Exploited: The Cyber Truth

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security Founder and CEO Joe Saunders and returning guest Hemanth Tadepalli, Senior Cybersecurity and Compliance Manager at May Mobility, to explore why cybersecurity and safety are becoming inseparable as software takes control of vehicles and other critical systems.

Drawing on his experience securing autonomous mobility platforms, Hemanth explains how connected vehicles have expanded the attack surface across software, cloud infrastructure, APIs, sensors, AI models, and supply chains. Joe explores how organizations can build resilience into software, protect legacy and resource-constrained systems, and move beyond the costly cycle of finding, patching, and deploying fixes.

Together, Joe and Hemanth discuss:

• Why cyber-physical systems require a different security mindset
• How autonomous vehicles connect cybersecurity with physical safety
• Why compliance should be a baseline—not the end goal
• How AI is changing both cyberattacks and defense
• Where software resilience and runtime protection fit
• Why public trust depends on consistency, transparency, and safety
• How security, engineering, and compliance teams can work together

Whether you secure autonomous vehicles, industrial equipment, medical devices, or other critical systems, this episode offers practical lessons for building software that is secure, resilient, and worthy of public trust.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security Chief Strategy Officer Doug Britton and special guest Andrew Ginter, Vice President of Industrial Security at Waterfall Security Solutions, an author, and a leading voice in OT cybersecurity.

Andrew explains why industrial security cannot simply borrow the same tools and practices used in enterprise IT. In OT environments, the physical process is the asset, and malicious information entering the system can become the threat. Doug explores how organizations can reduce exploitability, protect existing software, and maintain deterministic behavior without relying solely on disruptive patching cycles.

Together, Doug and Andrew explore:

• Why OT security must be stronger than traditional IT security
• How cyber attacks can create real-world safety and operational consequences
• The risks created by IT/OT convergence
• How cyber-informed engineering strengthens industrial resilience
• The role of unidirectional gateways and deterministic protections
• Why patch management alone cannot keep pace with AI-driven threats

For critical infrastructure leaders, engineers, and security teams, this episode offers a practical look at designing industrial systems that remain safe, reliable, and resilient when cyber threats become physical.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guest Derrick Bethea, NERC Compliance Manager and OT Cybersecurity Leader at Cypress Creek Energy, for an inside look at how utilities and renewable energy operators prepare for, respond to, and recover from cyber incidents.

Drawing on years of experience securing operational technology (OT) environments, Derrick explains why incident response plans must be tested—not just documented—and how organizations navigate the complex intersection of cybersecurity, regulatory compliance, and operational resilience. Joe explores how AI is changing both cyber defense and attacker capabilities, why legacy infrastructure presents unique security challenges, and how security-by-design and security-by-demand must work together to strengthen the energy sector.

Together, Joe and Derrick discuss:

• Why OT incident response differs from traditional IT security
• The realities of NERC CIP compliance and regulatory reporting
• How AI is accelerating vulnerability discovery across critical infrastructure
• Why security must be part of procurement and engineering decisions
• The importance of testing incident response plans before an emergency occurs
• How utilities can balance innovation with operational resilience

Whether you secure power generation, renewable energy assets, industrial control systems, or other critical infrastructure, this episode offers practical lessons for strengthening cyber resilience before the next incident occurs.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Lt. Gen. (Ret.) Bill Bender, former Chief Information Officer of the U.S. Air Force, to discuss what it takes to build true cyber resilience across some of the world's most complex digital environments.

Drawing on his experience overseeing a $17 billion IT portfolio and helping establish the first Chief Information Security Officer (CISO) and Chief Data Officer (CDO) offices within the Department of Defense, Bender explains why organizations must move beyond checklist-driven security and adopt a mission-focused approach to risk management.

Together, they explore:

• Why compliance alone cannot secure mission-critical systems
• Building cybersecurity leadership, accountability, and culture at scale
• Managing technical debt and long-lived systems that cannot easily be replaced
• The role of Zero Trust in protecting complex defense environments
• How software supply chains and SBOMs support mission assurance
• Why public-private collaboration is essential for modernization and innovation
• The growing impact of AI on cyber defense and critical infrastructure security

From defense acquisition to critical infrastructure protection, this episode examines how organizations can strengthen resilience.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Shane Fry, CTO of RunSafe Security, and Andrew McPhee, Solutions Manager for Industrial Security at Cisco, to examine why visibility is one of the biggest challenges in OT cybersecurity.

As industrial environments become more connected, organizations are struggling to identify unknown assets, understand hidden dependencies, and secure systems that were never designed with cybersecurity in mind. McPhee explains how attackers exploit these blind spots, why traditional IT security approaches often fall short in OT environments, and how visibility and segmentation can help reduce risk.

Together, they explore:

• Why asset visibility is the foundation of OT security
• How unknown assets and communication pathways create risk
• The differences between active and passive asset discovery
• Why segmentation remains one of the most effective OT security controls
• How IT/OT convergence is expanding the attack surface
• The role of risk tolerance and risk acceptance in security decisions

From manufacturing facilities to critical infrastructure, this episode explores what security teams must understand before they can effectively protect the systems they depend on.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joseph M. Saunders and Danielle “DJ” Jablanski, Cybersecurity Consulting Program Lead for Operational Technology at STV and former OT Cybersecurity Strategist at CISA, to examine what defenders often get wrong about attacks on critical infrastructure.

