Data Security Decoded

Identity-based ransomware is no longer a fringe tactic; it’s becoming the playbook of today’s most dangerous adversaries. Scattered Spider, a financially motivated e-crime group, has shifted the model from smash-and-grab encryption to a far more devastating combination of double extortion, social engineering, and hypervisor encryption attacks.

In this episode of Data Security Decoded, host Caleb Tolin welcomes back Joe Hladik, Head of Rubrik Zero Labs, to unpack how Scattered Spider is evolving the ransomware playbook. From double extortion and identity compromise to hypervisor encryption and legacy system exploitation, Joe explains why these tactics succeed where traditional defenses fail and why building cyber resilience, not just detection and response, is the critical next step for security leaders.

What You’ll Learn:

Episode Highlights:

[00:30] Joe on Scattered Spider’s financial motivations and shift to double extortion 

[06:53] Why identity compromise and social engineering bypass traditional defenses 

[08:49] Disabling EDR with “living off the land” techniques and vulnerable drivers 

[13:06] Hypervisor encryption: how attackers can take entire backup systems offline 

[16:21] Cyber resilience as the future: assuming breach and restoring trusted systems

Episode Resources:

Chinese state-backed cyber operations are often misunderstood as a single, centrally controlled machine. In reality, they are fragmented, diverse, and strategically aligned with China’s national objectives, from economic development to critical infrastructure positioning.

In this episode of ⁠Data Security Decoded⁠, join ⁠Caleb Tolin⁠ as he sits down with ⁠Mei Danowski⁠, Co-Founder of Natto Thoughts and expert in geopolitical intelligence, to explore how China’s cyber ecosystem operates and how it is shaped by cultural, political, and economic structures.

What You’ll Learn:

Highlights:

[01:50] The fragmented reality of Chinese state-backed cyber operations

[05:28] How cultural and political structures shape threat actor behavior

[08:47] Comparing China’s cyber strategy to Russia, North Korea, and Iran

[12:45] Why telecom, energy, and water systems are top targets

[21:24] China’s 14th Five-Year Plan successes and projections for the 15th

Episode Resources:

Cyber threat intelligence is often misunderstood, seen as a niche reporting function instead of the connective tissue that links defenders, leaders, and strategy. In this episode of ⁠Data Security Decoded⁠, join ⁠Caleb Tolin⁠ as he sits down with ⁠Scott Scher⁠, a cyber threat intelligence (CTI) expert with an unconventional backstory, to explore how his off‑grid years shaped his view on resilience, why CTI should be seen as “counter‑threat intelligence,” and how intelligence defenders, and policy teams can work as one to turn raw data into actionable security decisions.

What You’ll Learn:

Episode Highlights:

[00:01] Scott’s unconventional path from off‑grid homesteading to cybersecurity

[03:47] Breaking the “versus” mindset: How intelligence, defenders, and policy work as a formula

[08:19] What CTI and defenders really need to understand about each other

[12:45] CTI as “cover”: Giving defenders justification and prioritization for key decisions

[17:45] How CTI helps organizations protect their most sensitive data

Episode Resources:

In this episode of ⁠Data Security Decoded⁠, host ⁠Caleb Tolin⁠ sits down with ⁠Dustin Droullard⁠, a cyber threat intelligence expert and former Army intelligence analyst, to discuss how global conflict is increasingly playing out in cyberspace, from digital espionage to civilian-targeted cyber operations. This episode highlights why organizations must rethink their cyber risk strategies in light of modern geopolitical threats and growing digital exposure.

What You’ll Learn:

Episode Highlights:

Episode Resources:

Welcome to the ⁠Data Security Decoded⁠ podcast, brought to you by ⁠Rubrik Zero Labs⁠. In each episode, we discuss cybersecurity with thought leaders and industry experts, getting their take on trends, themes, and how they see data security evolving. This is a must-listen for security and IT leaders looking to better understand trends shaping data security and how they can achieve cyber resilience. 

In this episode, our host, ⁠Caleb Tolin⁠, is joined by ⁠Errol Weiss⁠, Chief Security Officer at ⁠Health-ISAC⁠ and former cybersecurity leader at ⁠Citi⁠ and ⁠Bank of America⁠. Errol shares his journey from the NSA to building one of the most collaborative threat intelligence networks in healthcare, discussing cyber recovery, the minimum viable hospital model, and why culture and community matter in achieving true resilience.

Errol Weiss has been a driving force in advancing cybersecurity resilience across critical sectors, beginning with his early work at the National Security Agency and later leading security programs at Citi and Bank of America. As Chief Security Officer at Health-ISAC, he built a threat operations center from the ground up, delivering original threat intelligence to healthcare organizations that often lack the resources to do it alone. With deep experience across consulting, finance, and healthcare, Errol has become a leading voice in shifting the conversation from protection to recovery, promoting a resilience-first mindset, collaborative intelligence sharing, and a human-centric security culture.

Join Caleb and Errol as they explore what makes healthcare cybersecurity unique, how to embed security into clinical culture, and why building a “human firewall” is just as critical as any technical control in today’s evolving threat landscape.

