CISA and DHS have raised the bar for software transparency with the first major update to the Minimum Elements for an SBOM since 2021—expanding what every software supplier must disclose. But what does this really mean for developers, embedded system teams, and security leaders trying to protect critical infrastructure?

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security’s Kelli Schwalm and CEO Joseph Saunders to unpack the technical and strategic impact of the 2025 SBOM draft.

Kelli explains key additions like component hashes, generation context, and transitive dependencies, and how they improve accuracy and traceability. Joe connects the dots to the bigger picture—how richer SBOMs enable resilience, transparency, and safer disclosure practices across the software supply chain.

Together, they explore:

• Why new SBOM data fields (like hashes and license metadata) matter for risk mitigation
• The ongoing challenges of SBOMs for embedded and C/C++ systems
• How stronger visibility supports secure vulnerability disclosure and compliance
• Why SBOMs are evolving from check-box compliance to core resilience tools

Whether you manage embedded software, oversee product security, or shape compliance policy, this episode reveals how the 2025 SBOM Minimum Elements is set to reshape software assurance for years to come.

Safeguarding critical infrastructure demands more than just technology—it requires unity. In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security CEO Joseph M. Saunders and Madison Horn, National Security & Critical Infrastructure Advisor at World Wide Technology, to explore how collaboration across government and industry is shaping a stronger, more secure future.

Madison shares insights from her work bridging the gap between policymakers and technologists, highlighting what “best-in-class” public-private partnerships look like and why security by design is a shared responsibility. Together, Madison and Joe unpack how AI, geopolitics, and legacy systems intersect in today’s cyber threat landscape and what it will take to build lasting resilience.

From aligning economic incentives to enabling secure-by-design innovation, this discussion underscores one essential truth: protecting critical infrastructure isn’t just a technical mission—it’s a collective one.

In this episode, you’ll learn:

• How collaboration between government and industry drives national cyber resilience
• What “best-in-class” public-private partnerships look like in practice
• The challenges of protecting legacy systems that were never built to be online
• How AI and emerging technologies are reshaping cyber defense and regulation
• Why secure-by-design principles must become a shared responsibility
• Where current policies succeed—and where leaders can push for meaningful change

The software supply chain often gets all the attention, but what about its foundation? In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joseph M. Saunders explores why securing the firmware supply chain is critical as attackers look to target the lowest layers of devices.

Joe explains how firmware vulnerabilities in embedded and connected devices—across healthcare, automotive, energy, and defense—can be exploited at scale, and why legacy assumptions about firmware trust are no longer enough. Listeners will learn:

• Tactics adversaries use to exploit firmware vulnerabilities
• Risks inherited from third-party firmware and complex supply chains
• How “shifting security down the stack” enhances trust for all systems above it
• Practical steps CISOs, security leaders, and device manufacturers can take to harden firmware

This episode uncovers an often-overlooked attack surface, showing why securing firmware is a strategic priority for reducing risk at scale.

As manufacturing systems and industrial control devices become increasingly connected, attackers are finding new ways to hijack machines, disrupt operations, and steal intellectual property. In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security Founder and CEO Joseph M. Saunders break down how embedded threats unfold and why manufacturers are in the crosshairs.

Joe shares real-world examples of water system breaches, programmable logic controller (PLC) exploits, and the dangers of memory-unsafe code that persists across legacy and modern systems. He explains how attackers weaponize software supply chain weaknesses and software determinism—and why preventing exploitation at build time is critical.

Topics discussed include:

• How adversaries infiltrate embedded and industrial devices
• The role of nation-state motivations, economic espionage, and insider threats
• Why memory-unsafe languages remain a root cause of critical vulnerabilities
• How Secure by Design practices and runtime protections can harden devices without disrupting operations
• What manufacturers must watch as AI-driven attack paths begin to emerge

For leaders responsible for protecting industrial systems, this episode offers a clear-eyed look at the risks and practical strategies to defend machines before they get hacked.

As advanced weapons platforms become increasingly software-driven, cybersecurity has emerged as a frontline concern for Aerospace & Defense. In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security CEO Joseph M. Saunders welcome Dave Salwen, VP of Embedded Systems at RunSafe Security, for a deep dive into the cultural and technical shifts required to defend tomorrow’s arsenal.

