Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense

When a ransomware attack hits, who actually talks to the criminals? In this episode, Lucas and Luna dive into the controversial but increasingly common practice of hiring professional ransomware negotiators. They explore how firms like Coveware and Kivu Consulting act as intermediaries between victims and attackers, using data from past incidents to drive down ransom demands. Lucas explains the typical playbook: threat actors demand $5 million, negotiators use industry benchmarks to get it below $1 million. Luna questions the ethical tightrope—do these firms legitimise extortion? They discuss the rise in ransom payments despite law enforcement crackdowns, and how the FBI quietly tolerates negotiation as a harm-reduction strategy. Specific numbers: average ransom payment in Q1 2026 was $812,000, down 18% year-over-year. The episode also covers how CISOs weigh reputational risk against paying, and why some insurers now mandate a negotiation firm in their policies.

#RansomwareNegotiation #Coveware #KivuConsulting #EnterpriseSecurity #CyberRansom #IncidentResponse #CISO #CyberInsurance #FBI #HarmReduction #RansomwarePlaybook #BusinessPodcast #FexingoBusiness #BusinessAndTechnology #CybersecurityBusiness #CyberExtortion #RansomPayment #NegotiationTactics

Keep every episode free: buymeacoffee.com/fexingo

Episode 97 of Cybersecurity Business with Fexingo dives into remote browser isolation (RBI), a technology that runs web sessions on a remote server to keep malware off endpoints. Lucas and Luna discuss how the approach flips the traditional security model: instead of trying to detect malicious code, it simply never lets code reach the user's device. They walk through a real example from a 2025 breach at a healthcare network where the attacker used a drive-by download from a compromised marketing site. That attack would have been impossible if the organization had deployed RBI. The hosts explain the cost trade-offs — RBI can add 100-200ms of latency per page load — and why the U.S. federal government is now mandating it for certain agencies. They also cover the major vendors: Cloudflare, Menlo Security, and Symantec's Web Isolation. A practical episode for any CISO or security architect evaluating defense-in-depth strategies.

#RemoteBrowserIsolation #RBI #Cybersecurity #EnterpriseSecurity #WebThreats #DriveByDownload #ZeroTrust #Cloudflare #MenloSecurity #Symantec #EndpointSecurity #DefenseInDepth #CISO #Business #Technology #FexingoBusiness #BusinessPodcast #CyberDefense

Keep every episode free: buymeacoffee.com/fexingo

Episode 96 of Cybersecurity Business with Fexingo explores how open-source threat modeling frameworks like OWASP Threat Dragon and MITRE ATT&CK are changing enterprise security. Lucas and Luna discuss why companies like Netflix, Spotify, and JPMorgan are ditching proprietary tools for community-driven models, how STRIDE and PASTA methodologies fit into modern DevSecOps, and what this shift means for vulnerability management budgets. They anchor the episode on a 2025 survey finding that 42% of Fortune 500 security teams now use at least one open-source threat modeling tool, up from 18% in 2022. The hosts also examine the risks of relying on community-maintained frameworks, including update lag and inconsistent documentation. This episode is a practical guide for security architects, CISOs, and DevOps leads looking to reduce tooling costs without sacrificing rigor.

#ThreatModeling #OpenSource #OWASP #MITREATTACK #DevSecOps #Cybersecurity #BusinessAndTechnology #EnterpriseSecurity #Netflix #Spotify #JPMorgan #STRIDE #PASTA #ThreatDragon #VulnerabilityManagement #SecurityArchitecture #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 95 dives into the rise of Cloud Workload Protection Platforms (CWPPs), a security category that has quietly become essential for enterprises running hybrid and multi-cloud infrastructure. Lucas and Luna unpack the specific shift from legacy antivirus and host-based security to agent-based workload protection that spans AWS, Azure, and GCP. They focus on a concrete example: how a Fortune 500 retailer detected a cryptominer hiding inside a dormant Kubernetes pod using runtime behavioral analysis from a CWPP agent — catching the threat before it could scale GPU usage and trigger a six-figure cloud bill. The episode explains what CWPPs actually do (file integrity monitoring, vulnerability scanning, runtime defense), why they differ from cloud security posture management tools, and how security teams are consolidating multiple point products into a single agent. Lucas and Luna also discuss the trade-offs: agent overhead, false positive tuning, and the challenge of covering serverless functions alongside containerized workloads. A practical, number-driven look at a fast-growing segment of the enterprise security stack.

#CloudWorkloadProtection #CWPP #Cybersecurity #EnterpriseSecurity #CloudSecurity #Kubernetes #ContainerSecurity #RuntimeSecurity #AWS #Azure #GCP #Cryptomining #ThreatDetection #BusinessAndTechnology #FexingoBusiness #BusinessPodcast #SecurityOperations #InfrastructureSecurity

Keep every episode free: buymeacoffee.com/fexingo

In Episode 94 of Cybersecurity Business with Fexingo, Lucas and Luna explore the growing threat of Living-Off-the-Land (LOL) binaries — a technique where attackers use legitimate system tools like PowerShell, WMI, and Certutil to evade detection. They break down real-world cases, including the 2021 Kaseya supply-chain attack where REvil used LOLbins to move laterally, and the 2020 SolarWinds breach where attackers abused trusted software. Lucas explains why this technique is so effective against signature-based defenses and how security teams are shifting to behavior-based detection and application control. They discuss specific tools like Sysmon and the LOLBAS project, and why endpoint detection and response (EDR) tools are essential but not foolproof. The episode also covers practical steps for defenders: disabling unnecessary tools, logging all command-line activity, and using deception to spot abuse. A must-listen for CISOs and security architects grappling with stealthy, fileless attacks.