With experience across government, threat intelligence, engineering, and industrial environments, DJ explains why sectors like water, rail, energy, and manufacturing require a different way of thinking about cybersecurity.

Together, they explore:

• How cyber-physical risk differs from traditional IT risk
• Why attacks can target engineering logic, process variables, and safety systems
• The challenge of securing long-lived OT assets and heterogeneous environments
• How visibility, asset identification, and segmentation shape OT defense
• Why secure-by-design and secure-by-demand both matter
• Why patching alone cannot keep up with distributed critical infrastructure

From water systems to transportation networks, this episode breaks down what security leaders, asset owners, OEMs, and operators must understand to stay ahead of cyber-physical threats.

In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joe Saunders and EVP and CSO Doug Britton join us for a strategic discussion on what Anthropic’s “Mythos moment” means for the future of cyber defense.

Joe and Doug explore why AI-driven vulnerability discovery marks a fundamental turning point for enterprises, critical infrastructure, and national security. As AI accelerates the discovery and weaponization of vulnerabilities, traditional patch-and-remediate strategies are becoming increasingly unsustainable, especially for safety-critical and mission-critical systems that cannot be patched quickly or frequently.

Together, Joe and Doug examine:

• Why “find and fix” alone cannot scale in the AI era
• How AI is shifting the balance between attackers and defenders
• Why patch timelines are widening as vulnerability discovery accelerates
• The growing need for resilience-based cybersecurity
• How organizations can reduce exploitability without rewriting legacy systems
• Why mitigation technologies are becoming essential for critical infrastructure and national security

Whether you secure embedded systems, manage cyber risk across critical infrastructure, or lead product security strategy, this episode makes the case for a new approach: one built not around chasing every vulnerability faster, but around ensuring systems remain resilient even when flaws exist.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Greg Garcia, Executive Director for Cybersecurity of the Health Sector Coordinating Council (HSCC) Cybersecurity Working Group, to examine how ransomware, third-party dependencies, and interconnected healthcare infrastructure are shaping cyber risk across the healthcare sector.

Drawing on experience spanning DHS, critical infrastructure protection, and healthcare cybersecurity coordination, Garcia explains how disruptions at a single vendor or service provider can cascade across hospitals, pharmacies, insurers, and patients nationwide.

Together, they explore:

• Why healthcare cyber risk is shifting from isolated breaches to systemic disruption
• How ransomware and third-party compromises create cascading operational impacts
• Lessons from the Change Healthcare ransomware attack
• The growing challenge of securing connected healthcare systems and medical devices
• Why patching alone cannot keep pace with modern cyber threats
• The role of collaboration and resilience in protecting critical healthcare infrastructure

From healthcare providers and medical device manufacturers to policymakers and critical infrastructure leaders, this episode explores what organizations must understand to prepare for the next generation of healthcare cyber threats.

Artificial intelligence is moving faster than the policies, security controls, and acquisition processes designed to govern it—especially in national security environments where preventing failure is mission-critical.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Nicolas Chaillan, the host of In the Nic of Time and Former DAF CSO, to examine a central question: how do you build trust in systems that operate, adapt, and make decisions at machine speed?

Drawing on his experience deploying DevSecOps across the Department of Defense and building large-scale AI platforms, Chaillan offers a direct perspective on what’s working, what isn’t, and where organizations are falling behind.

Together, they explore:

• Why multi-model AI strategies are critical to avoid lock-in and improve outcomes
• How AI is accelerating software development, testing, and security workflows
• Where policy and governance are lagging behind technical reality
• The risks of restricting access to critical AI capabilities
• What zero trust looks like in systems driven by automation and AI

From defense systems to software pipelines, this episode examines what it takes to move fast without losing control—and what leaders need to understand as AI becomes embedded across the mission stack.

Embedded systems power everything from critical infrastructure to defense systems, yet vulnerabilities in those systems often go unseen and unaddressed. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guests Mario Zuniga and Matt Janson of MITRE to discuss the “invisible attack surface” lurking within embedded and cyber-physical systems.

Drawing on their frontline experience in cyber operations and resiliency engineering, Mario and Matt explain why embedded systems demand a fundamentally different approach to cybersecurity. From limited patching capabilities and long system lifecycles to unique hardware and firmware attack vectors, traditional IT security models fall short in these environments.

Together, they discuss:

• Why embedded systems are often overlooked in cybersecurity strategies
• How attackers exploit firmware, hardware interfaces, and air-gapped environments
• The challenges of securing systems that must remain operational for decades
• The role of MITRE’s embedded threat matrix (ESTEEM) in mapping adversary behavior
• Why resilience—not just prevention—is key to defending critical infrastructure

From industrial control systems to national defense, this episode reveals what it takes to secure the technologies that quietly underpin modern society and why the time to act is now.