In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security CEO Joseph M. Saunders to unpack the EU Cyber Resilience Act (CRA)—a sweeping new regulation set to reshape software security across Europe and beyond.

With enforcement on the horizon in 2026, Joe breaks down what the CRA means for manufacturers, developers, and supply chain partners today. From the critical role of Software Bill of Materials (SBOMs) to the shifting landscape of liability, we explore how the CRA is raising the bar for Secure by Design software.

Joe also shares how leading organizations are preparing now and why cyber insurance may play a bigger role in the CRA era, even when best practices are followed.

In this episode:

• What the CRA covers and who it affects
• Why SBOMs are central to compliance and trust
• How the law shifts liability for software flaws
• Real-world prep strategies from industry leaders
• The role of cyber insurance in a post-CRA world

If your business touches software, this is one regulation you can’t afford to ignore.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with Joe Saunders, Founder & CEO of RunSafe Security, to unpack the real meaning behind “Secure by Design”—and why it’s more than just the latest industry buzzword. As cyber threats escalate in scale and sophistication, building security into software from the start has become not only best practice but a national imperative.

Joe shares why RunSafe signed CISA’s Secure by Design pledge and the bold steps the company is taking to meet its goals, including a transition from C++ to Rust to eliminate entire classes of memory safety vulnerabilities. He also explains how organizations can implement Secure by Design principles—without overhauling their entire codebase—using techniques like runtime exploit prevention.

In this episode:

• Why “Secure by Design” is the future of software development
• What the CISA pledge means—and why RunSafe joined it
• How transitioning to Rust addresses deep-rooted memory safety issues
• Practical ways to harden existing systems without starting from scratch
• How Secure by Design supports national security and critical infrastructure protection

In this episode of “Exploited: The Cyber Truth,” host Paul Ducklin returns with Joe Saunders, CEO and Founder of RunSafe Security, to dissect the alarming Salt Typhoon campaign that infiltrated major telecommunications companies across the United States and beyond. This Chinese state-sponsored group has been quietly harvesting sensitive communications data for at least two years, including potentially accessing conversations of high-profile political figures.

Joe explains how Salt Typhoon represents China’s long-term strategic approach to cyber espionage—playing the long game with well-funded teams operating globally. The discussion explores how attackers exploited vulnerabilities in Cisco routers to create their own backdoor access, compromising hundreds of thousands of devices simultaneously.

In this episode:

• How Salt Typhoon cleverly subverted “lawful intercept” infrastructure designed for legitimate government surveillance, turning it against its creators
• Why fileless malware like the “Demodex” rootkit makes detection nearly impossible by operating only in memory
• The surprising connection between video game cheating software and nation-state hacking tools
• Why metadata collection is a powerful intelligence tool, revealing critical patterns even without accessing conversation content
• Practical approaches to defense-in-depth security and the importance of memory safety in preventing these sophisticated attacks
• The need for systematic approaches to security rather than just patching individual vulnerabilities after discovery

In the debut episode of “Exploited: The Cyber Truth,” host Paul Ducklin talks with Joseph M. Saunders, CEO and Founder of RunSafe Security, about the serious threat Volt Typhoon poses to critical infrastructure in the U.S. and beyond. What makes this Chinese state-sponsored group so dangerous, and how are they exploiting the software in devices that make our world run?

Joe breaks it all down, explaining the big-picture geopolitical motivations behind these attacks. You’ll also learn how attackers use memory-based vulnerabilities to quietly gain long-term access to critical systems without leaving obvious clues.

In this episode:

• How Volt Typhoon is targeting critical infrastructure in sectors like transportation, communications, and financial services to create potential footholds for future conflicts
• Why memory-based vulnerabilities are a major risk, enabling attacks that are hard to detect and trace
• Practical ways to secure systems—like rewriting code in memory-safe languages or using advanced memory protection techniques like load-time function randomization
• How Secure by Design and Secure by Demand initiatives can drive adoption of practices to improve cybersecurity in critical infrastructure