Full Metal Packet Cybersecurity Podcast

Isaac Straley is CISO at the J. Paul Getty Trust and formerly served as CISO at the University of Toronto, where he helped build CanSSOC, Canada's first shared security operations center across universities and colleges.

Higher education might be the hardest place to do security. You cannot mandate anything. Policy means almost nothing without buy-in. And the people you are trying to protect are grad students filing taxes at the last possible second because that refund is how they pay rent.

In 2008, Isaac started getting phone calls. Not alerts. Not system flags. Students calling him directly saying someone had already filed their tax return.

What started as a handful of phone calls turned into a criminal investigation, a cross-country flight, and a fake tax processing office that had monitors and keyboards and absolutely nothing else inside it.

He has been thinking about that case for 18 years. And it still shapes everything he builds.

What we cover in this EP:

◼ Why security in higher ed runs on peer influence rather than authority and what that actually demands from a CISO

◼ How six Canadian universities pooled threat signals and started blocking attacks across institutions in minutes

◼ The 2008 grad student identity theft case: one phone call, 150 victims, a fake tax front, and one document nobody knew still existed

◼ When the breach belongs to your vendor but the students still come to you

◼ Why your playbook will break on every real incident and why that is the most valuable thing that can happen

(0:00) – Isaac's background and the higher ed security landscape

(02:12) – Why policy carries no weight at a university

(05:31) – Real technical differences versus people who just want to do it their way

(09:02) – How CanSSOC started and why six universities could not go it alone

(12:21) – Shared threat feeds blocking attacks across institutions in minutes

(17:25) – Peer reviewed command and control: influence that actually moves people

(21:27) – 2008: students report tax fraud before any alert fires

(25:06) – Isolating the cohort and following the data everywhere it went

(28:35) – Communicating with victims when the picture is still incomplete

(35:31) – The evidence that pointed to a third party supplier

(38:25) – A fake tax front, a subpoena, and a document nobody knew existed

(44:08) – Your playbook will break and that is the point

(51:32) – Supply chain vetting and why contracts are the floor not the ceiling

(1:00:38) – Citizen Lab, nation-state attention, and high-risk research

(1:07:25) – How to map threats you cannot fully see yet

Guest ⬇️

Isaac Straley

Hosts ⬇️

Yegor Sak & Alex Paguis (Control D)

Powered by Control D

Andrew Wertkin is Chief Strategy Officer at BlueCat and has spent over a decade working with some of the world's largest enterprises on DNS, DHCP, and IP address management.

BlueCat has been in the DDI business for 24 years, processing hundreds of billions of DNS queries a month across customers in finance, healthcare, manufacturing, retail, and education. Andrew spends a significant amount of that time inside customer environments when things go wrong, which gives him a ground-level view of where enterprise security and network observability actually break down.

EP #17 goes deep on DNS as a signal and control plane. Not the marketing version. The version where a spike in query traffic turns out to be a buggy MDM agent, where encrypted DNS quietly kills the visibility your security team depends on, and where a major outage call turns into nine teams trying to prove it was someone else's problem.

Andrew doesn't pitch. He explains the tradeoffs, names the failure patterns, and makes the case for why most enterprises are sitting on more DNS intelligence than they know what to do with.

What we cover in this EP:

◼ Why DNS is still criminally underused as a security control plane in most enterprises, even in 2026

◼ The encrypted DNS tradeoff nobody talks about: DoH gives you privacy and costs you visibility, and why DoT is the more honest option for enterprise networks

◼ How BlueCat uses IPAM metadata to flip DNS from a blocklist to a behavioral allowlist based on what each device type should actually be querying

◼ The false alarm war stories: a hundredfold query spike that turned out to be a buggy MDM agent, and a UDP-to-TCP fallback that looked like a DDoS

◼ Why enterprise outage calls become blame games and what having DNS observability data does to the mean time to innocence

(0:00) – Andrew's background and BlueCat's 24 years in DNS

(02:14) – Why DNS is still the most overlooked security layer

(04:51) – From service reliability to cyber observability

(12:28) – On-prem vs cloud DNS: where each belongs

(19:03) – Encrypted DNS lands: DoH, DoT, DoQ explained

(23:34) – Why DoH hurts enterprise visibility more than it helps

(29:57) – Zero trust models and what happens to DNS visibility

(39:20) – The MDM bug that looked exactly like a DDoS

(43:20) – SolarWinds customers and DNS forensics

(45:50) – Device identification through DNS behavior

(51:46) – DNS tunneling and the Indonesia carrier story

(56:52) – Microsoft 365 and the DNS nobody updated

(57:52) – Nine teams on a call, zero answers, one outage

(1:02:07) – What Google Chrome quietly does to your DNS data

Guest ⬇️

Andrew Wertkin

Hosts ⬇️

Yegor Sak & Alex Paguis

Powered by Control D

Micah Czigan is Chief Information Security Officer at Georgetown University and formerly served as Director of Defensive Cyber Operations at Symantec, with prior roles across the Department of Defense and Department of Energy.

