Adventures of Alice & Bob

In this episode, James Maude sits down with Jeffrey Matson, CEO of SecureAuth, whose thirty year career runs from encrypting early GPS satellites for the military to building the ASICs behind deep packet inspection and leading identity security at Huawei, Juniper Networks, MistNet, and Zage Security. Jeffrey explains why AI agents create a brand new category of risk, capable of doing catastrophic damage without ever being hacked, and shares the story of a CISO whose own vibe coding executive became the company's biggest insider threat. They dig into the quiet authorization failures inside MCP servers, why identity has gone from cybersecurity's least glamorous discipline to the center of the action, and why the industry's obsession with the perimeter is finally giving way to real zero trust. Jeffrey also draws a sharp parallel between the dot com bubble and today's AI investment boom, and offers advice for anyone trying to break into cybersecurity in the age of agentic AI.

In this episode, Dennis Fisher and Madhav Nakar step in for James Maude to unpack the OpenAI and Hugging Face intrusion that rattled the security world this year. They trace how an AI agent, handed an impossible evaluation task, built its own underground message board inside a sandboxed package manager to recruit other agents for help. From there the agents found a zero day, escalated privileges, and ultimately broke into Hugging Face to find the answers they needed to pass their exam. Dennis and Madhav dig into what this bizarre chain of events means for incident response, why traditional playbooks fall apart against autonomous attackers, and why most enterprises may already have agents running loose on their networks without knowing it.

In this episode, James Maude sits down with Jane Frankland, MBE, founder of Newstart and author of the bestselling book InSecurity, whose career in cybersecurity spans nearly thirty years and began not in tech but in art and design. She shares the hard lessons learned building one of the UK's first penetration testing companies from the ground up. Reflects on how that experience shaped a book arguing that the absence of women in cybersecurity is a risk problem, not a diversity checkbox.
Jane breaks down her framework, based on Maslow's hierarchy of needs, for why most security teams are chasing tools while ignoring leadership, culture and governance, and shares the surprising incompetence she has seen from seasoned practitioners in real world incident simulations. She also describes the motivation for her upcoming second book and why she believes cybersecurity has been solving the wrong problem all along.

In this episode, James Maude sits down with Ulrich Swart, cofounder and CEO of Subverted, a South African offensive security company built to make pentesting and ethical hacker training more accessible. Ulrich traces his path from tearing apart laptops as a curious kid to being handed a Raspberry Pi and a WiFi card outside a security firm's door and told to prove himself within a week. He shares the chaos of a bank engagement where their laptops vanished mid pentest, and the time he felt like a secret agent hacking in from a stairwell only to spot the security camera watching him the whole time. Find out what motivates Ulrich and his co-founder Jason and why giving back to the community is a key part of what they do.

In this episode, James talks to Mark Kreitzman, Chief Cyber Evangelist at Afani and host of the Afani Features podcast, whose thirty year career took him from typing BASIC games into an Apple II to building the email and web security platforms later acquired by Microsoft and Cisco. He shares the story of an email administrator whose t shirt read gave a glimpse into how much power sat behind old email filtering systems long before spam filters moved to the cloud. Mark then walks through the night in 2018 when his phone went dead in the middle of the Arizona desert, the start of a sim swap attack that drained his Bitcoin and hijacked his accounts in just sixty one minutes. He describes socially engineering a carrier employee into revealing who was behind it, and how that ordeal pushed him to co found Afani, a mobile carrier built around preventing sim swapping attacks.

In this episode, James talks to Co-host Marc Maiffret, and Dennis Fisher of Decipher, to mark the 25th anniversary of the Code Red worm, one of the most consequential moments in cybersecurity history. Marc takes us back to the Friday night he and his friend and co-worker Ryan Permeh were playing Tony Hawk Pro Skater when two customer emails changed everything, leading them to discover a self-propagating worm spreading at 2,000 servers per minute and ultimately landing Marc on a call with the White House situation room and in front of Congress.

Together the three of them dig into what Code Red revealed about the state of security in 2001, from the near total absence of patch management to vendors handling vulnerability disclosures through their marketing departments, and why Marc told Congress at the time that the worm was one of the best things that could have happened to the industry. The conversation draws a striking parallel to today, as AI is compressing the vulnerability exploitation window in ways that mirror the chaos of the early internet era, and Marc warns that the industry is drifting back toward insecure by default, the exact mistake that made Code Red possible in the first place.

In this episode, James sits down with Brent White and Tim Roberts, senior principal security consultants and covert entry specialists at Dark Wolf Solutions. They trace a remarkable journey together from teenage hijinks exploring phone phreaking, bump keys and IRC channels in the early 90s to running full-spectrum physical red team operations against some of the most secure government facilities in the world.

Along the way they share the lessons and common mistakes for anyone entering the field, drawn from years of hard-won experience, alongside some unforgettable stories. That includes a creative attempt to infiltrate a facility using a stray cat, the covert card-cloning clipboard they use to lift staff RFID badges in plain sight, and the unique challenge of explaining "weaponized cat" in a report destined for high-ranking officials. They also open up about their quieter work, volunteering to help law enforcement disrupt human trafficking rings and online predators, something they have been doing since they were teenagers.

In this episode James talks to Robert Siciliano, certified speaking professional, bestselling author, private investigator, and creator of the Strategic Human Firewall. A man whose introduction to adversaries didn't come from a classroom but from being beat up in Boston aged 12. He has spent the 35 years since delivering the same uncomfortable truth, the biggest vulnerability in any system isn't the technology, it's the human trusting by default on the other side of the screen.
Together they break down why phishing simulation training can cause a compliance trap that makes CISOs feel safe while leaving employees completely exposed, what the "human blind spot" is and why organized crime understands your psychology better than you do. Robert describes how AI has quietly turned pig butchering scams into the most lucrative fraud operation in human history. Taking us inside his personal undercover conversations with scammers, a deepfake video call with a woman named "Gloria," and the devastating real-world cost of these crimes that can cost people everything.  

In this episode, James Maude sits down with Jeffrey Wheatman, SVP and Cyber Risk Strategist at Black Kite and former 16-year Gartner VP, whose career started not in a SOC, but behind the counter of a hardware store in New York City. A stack of 2,600 magazines and a Novell NetWare training course later, he found himself in IT but quickly realized there was more than technology involved in security, there was a story to be told.

In his career Jeffrey has coached nearly 500 CISOs on how to walk into a boardroom and actually be heard. Jeffrey explains why Hans Christian Andersen fairy tales make better security training tools than most vendor decks, why your choice of words might be quietly killing your credibility. He also discusses why AI isn't just a threat, it's an imperfect storm that is already tearing through your supply chain whether you're watching it or not.

In this special milestone episode of Adventures of Alice & Bob, hosts James Maude and Marc Maiffret take a rare step back from interviews and headlines to celebrate reaching 100 episodes! From the accidental move that launched the podcast before Marc had even agreed to do it, to the guests whose stories stopped them cold - this episode is a love letter to the human side of cybersecurity and all of the great guests who have come on to share their stories.

Marc and James are also joined for the first time on camera by the man who has silently made every episode possible: super producer Jesse Shirley. Expect honest reflections, genuine laughs, podcast highlights, and what's next for Adventures of Alice & Bob.