Dave explains why applying enterprise IT security models to mission-critical weapon systems is dangerously inadequate, how long patch cycles and software reuse create systemic vulnerabilities, and why proactive defense against unknown threats is essential. The conversation explores:

• How adversaries exploit software flaws in unpatched, mission-critical systems
• Why cultural change inside the DoD and its ecosystem is as vital as its technical defenses
• The role of Secure by Design in weapons development lifecycles
• The risks of open-source and supply chain dependencies in defense programs
• Why resilience and runtime defenses are critical to mission survivability

For defense leaders, program managers, and technologists, this episode highlights how adopting a new mindset around weapons cybersecurity is key to safeguarding national security.

Taiwan sits at the heart of the global economy, producing nearly 90% of the world’s advanced semiconductors. But with 2.4 million cyberattacks hitting the island daily, could a digital siege cripple it before a single missile is launched?

In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security CEO and Founder Joseph M. Saunders examine Taiwan’s fragile critical infrastructure, exposed undersea cables, and dependence on imported energy—weaknesses that adversaries could exploit through cyber warfare and gray-zone tactics.

Drawing lessons from Ukraine and Israel, Joe and Paul explore:

• How Taiwan’s semiconductor “super sector” makes it a global cyber target
• Why energy and telecom resilience are linchpins of national survival
• The role of software supply chain security and memory safety in defense
• How the same cyber playbook could threaten U.S. and allied infrastructure

This sobering conversation underscores a vital truth: in the age of hybrid warfare, digital resilience is deterrence itself.

Is patching enough to secure critical systems? In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with Joe Saunders, Founder and CEO of RunSafe Security, to challenge the idea that vulnerabilities can be solved after software ships.

Joe explains why embedded systems and critical infrastructure demand a different approach—one that builds protections in from the start. He unpacks:

• Why patching after deployment creates dangerous gaps for attackers
• How build-time memory safety and code-hardening disrupt exploitation
• The software supply chain risks of relying on incomplete SBOMs
• Real-world examples of how build-time defenses reduce costly downtime and post-production scrambles

If you’re leading a program of record, developing embedded systems, or managing software security, this conversation reveals why “Secure by Design” is the only way forward.

What do drivers really think about the cyber and safety risks in connected and autonomous vehicles? In this episode of Exploited: The Cyber Truth, host Paul Ducklin speaks with Joe Saunders, CEO and Founder of RunSafe Security, about the findings from RunSafe’s 2025 Connected Car Cyber Safety & Security Survey. With responses from 2,000 drivers across the U.S., U.K., and Germany, the survey uncovers how consumers weigh safety, privacy, and trust in the cars of today and tomorrow.

Joe shares insights into:

• Why 65% of drivers believe remote hacking is possible
• Why 79% prioritize physical safety over personal data privacy
• How 87% say strong cybersecurity would influence their buying decision
• The role of over-the-air updates and what consumers fear most about them
• How trust in cybersecurity could shape brand loyalty alongside performance and fuel economy

Tune in to learn why cybersecurity is quickly becoming the next must-have feature for connected vehicles.

How do you respond when a vulnerability opens the door to your most sensitive data? In this urgent episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guest Ron Reiter, CTO and co-founder of Sentra, to dissect the SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771) that have already impacted hundreds of organizations, including U.S. government agencies.

Ron explains why this remote code execution flaw is more dangerous than most, how attackers exploit unauthenticated access to steal contracts, customer records, and intellectual property, and why patching alone won’t keep systems safe. Joe underscores the downstream risks for operational technology (OT), where attackers can pivot from IT breaches to disrupt industrial environments.

You’ll learn:

• Why SharePoint servers are a high-value target for attackers
• The real risk when IT breaches spill into OT environments
• Why compliance isn’t enough without true customer data protection
• Three  steps for security leaders to gain an organization-wide view of cyber security

This episode is a wake-up call for integrated, resilient cybersecurity that safeguards both corporate data and critical operations.

How do you protect the beating heart of modern manufacturing—smart factories—from equally smart attackers?

In this episode of Exploited: The Cyber Truth, host Paul Ducklin speaks with Joe Saunders, CEO and Founder of RunSafe Security, about the complex risks inside today’s highly connected industrial environments.

Joe shares insights into:

• Why the Purdue security model falls short in the cloud and IoT era
• How attackers gain value from even “read-only” factory access
• The role of standards like IEC 62443 in raising security posture
• Why software quality and Secure by Design practices matter as much as compliance
• Extending the life of legacy systems with memory safety protections

From factory floor sensors to enterprise IT systems, this conversation unpacks what manufacturers, suppliers, and operators can do to stay one step ahead of motivated adversaries.