In this episode of Beers with Talos, Hazel, Bill, Dave and Joe are joined by Talos Security Research Engineer James Nutland to discuss Living Off Trusted Services (LOTS) - a growing technique where attackers use platforms such as GitHub, Google Drive, Microsoft services and Telegram for command and control, malware delivery and data exfiltration.

We explore why this trend is growing, how it differs from Living Off the Land (LOTL)....and Lord of the Rings (LOTR)....why trusted services create new detection challenges, and what defenders should be monitoring.

Also in this episode:

• Data centers in space, when physics still has to physics.
• A USA vs UK Independence Day food showdown.
• Hazel faces another round of Make Hazel a Hacker.
• A new Reason Not to Quit looks at the latest successes from Operation Endgame.
• Bill gets his own corner.

Here's the LOTS project repository mentioned in the episode https://lots-project.com/

AI is accelerating vulnerability discovery, so what impact is that having on defenders?

In this episode of Beers with Talos, Hazel, Bill, Joe, and Dave are joined by Nick Biasini to unpack what attackers are doing with AI-assisted vulnerability discovery, why local models rather than frontier models may be a more attractive route for them, and the vendors who are now drowning in a flood of bug reports (many of them junk) as AI sifts through decades of technical debt with nothing but time and patience.

We also kick things off with a listener question about threat trends and the FIFA World Cup, which leads to a discussion about whether any of us could resist Rickrolling the entire planet.

Also in this episode: Joe attempts to "Make Hazel a Hacker" and phish the Pope. Plus, we launch a new segment called “Reasons not to Quit” in which we celebrate defender wins.

Hazel, Dave and Joe plot to celebrate Bill's 25 years at Talos with stories and a good old fashioned roast.

The team also covers the latest security headlines, including AI-assisted vulnerability research, and why attackers still can’t resist abusing trusted systems (or Roblox).

They also break down the latest Cisco Talos Incident Response Quarterly Trends report, including:

• Phishing’s return as the top initial access vector
• AI-generated credential harvesting pages built in minutes
• Crimson Collective activity and GitHub token exposure
• Pre-ransomware incidents and early disruption
• Why logging (still) matters more than ever

Read the full report at https://blog.talosintelligence.com/ir-trends-q1-2026/

And for more guidance for defenders, check out this episode of The Talos Threat Perspective https://www.youtube.com/watch?v=wppL7JBshK8

Plus: Crossbows, Metasploit nostalgia, and why, despite everything, security fundamentals still win.

Hazel, Bill, Joe and Dave break down (sometimes in the literal sense) the 2025 Talos Year in Review which is available  now at blog.talosintelligence.com/2025yearinreview

The team, supported as always by the Turkey Lurkey Man, dives into the biggest cybersecurity trends of the year, including:

·       The rapid weaponization of vulnerabilities

·       Why identity abuse showed up everywhere 

·       Ransomware trends

·       A rise in APT investigations

·       What defenders should prioritize heading into the year ahead

Before that, we discuss the cyber activity tied to the situation in the Middle East (full details on our blog https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east).

There’s also an alarming amount of discussion about glutes. And gravy.

Download the full 2025 Talos Year in Review:
blog.talosintelligence.com/2025yearinreview

It's the one, the only, it's Matt Olney! We are delighted to have Matt back to talk with the crew about about the most random things, including TikTok diagnosing us with ADHD, inspiring vtubers, K-Pop Demon Hunters, ransomware in hospitals (the serious bit), attacker use of AI, why 1999-era tricks are still undefeated, and an entirely reasonable number of desserts.

We recorded this episode on 20 February - please see the Talos blog for the latest on the developing situation in the Middle East https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/

Links to some things Matt mentioned:

The MapMen: https://www.youtube.com/@JayForeman

Ironmouse: https://www.youtube.com/watch?v=P1_2JehaKOw&list=RDP1_2JehaKOw&start_radio=1

Guess who’s back? Hazel, Bill and Joe welcome back fresh-from-parental-leave Dave Liebenberg, who has returned with a new baby, and some truly chaotic Thanksgiving opinions.    

