Exploited: The Cyber Truth

As OT environments face rising geopolitical tensions, ransomware threats, and aging infrastructure, vulnerability management has never been more complex. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Stuxnet expert Ralph Langner, Founder and CEO of Langner, Inc.

Ralph shares from his decades of firsthand experience defending industrial control systems and explains why traditional CVE-focused vulnerability management falls short in OT. He breaks down the three major categories of OT vulnerabilities—design flaws, feature abuse, and configuration errors—and reveals why competent attackers often ignore CVEs entirely. Joe highlights how memory-based vulnerabilities continue to threaten critical systems and why eliminating entire vulnerability classes can create an asymmetric advantage for defenders.

Together, Ralph and Joe explore:

• Why most OT equipment remains insecure by design and why replacement will take decades
• How features, not bugs, often become the real attack vector
• The growing role of ransomware and IT-side weaknesses in OT compromises
• Practical steps OT defenders can take today to incrementally improve resilience
• The value of class-level protections, better architectures, and secure development processes

Whether you secure energy infrastructure, manufacturing systems, or mixed IT/OT networks, this episode delivers experience-driven guidance for strengthening cyber-physical resilience.

AI is fueling both innovation and new attack tactics. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security Founder and CEO Joseph M. Saunders and Kelly Davis, Senior Solutions Architect at Glasswall, to uncover how AI-powered malware is slipping through traditional detection in federal and defense environments—and what can be done about it.

Kelly breaks down how “clean file” strategies are redefining cybersecurity by ensuring only safe, verified content enters critical systems. Joe connects these insights to operational technology (OT), where malicious code can disrupt industrial operations, safety systems, and even national infrastructure.

Together, they explore:

• How AI is changing both attack and defense in cybersecurity
• Why detection-based security is too slow—and how AI is widening the gap
• How Content Disarm and Reconstruction (CDR) strengthens federal and defense workflows
• How federal agencies can adopt file-level defenses using pilots, boundary controls, and workflow APIs
• The parallels between clean files in IT and secure binaries in OT

Whether you’re defending national assets or securing industrial systems, this episode reveals why prevention—not detection—is the smartest defense in the AI era.

As healthcare becomes increasingly connected, cybersecurity is now as critical to patient safety as the devices themselves. In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security Founder and CEO Joseph M. Saunders to explore how medical device manufacturers can design protection into every phase of product development—from concept to deployment and beyond.

Joe discusses how medical device manufacturers are aligning innovation with evolving FDA and CISA cybersecurity expectations, embedding secure-by-design principles, and redefining engineering culture to treat security as part of product quality and not just compliance.

Listeners will learn:

• Why Secure by Design is critical for building safe, resilient medical devices from the start
• How FDA guidance has pushed manufacturers to treat cybersecurity as part of product design and is reshaping compliance in healthcare
• What a Software Bill of Materials (SBOM) is and why generating it at build time gives the clearest picture of software risk
• Why openness about software components helps reduce risk, even when it feels counterintuitive
• How standardizing development practices makes devices safer, lowers costs, and leaves more room for innovation
• 
  

For those developing life-critical devices or managing medtech risk, this episode explores how building security into every stage of design and development protects patients and sustains innovation in connected care.

When we think of generative AI in defense, many think of how it will be used on the frontlines. But it actually serves a much wider purpose in helping warfighters plan, prepare, and execute missions. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security Founder and CEO Joseph M. Saunders and Arthur Reyenger, Generative AI Strategy Executive at Ask Sage, Inc., to explore how generative AI is transforming defense missions—from planning to execution.

They discuss how AI-driven decision support, predictive analytics, and digital twins are giving defense teams faster insights and tactical advantages while maintaining trust, security, and control. The conversation looks at examples of how AI is accelerating acquisition processes, strengthening cybersecurity, and even supporting front-line logistics aboard Navy vessels.

Together, Joe and Arthur discuss:

• How generative AI accelerates decision-making and mission readiness
• The role of commercial off-the-shelf (COTS) AI in defense innovation
• Why responsible AI and human oversight remain critical
• How secure, scalable platforms are redefining operational impact

Whether you’re in defense, cybersecurity, or technology leadership, this episode sheds light on how generative AI is helping warfighters stay one step ahead.

CISA and DHS have raised the bar for software transparency with the first major update to the Minimum Elements for an SBOM since 2021—expanding what every software supplier must disclose. But what does this really mean for developers, embedded system teams, and security leaders trying to protect critical infrastructure?

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security’s Kelli Schwalm and CEO Joseph Saunders to unpack the technical and strategic impact of the 2025 SBOM draft.

Kelli explains key additions like component hashes, generation context, and transitive dependencies, and how they improve accuracy and traceability. Joe connects the dots to the bigger picture—how richer SBOMs enable resilience, transparency, and safer disclosure practices across the software supply chain.

