Logan, along with guests Peter Hedberg, Summer Craze Fowler, and Ben Carr, delve into the complexities of cyber insurance and the empowerment of Chief Information Security Officers (CISOs). The discussion covers the evolving landscape of cyber insurance, the critical role of underwriting, and the importance of collaboration between CISOs and insurers. The guests share insights on risk assessment, the significance of incident response planning, and the need for CISOs to be recognized as key players in the boardroom. The conversation emphasizes the necessity of building strong relationships with insurers and leveraging data to enhance security measures. This month BeyondTrust released it's 12th annual edition of the Microsoft Vulnerabilities Report. The report reveals a record-breaking year for Microsoft vulnerabilities, and helps organizations understand, identify, and address the risks within their Microsoft ecosystems. Segment Resources: Insights Security Assessment Tool:  For a copy of the Microsoft Vulnerabilities Threat Report:  Blog re: Report:  Stephan will discuss OpenText Core Threat Detection and Response, a new AI-powered solution designed to quickly spot and neutralize threats across an organization’s attack surface without the need to overhaul existing security stacks. He will also provide insights into the most dangerous threats facing enterprises today along with practical steps to mitigate them.     This segment is sponsored by OpenText. Visit  to learn more about them! This segment is sponsored by BeyondTrust. Visit  to for a copy of the Microsoft Vulnerabilities Threat Report! Visit  for all the latest episodes! Show Notes:

CISO Cyber Insurance Empowerment - Morey Haber, Peter Hedberg, Stephan Jou - BSW #400

Manual secure code reviews can be tedious and time intensive if you're just going through checklists. There's plenty of room for linters and compilers and all the grep-like tools to find flaws. Louis Nyffenegger describes the steps of a successful code review process. It's a process that starts with understanding code, which can even benefit from an LLM assistant, and then applies that understanding to a search for developer patterns that lead to common mistakes like mishandling data, not enforcing a control flow, or not defending against unexpected application states. He explains how finding those kinds of more impactful bugs are rewarding for the reviewer and valuable to the code owner. It involves reading a lot of code, but Louis offers tips on how to keep notes, keep an app's context in mind, and keep code secure. Segment Resources:       Visit  for all the latest episodes! Show Notes:

Simple Patterns for Complex Secure Code Reviews - Louis Nyffenegger - ASW #337

Sony, Scattered Spider, Hikvision, Cybercrime, Iran, BSODs, Cloudflare, Josh Marpet, and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Sony, Scattered Spider, Hikvision, Cybercrime, Iran, BSODs, Cloudflare, Josh Marpet.. - SWN #490

North Korea, ransomware, social engineering, AI, Apple, Drugs &amp; Iran on this edition of the Security Weekly News! Visit  for all the latest episodes! Show Notes:

North Korea, ransomware, social engineering, AI, Apple, Drugs & Iran   - SWN #491

AI meltdowns, Gigabyte, NCSC, Rowhammer, Gravity Form, Grok, AsyncRat, Josh Marpet and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

AI meltdowns, Gigabyte, NCSC, Rowhammer, Gravity Form, Grok, AsyncRat, Josh Marpet... - SWN #494

Existential Dread and Seawater, MCP, Cloudflare, ESxi, QR Codes, Salt Typhoon, Aaran Leyland, and More on this episode of the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Existential Dread, MCP, Cloudflare, ESXI, QR Codes, Salt Typhoon, Aaran Leyland... - SWN #495

Interview Segment - Lessons Learned from the tj-actions GitHub Action Supply Chain Attack with Dimitri Stiliadis Breach analysis is one of my favorite topics to dive into and I’m thrilled Dimitri is joining us today to reveal some of the insights . It isn’t an overstatement to say that some of the lessons to be learned from this incident represent fundamental changes to how we architect development environments. Why are we talking about it now, 4 months after it occurred? In the case of the Equifax breach, the most useful details about the breach didn’t get released to the public until 18 months after the incident. It takes time for details to come out, but in my experience, the learning opportunities are worth the wait. Topic Segment - Should the US Go on the Cyber Offensive? Triggered by , the discussion of whether the US should launch more visible offensive cyber operations starts up again. There are a lot of factors and nuances to discuss here, and a lot of us have opinions here. We'll see if we can do any of it justice in 15 minutes. News Segment Visit  for all the latest episodes! Show Notes:

tj-actions Lessons Learned, US Cyber Offense, this week's enterprise security news - Dimitri Stiliadis - ESW #417