He came to security through an unusual path: marine biology, commercial shipping, the Navy as a cryptographic communications specialist, and eventually the Pentagon running enterprise IT.

EP #16 goes inside what real incident command looks like. Not the tabletop version.

The version where a junior analyst freezes at 2am with a real alert, a third-party platform dies the week of finals, an Active Directory breach lands before the new CISO walks in, and a single TCP packet quietly exfiltrates sensitive data every few days for five years.

Micah doesn't clean any of it up. He walks through what happened, what failed, and what no runbook covers when the facts don't match anything you trained for.

What we cover in this EP:

◼ Why calm is an active leadership decision, not a personality trait

◼ The real cost of a delayed 2AM escalation on a genuine government alert

◼ When Canvas went down during finals week and security became business continuity

◼ One university device, no MFA, Active Directory already breached before Micah arrived

◼ How retained NetFlow at the DOE surfaced a five-year APT nobody else found

(0:00) – Micah's path to CISO

(04:56) – Leading incidents without answers

(09:03) – Why tabletops alone aren't enough

(11:21) – The first hour: what leaders miss

(13:26) – The incident manager bridge

(21:54) – Junior analyst froze, incident was real

(25:37) – Building a culture of early escalation

(31:15) – Should CISOs run incidents themselves?

(37:53) – Canvas down during finals week

(42:60) – SaaS-first with no failover

(48:03) – The Georgetown Active Directory breach

(50:14) – How abnormal traffic launched the investigation

(54:03) – What Micah would do differently now

(56:02) – Free cyber hygiene wins

(57:43) – Hardware keys: who gets them first

(1:04:53) – One TCP packet. Five years. Undetected.

(1:09:41) – Why historical NetFlow changes everything

(1:16:40) – Critical thinking over runbooks

(1:25:52) – Final takeaway for security leaders

Guest ⬇️

Micah Czigan

Hosts ⬇️

Yegor Sak & Alex Paguis (Co-founders at Control D)

Powered by Control D

Konrads Klints is CISO at Rajah & Tann Asia and formerly served as a senior incident response and red team consultant at KPMG.

He spent years on the offensive side, running red team engagements against ATMs, mainframes, and telecoms infrastructure before crossing over to defense as the first full-time, dedicated CISO at a law firm in all of Asia.

This episode covers how ransomware actually lands inside organizations that get hit, why law firms almost always pay, and what two incident response war stories reveal about the thing no playbook covers: knowing the right person at the right vendor before everything breaks.

What we cover in this EP:

◼ Why the "don't pay" advice from governments is mostly political posturing, and what law enforcement privately tells victims instead

◼ How one senior budget decision made years before an attack determines whether you survive ransomware or get owned by it

◼ What a SonicWall on your perimeter actually signals about the 10 security decisions that followed it

◼ Why the vendor contact you need during an incident is never the one in your contract, and two recoveries that prove it

◼ How Konrads spent $1,000 in AI tokens to replace a niche vendor that told him security wasn't their problem

(0:00) – First dedicated CISO at a law firm in Asia, period

(05:00) – Why Southeast Asian law firms had no dedicated security function

(08:33) – Bitcoin enabled ransomware; North American firms got hit first

(13:42) – The Shook Lin & Bok breach: Akira, the file list, and a negotiation gone public

(18:24) – Why law firms almost always pay and what happens to clients who find out

(27:35) – 86% of Akira breaches tied to SonicWall: what cheap appliances really signal

(32:15) – Where to spend a limited security budget

(35:53) – Get cyber insured before anything else

(47:37) – The Ireland incident: how an Xbox contact unblocked a Microsoft lockout

(54:42) – The Scandinavian recovery: 50 engineers in 48 hours, one relationship

(58:00) – How to vet vendor support before you actually need it

(1:08:21) – AI in 2026: where it helps and where it falls short

(1:11:32) – Replacing a niche vendor with $1,000 in AI tokens

(1:14:07) – Vibe coding in enterprise: what's actually risky

(1:22:23) – What Konrads misses about red teaming

(1:28:35) – Hardware keys: highest ROI security move

(1:31:44) – If law firms do one thing: get cyber insurance

Guest ⬇️

Konrads Klints

Hosts ⬇️

Alex Paguis & Yegor Sak (Co-Founders of Control D)

Powered by Control D

Mohana "Mo" Balakrishnan is CTO at Schools Insurance Authority and the former security architect at SonicWall.