#LivingOffTheLand #LOLbins #Cybersecurity #FilelessMalware #PowerShell #WMI #REvil #Kaseya #SolarWinds #Sysmon #EDR #ThreatHunting #SupplyChainAttack #BehavioralDetection #EnterpriseSecurity #BusinessAndTechnology #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 93 of Cybersecurity Business with Fexingo dives into how organizations are consolidating their threat intelligence feeds into unified platforms. Lucas and Luna examine the shift from dozens of point solutions to a single TIP, using the example of a global bank that cut alert noise by 40%. They discuss how platforms like Recorded Future and Anomali are evolving, the role of STIX/TAXII standards, and why CISOs are finally demanding interoperability. The episode also covers how machine learning is helping prioritize the most critical threats, and a surprising stat: 70% of enterprises now have a dedicated TIP. A practical look at how security teams are moving from data overload to actionable intelligence.

#ThreatIntelligence #EnterpriseSecurity #CISO #RecordedFuture #Anomali #STIX #TAXII #MachineLearning #AlertFatigue #CyberThreats #SecurityOperations #SOC #IntelligenceDriven #BusinessAndTechnology #CybersecurityBusiness #FexingoBusiness #BusinessPodcast #SecurityTech

Keep every episode free: buymeacoffee.com/fexingo

Episode 92 of Cybersecurity Business with Fexingo dives into the rapidly growing market for breach and attack simulation (BAS) tools. Lucas explains how BAS platforms continuously probe an organization's defenses — from firewalls to endpoint detection — to find gaps before real attackers do. He cites Gartner's projection that by 2027, 40% of enterprises will use BAS, up from under 10% in 2024. Luna asks whether these tools replace penetration testing or red teams. Lucas clarifies that BAS automates the repetitive validation, freeing human experts for deeper hunts. They discuss the $1.8 billion acquisition of AttackIQ by a private equity consortium in early 2026, and why CISOs are shifting from periodic compliance checks to continuous security validation. The episode also covers the limitations: BAS can't test novel zero-days or social engineering. A concrete takeaway: if your security team isn't running weekly automated simulations, you're flying blind until the next breach.

#BreachAndAttackSimulation #BAS #ContinuousSecurityValidation #CISO #CyberDefense #AttackIQ #Gartner #PenetrationTesting #RedTeam #SecurityAutomation #EnterpriseSecurity #ZeroDay #CyberResilience #BusinessPodcast #BusinessAndTechnology #FexingoBusiness #CybersecurityBusiness #SecurityTesting

Keep every episode free: buymeacoffee.com/fexingo

Episode 91 of Cybersecurity Business explores the Cyber Threat Hunting Maturity Model (HMM), a framework developed by the cybersecurity firm Sqrrl (acquired by AWS) to measure and improve an organization's threat-hunting capabilities. Lucas and Luna discuss the five levels, from Level 0 (initial, reactive) to Level 4 (leading, automated), and walk through a specific case study of a Fortune 500 financial services company that moved from Level 1 to Level 3 in 18 months, reducing mean dwell time by 60 percent. The hosts break down what each level means in practice, how companies can assess their current state, and why most enterprise security teams are stuck at Level 1. They also touch on the role of AI in accelerating maturity, and why the model is becoming a standard reference point for CISOs and security architects. No prior episode has covered this framework.

#CyberThreatHunting #ThreatHuntingMaturityModel #Sqrrl #AWS #Cybersecurity #CISO #EnterpriseSecurity #ThreatDetection #SecurityOperations #SOC #MeanDwellTime #ThreatHunting #CyberDefense #SecurityFramework #BusinessAndTechnology #Business #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 90 of Cybersecurity Business with Fexingo dives into a fresh intelligence frontier: AI-powered translation of dark web and encrypted chat logs. Lucas and Luna explore how security teams are leveraging large language models to parse jargon, slang, and coded language from threat actor communications in real time. The episode centers on a specific case: a mid-2026 ransomware group — tracked as 'VoidCrypt' — whose operators switched to a custom encrypted chat protocol. Analysts used a fine-tuned LLM to translate and classify over 50,000 messages in three days, revealing a planned supply chain attack days before execution. Lucas breaks down the technical pipeline — from scraping clearnet and Tor-based forums to entity extraction and sentiment scoring. Luna pushes back on privacy risks and data sovereignty concerns. They discuss where this technique fits in the broader threat intelligence stack and whether it's a temporary edge or a permanent capability. No hype, just the operational reality of machine-assisted human analysis.

#AIThreatIntelligence #LLMSecurity #DarkWebMonitoring #ThreatActorChat #VoidCrypt #RansomwareAnalysis #SecurityOperations #ThreatHunting #CyberIntelligence #EncryptedChatAnalysis #NLPforSecurity #OSINT #BusinessAndTechnology #EnterpriseDefense #FexingoBusiness #BusinessPodcast #Cybersecurity #BreachPrevention

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna explore how enterprises are moving away from manual firewall rule reviews and access control list updates toward automated policy enforcement. They discuss the challenges of maintaining security policies across hybrid cloud environments, the role of infrastructure-as-code tools like Terraform and Open Policy Agent, and a specific case where a Fortune 500 company reduced policy deployment time from weeks to minutes. The hosts also examine the risks of automation—including misconfigurations and the need for guardrails—and what the shift means for security operations teams.

#AutomatedPolicyEnforcement #InfrastructureAsCode #OpenPolicyAgent #Terraform #HybridCloudSecurity #SecurityAutomation #PolicyAsCode #CloudSecurity #DevSecOps #Fortune500 #SecurityOperations #ConfigDrift #ZeroTrust #CISO #BusinessAndTechnology #FexingoBusiness #BusinessPodcast #EnterpriseSecurity

Keep every episode free: buymeacoffee.com/fexingo