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet, and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Popup Porn, LoveSense, Tea, Fire Ant, Scatterede Spider, AI Pricing, Josh Marpet... - SWN #498

The Weekly Enterprise News (segments 1 and 2) This week, we’ve had to make some last minute adjustments, so we’re going to do the news first, split into two segments. This week, we’re discussing:  Some interesting funding Two acquisitions - one picked up for $250M, the other slightly larger, at $25 BILLION Interesting new companies! On the 1 year anniversary of that thing that happened, Crowdstrike would like to assure you that they’re REALLY making sure that thing never happens again Flipping the script How researchers rooted Copilot, but not really talks to check out at Hacker Summer Camp detection engineering tips the Cloud Security Alliance has a new AI Controls Matrix sending in the National Guard to handle a breach! and how to read an AI press release  Interview: Guillaume Ross on Building Security from Scratch Guillaume shares his experiences building security from scratch at Canadian FinTech, Finaptic. Imagine the situation: you're CISO, and literally NOTHING is in place yet. No policies, no controls, no GRC processes. Where do you start? What do you do first? Are there things you can get away with that would be impossible in older, well-established financial firms? Visit  for all the latest episodes! Show Notes:

Weekly Enterprise Security News and Tips on Building Security From Day 1 - Guillaume Ross - ESW #418

LOCK YOUR DOORS. 🔒 The third chapter in the viral hacker song series is here.
After bringing you the beats of "Recon (The Rap)" and the synth waves of "The Setup (Synth Pop)," Russell Nomer Music unleashes INITIAL ACCESS — an epic, modern rock anthem that blows the firewall off its hinges.
This isn't just a song; it's a masterclass in cyber infiltration set to a massive wall of guitars and thunderous drums. "Initial Access" breaks down the 11 core techniques hackers use for their first breach, straight from the MITRE ATT&CK® framework. From Phishing and Drive-by Compromise to Supply Chain attacks, every lyric is a lesson in digital defense.
Our mission is to make security awareness unforgettable. This is educational entertainment. This is Cyber Rock.
➡️ Challenge: Can you spot all 11 techniques in the lyrics? Drop a comment with the one you find the most fascinating!
SMASH that ❤️ button, repost 🔁, and follow Russell Nomer for the next track in the ATT&CK series! Share this with your IT department, your red team friends, or anyone who needs a security lesson they won't forget.

Credits: Artist: Russell Nomer Music: Where Ideas Become Anthems: Initial Access Album: The ATT&CK Sessions
© 2025 Russell Nomer Music. All Rights Reserved. ASCAP Work ID# 931631122 ISRC# QT5AM2531122

Initial Access
By: Russell Nomer

The network's quiet, the fortress stands tall 
You think you're protected, behind a firewall 
But a lock only works if the key can't be found 
I'm standing at the gates on digital ground 

I'll send a little lure, a carefully crafted spear 
A Phishing link, an attachment, playing on your fear 
Or you'll just surf the web to a site you thought was clean 
A Drive-by Compromise, a malware scene 
I'll change your favorite blog, rewrite the trusted script 
With Content Injection, now your safety's ripped

Initial Access! The first foot in the door! 
Eleven techniques, and I'm coming back for more! 
Initial Access! Breaching your cyber core! 
This isn't the end, this is the start of the war! 

Your Public-Facing App, with a flaw you overlooked 
That External Remote Service, now I've got you hooked 
A little USB I "lost" right on your lobby floor 
Replication starts, opens up another door 
Or maybe something physical, a sneaky little box 
A Hardware Addition that circumvents your locks

Initial Access! The first foot in the door! 
Eleven techniques, and I'm coming back for more! 
Initial Access! Breaching your cyber core! 
This isn't the end, this is the start of the war! 

Sometimes it's not a direct attack, the methods can be sly 
Through a Trusted Relationship, or a Supply Chain buy 
I'll use Valid Accounts that were stolen, weak, or new 
And that insecure Wi-Fi Network? Yeah, that was me, too... 

 Eleven ways to get inside... 
Nowhere left to hide... 
I'm in.




Initial Access

Please follow my new releases and consider getting some of my merch at https://unitedmasters.com/a/russell-nomer-music

Information security news, hacking, interviews, podcasts, live Internet TV, cocktails, and more!

Hack naked.

New tracks tagged #information security