We kick things off with the security headlines. Joe gets spicy about a recent “AI-orchestrated cyber campaign” report.  Dave brings us the poetic news that AI models can apparently be jailbroken with a well-placed limerick. Hazel challenges the others to a guessing game about just how much cyberattacks cost the UK, and Bill discusses what’s top of mind for organizations right now.  

But really, you know what you’re here for: the annual RanksGiving extravaganza. Dave boldly ranks his top five Thanksgiving dishes (with a new twist for this year, because apparently we need to re-engage the ‘youth’ before they’re lost to TikTok forever.) Cue the outrage, the gravy discourse, and a heartfelt (touching on amorous) defense of gluttony from Bill.  

Happy holidays everyone! May your gravy be thick and your cyber incidents few. See you in 2026! 

Talos' Vice President Christopher Marshall (the “real Marshall,” much to Joe’s displeasure) joins Hazel, Bill, and Joe for a very real conversation about leading people when the world won’t stop moving. We start with Marshall’s days in the Navy’s nuclear program and the art of translating deeply technical work for non-technical leaders. We then get into how he joined Talos (“you WILL do this for me”), why being right beats being first, and how to keep a team steady and mission focussed when the news cycle is anything but. Marshall also talks about the decisions that shaped his life and career, what he’s had to let go of as he’s moved up, and the gloriously nerdy hobbies that keep him grounded.

This week, the B-Team gets an upgrade as we’re joined by Sara McBroom from Talos’ nation-state threat intelligence and interdiction team. Sara shares her journey from a liberal arts major to tracking some of the world’s most advanced adversaries. Along the way, she talks about moving from the U.S federal service to Talos, mentoring, leading with empathy, and why making bad actors miserable is a pretty good day’s work.

Before diving into Sara’s story, we hit the security headlines (ouch) and also discuss a Dutch hacker camp with flaming badges and port-a-potty internet. But from 17 minutes in, it’s all about Sara — her path, her research (Static Tundra, anyone?), and how she leads her team without micromanaging.

If you’ve ever wondered what it’s like to ruin an APT’s day for a living, this is the episode.

Here's the research that Bill mentioned: "Psychopathia Machinalis: A Nosological Framework for Understanding Pathologies in Advanced Artificial Intelligence" https://www.psychopathia.ai

We welcome new Talos teammate and incident commander Alex Ryan to the pod this week. Bill, Joe and Hazel chat with Alex about what it really takes to lead through the chaos of a cybersecurity incident, from coordinating stressed-out teams, fielding exec questions, and making sure people eat.

Much to Bill's dismay, we have something resembling a "format" for this episode, and we start by breaking down the week's security news, including:

• The SharePoint zero-day exploit (“ToolShell”) and what defenders should do now. Here's the Talos blog we mention https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/
• An AI assistant gone rogue — and how a consultant lost thousands of databases in his sleep.
• Everything Talos has got going on at Black Hat

We then ask Alex more about her career story, including what it’s like breaking into security from a philosophy degree. We also have some honest talk about making mistakes, women in cyber, and why we need to keep mid-career women in tech. 

Want to meet Talos at Black Hat? Come find us at the Cisco booth, play Backdoors & Breaches over lunch with us, and hear the latest threat research. More details in this blog https://blog.talosintelligence.com/cisco-talos-at-black-hat-2025-briefings-booth-talks-and-what-to-expect/

Welcome back to the podcast where the structure is theoretical and the only certainty is uncertainty. In this episode, the crew reassembles after a totally intentional and not-at-all accidental hiatus (blame is assigned, forgiveness is not).

We cover:

• AI-assisted IVF (spoiler: it's mostly robots and headlines)
• The dawning of Mind-games-as-a-service in ransomware operations
• Conference dogs that may have been the real security MVPs
• A possible underground war against dairy
• And the billionaires quietly building their own genetically-diversified endgame.

We also mourn Bill's departure as he abruptly quits the podcast after one pun too many.

As always, we make absolutely no guarantees that this episode makes any sense whatsoever.