He started his career as a geophysicist in a tent in northern Canada at minus 60, pivoted to tech in London, and joined SonicWall at the bottom. Years later he was the architect at the keyboard when SonicWall's own systems were compromised through a zero day in its remote access product. He has also served as CISO at the University of the Pacific.

This is the operator level reconstruction. The canary alert he waved off on a holiday, the decision to physically unplug the internet router, and the argument he made when everyone senior to him stayed quiet.

What we cover in this EP:

◼ The canary alert that fired on a holiday, why he told the user to just close the laptop, and what it actually was

◼ Why the first move was cutting all internet access, and what that did to a fully remote workforce

◼ The out of band stack they stood up in hours. Separate domain, separate Jira, separate workspace, because corporate email was suspect.

◼ Rebuilding access one manual host to host firewall rule at a time instead of flipping the network back on

◼ Why the microsegmentation project nobody would fund became a no brainer the week after

(00:00) – Meet Mo Balakrishnan: geophysicist turned security architect

(05:12) – What execs get wrong in the first hour of an incident

(07:09) – SonicWall's 2021 breach: take us back to that moment

(08:08) – The canary alert that fired on a holiday

(09:06) – "Just close the laptop": a zero day in their own product

(10:31) – Backups saved them, the engineering lab didn't

(15:46) – Shutting it all down and unplugging the internet router

(19:02) – Hour 12: leadership wants the company back online

(20:30) – The out of band stack: separate Jira, workspace, domain

(21:30) – Rebuilding access one manual firewall rule at a time

(25:47) – Killing outbound internet to cut their command and control

(29:09) – The playbook they didn't have, cyber insurance, and the FBI

(36:39) – A communications battle, not a technical one

(49:31) – Closing thought: why the prompt is the new perimeter

Guest ⬇️

Mohana "Mo" Balakrishnan: https://www.linkedin.com/in/mohana-b-24012016/

Hosts ⬇️

Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

Paul Bleicher is Co-Founder and Chief Product Officer at Convo, building agentic vulnerability triage for security teams drowning in scanner noise.

After a decade as an early employee across security and dev-tool startups, Paul and his co-founders spent two months interviewing 100+ security leaders before landing on the problem: most CVEs flagged by scanners are never actually exploitable.

What we cover in this EP:

◼ Why 70-90% of vulnerabilities flagged by scanners are false positives, and how reachability vs. exploitability analysis separates real risk from noise

◼ How agentic AI systems investigate CVEs like a security analyst — building exploitability checklists, orchestrating deterministic tools, and guarding against prompt injection

◼ Why large enterprises' compliance processes can slow AI adoption at the exact moment attackers are moving faster than ever

◼ The audit/compliance angle: how AI-generated exploitability reports help satisfy regulators when vulnerabilities go unpatched

◼ Paul's advice to every security leader: use an LLM 5-10 times a day or risk falling behind entirely

(00:00) – Meet Paul Bleicher, Co-Founder & CPO of Convo

(00:56) – Why Paul started his own company after 12 years as an early employee

(01:54) – The pivot: from ownership mapping to vulnerability triage

(03:42) – Reachability vs. exploitability explained

(08:21) – False positives on false positives: the limits of reachability

(10:16) – The CVE arms race and thousands of vulnerabilities per day

(13:29) – What “agentic” actually means vs. AI marketing buzzwords

(15:22) – Prompt injection risk: securing an AI system that reads your codebase

(19:13) – Noise vs. context: solving triage in the right order

(20:11) – “Don’t worry about it, bro” — the reality of unfixed critical vulnerabilities

(23:33) – Convo’s real numbers: how many alerts are actually exploitable

(26:27) – AI writes the code, AI finds the bugs, AI has to fix them

(28:45) – Startups vs. enterprises: who’s better equipped to survive?

(33:21) – The gap between security leaders who use AI daily and those who don’t

(37:09) – What to tell boardrooms still afraid of AI in 2026

(41:18) – What CISOs should stop doing today

(42:17) – What CISOs should start doing tomorrow

(44:41) – Closing thoughts and where this is all heading

Guest ⬇️

Paul Bleicher: https://www.linkedin.com/in/paulbleicher/

Hosts ⬇️

Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

Zach Lewis, CIO and CISO at the University of Health Sciences and Pharmacy in St. Louis, breaks down the LockBit ransomware attack that hit his university in April 2023 and how it impacts CISOs and security leaders navigating the same threat today.

