Exploited: The Cyber Truth

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Patrick Garrity, Security Researcher at VulnCheck, and RunSafe Security CEO Joe Saunders for a deep dive into the hidden lifecycle of vulnerabilities—and why many threats are exploited long before public disclosure.

As embedded systems grow more complex, attackers are moving faster, exploiting flaws before most organizations even know they exist. Patrick shares research on how frequently vulnerabilities are weaponized prior to disclosure and what that means for defenders across critical infrastructure, OT environments, and embedded technologies.

Together, the group explores how hidden software dependencies, insufficient supply chain visibility, and outdated components create long-term blind spots for security teams. They also discuss actionable strategies, from Software Bills of Materials (SBOMs) to proactive disclosure, that help organizations build more resilient systems.

Topics covered:

• Why exploitation often occurs before vulnerabilities are publicly disclosed
• The hidden risks in embedded systems and opaque supply chains
• How SBOMs and build-time visibility can help mitigate inherited risk
• The importance of security maturity in long-lifecycle product environments
• What organizations can do today to reduce risk and increase resilience

Whether you're in cybersecurity, product development, or managing legacy infrastructure, this episode will reshape how you think about vulnerability intelligence and embedded system security.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security Founder and CEO Joe Saunders to explore the urgent and evolving risks facing medical devices in healthcare. Based on RunSafe’s 2025 Medical Device Cybersecurity Index—an extensive survey of over 600 healthcare leaders across the U.S., UK, and Germany—they unpack how cyberattacks are no longer limited to hospital IT networks but are now directly compromising connected medical devices, threatening patient care in real time.

From real-world consequences like forced patient transfers and increased downtime, to the rising willingness of healthcare organizations to pay premiums for secure devices, this conversation reveals how cybersecurity is reshaping healthcare operations and procurement strategies. Joe explains why securing medical devices requires a fundamentally different approach than traditional IT, the growing intersection of IT and operational technology (OT) risks, and why regulatory standards are more critical than ever for patient safety.

Topics covered:

• Real impacts of cyberattacks on medical devices and patient care
• Why 46% of healthcare organizations have declined to buy devices lacking strong security
• The unique challenges of securing medical devices versus traditional IT systems
• The convergence of IT and OT security risks in healthcare environments
• The rising importance of Software Bills of Materials (SBOMs) in medical device procurement
• Advice for device manufacturers adapting to a security-first healthcare market

If you’re involved in healthcare, medical device manufacturing, or cybersecurity, this episode offers vital insights into the new front lines of protecting patient care in a connected world.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by Ocean Aero’s Michael “Sparky” Braun and RunSafe Security Founder and CEO Joe Saunders for a deep dive into the vulnerabilities and opportunities in autonomous maritime defense.

As navies deploy autonomous vehicles on—and below—the water’s surface, this conversation explores the overlooked cybersecurity risks that threaten their resilience and effectiveness. Sparky shares Ocean Aero’s vision for solar- and wind-powered autonomous vessels capable of weeks-long missions while Joe breaks down the need for embedded security to ensure these systems can operate safely in contested environments.

Topics covered:

• How autonomous maritime vehicles reshape modern defense strategy
• Interoperability challenges and the need for Secure by Design systems
• Why nations like South Korea are shifting from traditional assets to autonomous fleets
• Risks posed by supply chain vulnerabilities and insecure software components

Whether you're in defense, critical infrastructure, or cybersecurity, this is a must-listen discussion on protecting mission-critical systems in an increasingly connected battlespace.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin tackles a core challenge in healthcare cybersecurity: how can medical device manufacturers and healthcare organizations secure legacy systems and meet FDA expectations—without rewriting a single line of code?

Guests Phil Englert, VP of Medical Device Security at Health-ISAC, and Joe Saunders, CEO of RunSafe Security, bring decades of experience to a candid discussion on what practical, compliance-ready security looks like when device updates or patches aren’t an option.

They explore how to protect long-life medical devices with limited support, how to interpret and align with evolving FDA premarket and postmarket guidance, and how tools like SBOMs are reshaping transparency and accountability in the healthcare ecosystem. The conversation emphasizes the shared responsibility between manufacturers and providers to prioritize both cybersecurity and patient safety.

In this episode:

• What “security without code changes” really means in healthcare
• Why legacy medical devices are difficult to secure—and what still can be done
• The importance of SBOMs for transparency and visibility
• How evolving FDA expectations are influencing both manufacturers and providers
• Why cybersecurity and patient safety must now go hand in hand

If you're navigating regulatory demands or simply trying to protect vulnerable medical systems, this episode offers grounded insights and real-world strategies.

In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joseph M. Saunders returns to explore one of the most urgent challenges in modern transportation: securing the software-defined vehicle.

As connected cars grow more complex—with over 100 million lines of code and dozens of software components—they also become more vulnerable. Joe joins host Paul Ducklin to unpack how Secure by Design principles can help OEMs and suppliers address these risks before they hit the road.

We dive into why memory safety is foundational for protecting embedded systems like ECUs and infotainment units, and how the CAN bus and real-time operating systems factor into broader security decisions. Joe also explains how industry frameworks like ISO 26262 and ASIL (Automotive Safety Integrity Level) classifications help automotive teams align cybersecurity with functional safety goals.

If you're working on embedded systems, vehicle software, or supply chain security in the automotive world, this episode breaks down what it really takes to build safe, secure, and resilient vehicles—right from the start.