Together, they explore:

• Why new SBOM data fields (like hashes and license metadata) matter for risk mitigation
• The ongoing challenges of SBOMs for embedded and C/C++ systems
• How stronger visibility supports secure vulnerability disclosure and compliance
• Why SBOMs are evolving from check-box compliance to core resilience tools

Whether you manage embedded software, oversee product security, or shape compliance policy, this episode reveals how the 2025 SBOM Minimum Elements is set to reshape software assurance for years to come.

Safeguarding critical infrastructure demands more than just technology—it requires unity. In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security CEO Joseph M. Saunders and Madison Horn, National Security & Critical Infrastructure Advisor at World Wide Technology, to explore how collaboration across government and industry is shaping a stronger, more secure future.

Madison shares insights from her work bridging the gap between policymakers and technologists, highlighting what “best-in-class” public-private partnerships look like and why security by design is a shared responsibility. Together, Madison and Joe unpack how AI, geopolitics, and legacy systems intersect in today’s cyber threat landscape and what it will take to build lasting resilience.

From aligning economic incentives to enabling secure-by-design innovation, this discussion underscores one essential truth: protecting critical infrastructure isn’t just a technical mission—it’s a collective one.

In this episode, you’ll learn:

• How collaboration between government and industry drives national cyber resilience
• What “best-in-class” public-private partnerships look like in practice
• The challenges of protecting legacy systems that were never built to be online
• How AI and emerging technologies are reshaping cyber defense and regulation
• Why secure-by-design principles must become a shared responsibility
• Where current policies succeed—and where leaders can push for meaningful change

The software supply chain often gets all the attention, but what about its foundation? In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joseph M. Saunders explores why securing the firmware supply chain is critical as attackers look to target the lowest layers of devices.

Joe explains how firmware vulnerabilities in embedded and connected devices—across healthcare, automotive, energy, and defense—can be exploited at scale, and why legacy assumptions about firmware trust are no longer enough. Listeners will learn:

• Tactics adversaries use to exploit firmware vulnerabilities
• Risks inherited from third-party firmware and complex supply chains
• How “shifting security down the stack” enhances trust for all systems above it
• Practical steps CISOs, security leaders, and device manufacturers can take to harden firmware

This episode uncovers an often-overlooked attack surface, showing why securing firmware is a strategic priority for reducing risk at scale.

As manufacturing systems and industrial control devices become increasingly connected, attackers are finding new ways to hijack machines, disrupt operations, and steal intellectual property. In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security Founder and CEO Joseph M. Saunders break down how embedded threats unfold and why manufacturers are in the crosshairs.

Joe shares real-world examples of water system breaches, programmable logic controller (PLC) exploits, and the dangers of memory-unsafe code that persists across legacy and modern systems. He explains how attackers weaponize software supply chain weaknesses and software determinism—and why preventing exploitation at build time is critical.

Topics discussed include:

• How adversaries infiltrate embedded and industrial devices
• The role of nation-state motivations, economic espionage, and insider threats
• Why memory-unsafe languages remain a root cause of critical vulnerabilities
• How Secure by Design practices and runtime protections can harden devices without disrupting operations
• What manufacturers must watch as AI-driven attack paths begin to emerge

For leaders responsible for protecting industrial systems, this episode offers a clear-eyed look at the risks and practical strategies to defend machines before they get hacked.

As advanced weapons platforms become increasingly software-driven, cybersecurity has emerged as a frontline concern for Aerospace & Defense. In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security CEO Joseph M. Saunders welcome Dave Salwen, VP of Embedded Systems at RunSafe Security, for a deep dive into the cultural and technical shifts required to defend tomorrow’s arsenal.

Dave explains why applying enterprise IT security models to mission-critical weapon systems is dangerously inadequate, how long patch cycles and software reuse create systemic vulnerabilities, and why proactive defense against unknown threats is essential. The conversation explores:

• How adversaries exploit software flaws in unpatched, mission-critical systems
• Why cultural change inside the DoD and its ecosystem is as vital as its technical defenses
• The role of Secure by Design in weapons development lifecycles
• The risks of open-source and supply chain dependencies in defense programs
• Why resilience and runtime defenses are critical to mission survivability

For defense leaders, program managers, and technologists, this episode highlights how adopting a new mindset around weapons cybersecurity is key to safeguarding national security.

Taiwan sits at the heart of the global economy, producing nearly 90% of the world’s advanced semiconductors. But with 2.4 million cyberattacks hitting the island daily, could a digital siege cripple it before a single missile is launched?

In this episode of Exploited: The Cyber Truth, host Paul Ducklin and RunSafe Security CEO and Founder Joseph M. Saunders examine Taiwan’s fragile critical infrastructure, exposed undersea cables, and dependence on imported energy—weaknesses that adversaries could exploit through cyber warfare and gray-zone tactics.

Drawing lessons from Ukraine and Israel, Joe and Paul explore:

• How Taiwan’s semiconductor “super sector” makes it a global cyber target
• Why energy and telecom resilience are linchpins of national survival
• The role of software supply chain security and memory safety in defense
• How the same cyber playbook could threaten U.S. and allied infrastructure

This sobering conversation underscores a vital truth: in the age of hybrid warfare, digital resilience is deterrence itself.