◼ Incident response takeaway: why the first 24 hours matter more than any tool in your stack

◼ Threat intelligence insight: how LockBit's negotiation tactics and "customer support" model actually work

◼ Real-world application: the backup failure that nearly ended recovery, and the policy violation that saved it

◼ Identity security lesson: how cached credentials let attackers escalate from one phished laptop to full domain control

◼ Post-incident rebuild: the break-glass accounts, data governance, and password manager overhaul that followed

Zach walks through the full incident: discovering the ransom note on the hypervisor, the scramble to restore Active Directory on an esports gaming PC, refusing a $1.25M ransom demand, and the data governance and identity security overhaul that followed.

(00:00) – Introducing Zach Lewis, University CISO

(02:06) – Balancing CIO and CISO Roles

(03:32) – Common Ransomware Misconceptions for Leaders

(06:18) – Ransomware Industry Trends and Economics

(07:44) – AI-Driven Phishing and Social Engineering

(09:36) – Misdiagnosing a LockBit Cyberattack

(10:30) – Ransom Note Found on Hypervisor

(12:56) – First 24 Hours of Incident Response

(15:20) – Impact on Students, Faculty, Systems

(19:14) – Restoring Active Directory on Gaming Hardware

(21:59) – LockBit Negotiation via Tor Network

(24:50) – Backup Failures and Recovery Breakthrough

(27:41) – Decision to Refuse Ransom Payment

(34:20) – Root Cause: Phishing and Cached Credentials

(41:38) – Why Only Partial Data Leaked

(49:39) – Post-Incident Security Program Overhaul

(1:04:45) – Final Advice for Security Leaders

Guest ⬇️

Zach Lewis: https://www.linkedin.com/in/zacharylewis1/

Hosts ⬇️

Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

How did the 2019 Capital One breach happen? Ross Young explains how a WAF misconfiguration and unfinished cloud migration exposed a critical security-control gap.

CISOs will learn how to measure tool effectiveness, redirect wasted security budget, and add safeguards for autonomous AI agents.

Ross Young is a former intelligence officer turned enterprise CISO. He was at Capital One during the 2019 breach, authored Cybersecurity's Dirty Secret: Why Most Budgets Go to Waste, and is now co-founder & CEO of Clear Capabilities, building AI agents to automate the parts of security that drain teams dry.

In this episode, Ross explains:

◼ The exact WAF misconfiguration that enabled the Capital One breach and why it's probably still hiding in your environment

◼ Why your security tools are likely only 40–72% effective, and how to calculate your true effective protection score

◼ Which security categories are largely security theater (DLP, third-party risk management) and where budget should actually go

◼ How AI is shifting the speed of attacks vs. defenses and what defenders must do right now to keep up

◼ Why AI agents need kill switches, audit trails, and rollback processes before they ever go live

Time Stamps

(00:00) Introduction: Ross Young's Path From Offense to CISO

(00:29) Inside the 2019 Capital One AWS Breach

(07:14) Evidence Every CISO Should Collect After a Breach

(08:26) The Swiss Cheese Firewall Problem

(11:17) Misaligned Incentives Between Developers and Security

(13:10) Risk Acceptance: The MRI Machine and the CFO's Math

(17:55) Murder Boards: Killing Underperforming Security Tools

(24:18) Why Vendor Choice Matters Less Than Configuration

(28:32) Where Security Budgets Should Actually Go

(32:39) AI Is Closing the Attacker-Defender Speed Gap

(36:25) Stopping Deepfakes and Phishing With Process, Not Tools

(43:51) AI Agents Are the New Phishing Target

(47:37) Building a Kill Switch for Rogue AI Agents

(51:51) Introducing the OWASP Threat and Safeguard Matrix

(58:50) One Thing Every CISO Should Fix This Week

(59:48) Ross's New Venture: Clear Capabilities

Connect with Ross Young on LinkedIn: https://www.linkedin.com/in/mrrossyoung/

Hosts ⬇️

Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

How should security teams manage vulnerabilities when patching is impossible or incomplete? Ben Lipczynski explains contextual threat modeling, legacy-system risk, and defense in depth.

Security leaders will learn how to identify critical systems, reduce hundreds of scan findings to meaningful actions, and prepare around operational consequences.

Ben is the Director of Security and Regulatory Services at Origina and a former British Royal Navy officer with 12 years operating nuclear submarines and global networks. He brings an operator-level perspective on what separates a contained incident from a months-long operational nightmare.

He explains:

◼ Why siloed teams and poor system knowledge cause more breaches than sophisticated attacks ever do

◼ Why upgrading to the latest version often introduces more vulnerabilities than it removes

◼ How 700 scan findings came down to 20 real actions after proper contextual analysis

◼ Why the CVE volume problem is about to get significantly worse and what to do about it

◼ Why defense in depth, not patching, is the only strategy that holds up when an attacker gets inside

Time Stamps:

(0:00) Introduction

(0:53) What corporate security teams get wrong vs. the military

(2:22) The submarine mindset: 90% training, 10% operations

(4:48) Operational clarity in the military: everyone knows the mission and their role

(6:59) Military structure vs. corporate agility — opposites or the same need?

(10:38) Why Ben left the Navy for cybersecurity

(14:32) "Take a marching pace" — thinking before acting in incident response

(18:09) The iPad water treatment plant story — OT connectivity creep in the real world

(25:30) The myth of N-minus-one: legacy doesn't mean insecure

(28:10) Open source dependency risk — 60% of vulnerabilities aren't in the core code

(31:01) Slop squatting: attackers pre-registering AI-hallucinated package names

(33:00) What to do when you can't patch — contextual risk-based defense in depth

(36:26) The patch validation problem — exploits now arrive within hours of a CVE

(44:00) Fully patched, still taken down — architecture beats updates

(51:26) Log4J case study: why deleting the library beat the patch cycle

(55:23) Practical advice for security teams managing legacy systems

(1:02:22) The CVE volume crisis — is the current patching model even tenable?

(1:07:21) Bold prediction: CVE text itself will become an attack vector for AI agents

Connect with the speakers ⬇️:

Ben Lipchinski: https://www.linkedin.com/in/benlipczynskisecurity/

Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

What is the difference between ISO 27001 compliance and operational security? John Verry explains compliance theater, shadow AI, and the role of ISO 42001 and the EU AI Act.

Security leaders will learn how to operationalize controls, inventory AI use, and govern agentic systems without adding unnecessary GRC complexity.

John Verry is the Managing Director at CBIZ Cybersecurity, ISO 27001 certified lead auditor since 2006, and has guided hundreds of organizations through ISO 27001, SOC 2, CMMC, FedRAMP, and HITRUST. He has seen firsthand what separates organizations that get genuinely secure from those that just collect certifications.

John explains:

◼ Why you can be fully compliant and completely insecure at the same time

◼ Why operationalizing your security program inside tools your team already uses matters more than buying another GRC platform

◼ How 65% of SaaS platforms now have AI built in and why most organizations have no inventory of it

◼ Why the EU AI Act's August 2026 deadline is real and what organizations need to do now

◼ Why agentic AI shifts the risk from hallucination to autonomous business decisions made at scale without a human in the loop

Timestamps

(00:00) Introduction

(06:27) Meet John Verry: Managing Director at CBiz Cybersecurity

(07:47) What compliance theater actually means and why it matters

(09:34) Security is a journey, compliance is a destination

(12:30) The most common mistakes companies make after getting certified

(15:07) What it actually takes to operationalize a security program

(17:34) The merchants of complexity problem and why less tooling wins

(20:50) Third party risk management and the hidden operational debt of every new vendor

(22:19) What shadow AI is and why most organizations still do not know they are using it

(28:21) How to balance moving fast on AI with slow-moving compliance frameworks

(31:40) Why ISO 27001 updates slowly and why that might actually be a good thing

(36:41) How to risk model different types of AI from Grammarly to agentic systems

(40:14) Why shadow AI is lower risk than deeply integrated AI but still dangerous

(43:29) Sycophantic AI behavior, what causes it, and why it creates real danger

(52:29) AI coding AI, the hard takeoff, and the model collapse problem

(54:24) EU AI Act deadlines, ISO 42001, and why AI compliance urgency is now

(58:44) How ISO 42001 works as an extension of ISO 27001

(01:01:27) When auditors do not understand AI governance and certifications become theater

(01:02:28) The main blocker stopping CISOs from escaping compliance theater

(01:05:41) The next 12 to 18 months: why the era of agentic AI is already here

(01:07:48) Closing thoughts: What should actually scare every CISO right now

Connect with John Verry on LinkedIn

https://www.linkedin.com/in/jverry/

Hosts ⬇️

Alex: https://www.linkedin.com/in/alex-paguis-53a21815/

Yegor: https://www.linkedin.com/in/yegor-sak-725330b2/

Powered by Control D