In this episode:

• Why vehicles have become such attractive cyber targets—and how criminals are exploiting remote attack vectors
• What “Secure by Design” really means for ECUs, infotainment systems, and embedded firmware
• How to manage software risk across global, multi-tier automotive supply chains
• Why memory safety is key to preventing attacks before they happen
• How ASIL safety levels guide critical system design and compliance
• The role of SBOMs, OTA updates, and RTOS security in future-proofing connected cars
• What a “shift left” approach actually looks like for automotive cybersecurity teams

If you’re building or securing the next generation of connected vehicles, this episode delivers critical insights on embedding cybersecurity into the foundation—not the finish line—of automotive innovation.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin dives into one of cybersecurity’s most persistent questions: Can companies actually get ahead of zero-day vulnerabilities—or are we all just chasing shadows?

Joining the conversation are Steve Barriault, VP of Sales & Solutions Engineering North America, Japan and Korea at TrustInSoft, and Joe Saunders, Founder and CEO of RunSafe Security. Together, they bring two distinct but complementary strategies to the table: code-level certainty and runtime protection.

Steve outlines how formal methods and mathematical analysis—long used in safety-critical sectors like avionics—can reduce exploitable bugs to near-zero before code ever ships. Joe shares how runtime defenses like memory layout randomization offer critical safeguards for systems that can’t be patched, such as those in legacy infrastructure.

We explore the growing complexity of the software supply chain, why embedded devices pose a uniquely difficult challenge, and how new regulations are forcing companies to think differently about software assurance and liability.

In this episode:

• Why zero days remain so hard to prevent and detect
• How formal verification can help eliminate vulnerabilities
• What makes embedded systems especially vulnerable to zero-day exploitation
• When patching isn’t possible, what protection strategies still work
• How upcoming regulations like the EU Cyber Resilience Act are changing the game
• What a multi-layered defense actually looks like in practice

Whether you're a CISO, security engineer, or software leader, this episode offers a frank look at what it really takes to stay ahead of invisible threats.

In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joe Saunders joins host Paul Ducklin to uncover one of the most overlooked threats in critical infrastructure: embedded risk.

As industrial systems become more automated and interconnected, embedded devices—once isolated—have become prime targets for attackers. Joe explains why embedded risk differs fundamentally from traditional IT threats, and why legacy systems, unmanaged endpoints, and obscure firmware pose some of the biggest risks to operational technology today.

We explore what makes embedded vulnerabilities so hard to find and fix, how real-time operating systems factor into security decisions, and why patching isn’t always an option in industrial settings. Joe also shares how Secure by Design, SBOMs, and exploit prevention strategies can help CISOs break free from the endless patch cycle and proactively reduce risk.

In this episode:

• What “embedded risk” really means for industrial environments
• Why legacy devices are so difficult—and dangerous—to secure
• How to rethink security when patching isn’t possible
• The real role of SBOMs in managing software supply chain risk
• Why real-time operating systems demand a different security mindset
• What every CISO should prioritize to protect safety and uptime

If you’re responsible for securing factory floors, OT networks, or embedded systems—this is a must-listen conversation.

In this episode of Exploited: The Cyber Truth, RunSafe Security Founder and CEO Joseph M. Saunders returns to confront a critical question: With nearly 70% of industrial firms hit by OT cyberattacks last year, can we actually fix OT security—or are we forever stuck in a cycle of reaction?

Joe takes a hard look at the current state of operational technology security, exposing why legacy systems running our power grids, water plants, and factories remain dangerously vulnerable. He also unpacks the NSA’s April 2025 guidance on Smart Controller Security and what it signals for the future of critical infrastructure protection.

We discuss the real risks behind outdated architectures, the shortcomings of so-called “security solutions,” and why Secure by Design must replace “patch and pray.” With a focus on practical defense strategies—not buzzwords—Joe shares what CISOs can do right now, even on limited budgets, to mitigate OT risk.

In this episode:

• Why OT environments are still so vulnerable
• The impact of new NSA guidance on Smart Controller Security
• What “Secure by Design” actually looks like in OT systems
• How to cut through “security theater” and address real risks
• What every mid-sized industrial org should prioritize today
• Whether a wake-up call OT event is looming—or already here

If you're responsible for securing critical infrastructure—or simply rely on it—this is a conversation you can’t afford to miss.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with RunSafe Security CEO Joseph M. Saunders to unpack the EU Cyber Resilience Act (CRA)—a sweeping new regulation set to reshape software security across Europe and beyond.

With enforcement on the horizon in 2026, Joe breaks down what the CRA means for manufacturers, developers, and supply chain partners today. From the critical role of Software Bill of Materials (SBOMs) to the shifting landscape of liability, we explore how the CRA is raising the bar for Secure by Design software.

Joe also shares how leading organizations are preparing now and why cyber insurance may play a bigger role in the CRA era, even when best practices are followed.

In this episode:

• What the CRA covers and who it affects
• Why SBOMs are central to compliance and trust
• How the law shifts liability for software flaws
• Real-world prep strategies from industry leaders
• The role of cyber insurance in a post-CRA world

If your business touches software, this is one regulation you can’t afford to ignore.

In this episode of Exploited: The Cyber Truth, host Paul Ducklin sits down with Joe Saunders, Founder & CEO of RunSafe Security, to unpack the real meaning behind “Secure by Design”—and why it’s more than just the latest industry buzzword. As cyber threats escalate in scale and sophistication, building security into software from the start has become not only best practice but a national imperative.

Joe shares why RunSafe signed CISA’s Secure by Design pledge and the bold steps the company is taking to meet its goals, including a transition from C++ to Rust to eliminate entire classes of memory safety vulnerabilities. He also explains how organizations can implement Secure by Design principles—without overhauling their entire codebase—using techniques like runtime exploit prevention.

In this episode:

• Why “Secure by Design” is the future of software development
• What the CISA pledge means—and why RunSafe joined it
• How transitioning to Rust addresses deep-rooted memory safety issues
• Practical ways to harden existing systems without starting from scratch
• How Secure by Design supports national security and critical infrastructure protection