Episode Highlights:

Episode Resources:

Navigating Modern Cybersecurity: From Supply Chain Risks to AI Evolution. In this episode of ⁠Data Security Decoded⁠, ⁠Allison Wikoff⁠, a 20-year veteran in information security and threat intelligence, explores current cybersecurity challenges, emerging threats, and practical defensive strategies for organizations of all sizes.

What You'll Learn:

Key Insights:

Highlights:

[00:00:00] Vulnerability Exploitation Trends

Allison Wikoff reveals that vulnerability exploitation has become a dominant attack vector across both criminal and state-sponsored threat actors. The shift marks a departure from traditional assumptions that mainly espionage-focused groups leveraged vulnerabilities.

[04:30] Supply Chain Security Essentials  

Wikoff emphasizes that modern supply chain security requires looking beyond just your own organization's defenses. Organizations must thoroughly understand their vendors' access levels and potential impact on operations.

[07:23] AI in Cybersecurity: Reality vs Hype

Tolin shares that while AI adoption by threat actors is increasing, it hasn't revolutionized attack tactics as many feared. Current AI usage focuses mainly on improving phishing email quality and assisting with malware code generation.

[14:08] Threat Profile Development

Tolin advocates for organizations to start by understanding what assets would interest attackers rather than chasing every new threat. The rapidly changing threat landscape makes it impossible to defend against everything, requiring a focused approach based on your specific risk profile.

Episode Resources: 

AI-powered SOC platforms are revolutionizing cybersecurity by dramatically reducing false positives and enabling analysts to focus on high-value security work. In this episode of ⁠Data Security Decoded⁠, join ⁠Caleb Tolin⁠ as he sits down with ⁠Grant Oviatt⁠, Head of Security Operations at Prophet Security, to explore how AI agents are transforming security operations centers (SOCs) and reshaping the future of cyber defense.

What You'll Learn:

Highlights:

[02:57] Dramatic Reduction in False Positives Through AI-Driven Investigation

[07:21] AI Augmentation vs. Replacement: Elevating Security Roles

[09:34] Lowering Barriers to Entry in Cybersecurity

[17:41] Building Trust Through Transparent AI Operations

[21:58] Strategic Implementation of AI Security Solutions

Episode Resources:

In this episode of ⁠Data Security Decoded⁠, host ⁠Caleb Tolin⁠ sits down with ⁠Gabrielle Hibbert⁠, a social policy expert and researcher, about her innovative work developing a nutrition labeling system for generative AI tools. This framework aims to bridge the gap between complex AI technology and consumer understanding, while addressing critical transparency and data privacy concerns.

What You'll Learn:

Episode Highlights:

Episode Resources:

Welcome to the ⁠Data Security Decoded⁠ podcast by Rubrik Zero Labs. In this episode, our host ⁠Caleb Tolin⁠ speaks with ⁠Joe Hladik⁠, a veteran security expert with two decades of experience, to explore the evolving landscape of cybersecurity, incident response, and the critical challenges of data security in today's distributed environments.

What You'll Learn:

The conversation draws from "The State of Data Security: A Distributed Crisis," a new report from Rubrik Zero Labs, and provides practical insights into how organizations can better manage their data security posture while addressing emerging threats in an increasingly complex digital landscape.

Episode Highlights:

[20:05] Understanding Data Sprawl and Security Posture Management

[27:05] Identity Management as a Dynamic Security Challenge 

[08:40] The Evolution of Cyber Threats and Motivations

[32:28] The Future of Security Research and Response

Episode Resources:

Welcome to the ⁠Data Security Decoded⁠ podcast by Rubrik Zero Labs. In this episode, our host ⁠Caleb Tolin⁠ speaks with ⁠Pavlina Pavlova⁠, a researcher and cybersecurity advocate focusing on data weaponization and its disproportionate impact on vulnerable populations.

Pavlina defines data weaponization as using data to manipulate, deceive, coerce, or attack someone to inflict harm. Her research investigates why cyber attacks and their impacts often have gendered dimensions, with certain populations experiencing more severe consequences.

The conversation explores how attacks on critical infrastructure, particularly healthcare, create immediate impacts. While cyber attacks aren't becoming more sophisticated, they're growing more vicious. Ransomware attacks against healthcare facilities disproportionately affect women, who often serve as caregivers and rely more heavily on healthcare services.

Pavlina examines the geopolitical dimensions of cybercrime, noting how certain nations harbor cybercriminals aligned with their foreign policy goals. These sanctuary jurisdictions make accountability difficult and contribute to attacks aimed at disrupting societal resilience.

Join Caleb and Pavlina as they discuss policy frameworks addressing gender dimensions of data weaponization, explore international cooperation efforts, and share practical advice for under-resourced organizations to improve their cyber resilience despite limited funding. They also examine the critical role of responsible data collection and the importance of donors specifically allocating cybersecurity funding when supporting vulnerable organizations.

Episode Highlights:

Episode Resources: