Full Metal Packet Cybersecurity Podcast

How do attackers bypass MFA and compromise an organization without deploying malware? Devon Ackerman breaks down help-desk social engineering, stolen session tokens, and adversary-in-the-middle phishing.

Security and DFIR leaders will learn why identity-based intrusions evade traditional detection, where hardware security keys can break the attack chain, and how to limit the blast radius when credentials are compromised.

Devon is the Global Head of Digital Forensics and Incident Response at Cyber Reason and a former FBI Supervisory Special Agent focused on counterintelligence and cyber investigations. He is also the author of Diving In: An Incident Responder's Journey and one of the most experienced breach investigators working today.

Devon explains:

◼ Why attackers ditched malware and are stealing identities to hide inside normal user behavior

◼ How one phone call to a help desk bypassed MFA and gave full network access without a single alert

◼ Why phishing kits intercept your authentication token, not your password

◼ Why hardware keys stop most kill chains cold and where that still breaks down

◼ The four threat actor categories and why each one requires a different defensive response

Time Stamps

(00:00) Devon Ackerman Introduction

(01:48) Why digital forensics and incident response belong together

(04:28) How modern investigations have changed in the last 5 years

(06:49) Are attackers moving faster than defenders?

(08:41) Can digital forensics become proactive?

(11:31) Will AI turn cyber defense into a war of bots?

(14:50) Why security adoption still lags behind new threats

(16:43) Identity becomes the primary attack surface

(19:56) War story: help desk social engineering, password resets, and disabled MFA

(22:52) A real vulnerability exploited within 12 hours

(25:18) What happens when CVE-to-exploit timelines shrink to minutes

(28:29) How adversary-in-the-middle MFA phishing works

(33:16) Why MFA bypass is really about intercepting authentication

(35:54) Hardware keys and where phishing kill chains usually stop

(39:14) Hacktivists, nation-states, organized crime, and initial access brokers

(42:47) The economics of selling access vs exploiting it yourself

(46:56) Devon’s final advice for defenders: reduce blast radius

Connect with the speakers ⬇️

Devon: https://www.linkedin.com/in/devonackerman/

Yegor: https://www.linkedin.com/in/yegor-sak-725330b2/

Alex: https://www.linkedin.com/in/alex-paguis-53a21815/

Powered by Control D

What does modern cyberwarfare look like for security leaders? Matan Eli Matalon explains Iran-linked attacks, disruption campaigns, propaganda, credential abuse, and AI-enabled attacker speed.

CISOs will learn a three-step framework for defining business failure, mapping attack paths, and protecting critical systems.

This episode had to pause mid-recording after Matan, a former CISO who reverse-engineered Iran’s Handala malware, received a missile warning and had to take shelter. We picked the conversation back up the next day.

Matan explains:

• Why groups like Handala choose quantity over sophistication and how that makes them harder to defend against
• How AI removes friction for attackers without changing the attacks themselves and why defenders can't keep up
• Why protecting everything equally is the fastest way to protect nothing
• The 3-step CISO framework: define failure, map every attack path to it, validate it's closed

Timestamps:

• (00:00) Intro - Cyberwar is already here

• (03:00) Disruption over dollars

• (06:45) The Handala playbook exposed

• (08:07) Inside Handala’s malware

• (10:29) AI didn’t make hackers smarter, it made them faster

• (12:20) Anthropic’s leaked “Mythos” model

• (13:48) Stop protecting everything, protect what can kill you

• (18:00) AI is breaking your security perimeter from within

• (22:20) The house analogy that changes how CISOs think

• (34:25) The CISO isn’t the department of no

• (46:45) Agentic AI is a black box and CISOs hate it

• (51:05) Slop squatting: the attack no one’s talking about

• (54:00) The Iranian hack that almost took everything down

• (1:00:00) When the goal is deletion, not data theft

• (1:03:18) The backup that wasn’t

• (1:06:30) The 3-step framework every CISO needs

• (1:08:25) Why this 28-year-old chose defense over offense

• (1:10:50) Cybersecurity in 3 years: Matan’s prediction

Connect with Matan Eli Matalon on LinkedIn

Powered by Control D

How is AI changing cybersecurity in 2026? Former Intel CISO Matthew Rosenquist examines AI-enabled social engineering, faster exploitation, ransomware, shadow AI, and MCP server risk.

Security leaders will learn how to govern autonomous tools, adapt defensive operations, and position the CISO as a strategic business partner.

He explains:

• Why AI is a force multiplier for attackers first and what that means for defenders
• How the vulnerability discovery-to-exploit window has collapsed from months to hours
• The evolution of ransomware into AI-powered blackmail and extortion
• Why MCP servers are the next major attack surface nobody is talking about
• The CISO identity crisis and how to shift from cost center to business partner
• Shadow AI, prompt injection, and why privacy is on life support
• What the CISOs who survive AI disruption will do differently from those who don't

Episode Timeline:

• (00:00) Intro and why 2026 hits different for cybersecurity
• (14:40) How Matthew builds his annual predictions across 4 domains
• (16:37) Why AI is the first force to dominate all four at once
• (18:53) Social engineering at scale: AI's first killer app for attackers
• (21:14) Zero days for $6 and the collapse of the exploit window
• (24:14) Why human inertia is still the defender's biggest enemy
• (33:54) Security by design and shrinking the zero day pool
• (43:39) When tools have agency: the blurring line between AI and humans
• (51:30) MCP servers, shadow AI and the governance gap no one is closing
• (58:00) A real world AI phishing attack that almost fooled a security expert
• (01:05:33) How ransomware is evolving into AI-powered blackmail
• (01:37:39) The CISO identity shift from cost center to competitive edge

Connect with Matthew Rosenquist on LinkedIn

Powered by Control D

How do you build a security program as a company scales? Veteran CISO Randy Barr explains security budgets, tool sprawl, insider threats, incident war rooms, and AI risk.

Security leaders will learn which controls growing companies need first, how to prepare for operational incidents, and when another security tool is the wrong investment.

Randy Barr has held the CISO title at over 10 companies — including Cisco, Zoom, and BioRender — and has seen every version of how security programs succeed and fall apart.

He now leads security at Sequence Security, focused on API security, bot management, and AI protection. In this episode, Randy takes us through what security teams think they're doing well but aren't, what incidents actually look like at scale, and why AI is rewriting the rules faster than most organizations can keep up.

Randy explains:

• Why compliance and security are not the same thing — and confusing them is dangerous
• How insider threats often hide inside your own growth and broken processes
• What a war room actually needs to function under pressure
• Why MCP servers and prompt injection are the next wave of incidents no one is ready for
• How to build a CISO career that doesn't burn you out

Episode Timeline:

• (00:00) From ASP to cloud to AI — how the security industry has shifted
• (07:33) Why 80% of internet traffic is now machine to machine
• (09:46) What most startups get wrong about security programs
• (15:01) How to make the business case for a security budget
• (19:36) When buying more tools is actually the wrong move
• (28:30) War story: stolen servers sold online by an infrastructure manager
• (36:25) War story part 2: third-party contractors scripting their own reimbursements
• (42:00) The website defacement that launched Randy's security career
• (46:11) What a good incident war room actually looks like
• (53:50) Shadow AI, MCP servers, and the prompt injection risk no one is tracking
• (01:02:00) Where AI can genuinely replace manual security work
• (01:12:43) Advice for new and experienced CISOs on what actually matters

Connect with Randy on LinkedIn

Powered by Control D

How does cyber incident response differ between the EU and the United States? DFIR expert Alejandro Rivas Vazquez explains privacy constraints, legal involvement, OFAC decisions, and CISO liability.

Security leaders will learn how to prepare for ransomware, business email compromise, and cross-border investigations before an incident occurs.

Alejandro Rivas Vazquez has spent nearly two decades running DFIR services and now advises on preparedness through his boutique consultancy, VeraBeam. He’s sat in boardrooms, testified as an expert witness, and been on the phone at 1am when OFAC changed the rules mid-ransomware negotiation.

Alejandro explains:

• Why lawyers belong in the room (and exactly when they don't)
• How the EU's hyper-regulation actively hinders incident response
• Why business email compromise costs more than ransomware — and gets less attention
• What preparation actually means before an incident hits
• How DFIR is professionalizing, and where AI fits into its future

Timestamps

• (00:00) Alejandro's path from Big Four IT risk to DFIR
• (07:45) How Operation Night Dragon changed the industry
• (16:20) Boardrooms, expert witnesses, and CISO liability
• (25:35) EU vs. US: regulation-first vs national security-first
• (32:15) When Europe's privacy laws block your own investigation
• (41:48) CISO personal liability: insurance, risk acceptance, and burnout
• (54:18) War story: business email compromise and the board member who went rogue
• (01:01:45) The single decision that separates contained from catastrophic
• (01:09:26) Midnight OFAC call during an active ransomware response
• (01:14:00) Why DFIR merged and where the profession is heading
• (01:20:09) AI as force multiplier: threat, opportunity, and the hallucination danger zone
• (01:33:53) Practical advice: what EU and North American CISOs should do this quarter

Connect with Alejandro on LinkedIn

Powered by Control D

How should CISOs rationalize an overcrowded security stack? Ralph Chammah explains tool sprawl, XDR/MDR overlap, AI-assisted detection, selective data ingestion, and alert noise.

Security leaders will learn how to evaluate platform value, validate detections, reduce false positives, and remove tools that add cost without improving security outcomes.

Ralph Chammah, Co-Founder & CEO of Blacklight AI, shares a builder’s perspective shaped by years in cybersecurity analytics—what breaks in real SOC environments, and what it takes to make detection actually usable at scale.

He explains:

• Why security stacks get noisy (and what “AI-first” should actually mean)
• How to cut through acronyms like XDR/MDR and evaluate real value
• How to use context + behavior patterns to catch insider risk and compromise
• Why privacy/trust decisions (local vs external processing) matter in AI security
• How replay/simulation helps validate detections and reduce false positives

Episode Timeline:

• (01:46) Meet Ralph + what Blacklight AI does
• (06:45) Why he left the Big 4 to build a product
• (12:26) Tool overload, acronyms, and differentiation (XDR/MDR)
• (18:10) Why AI belongs in detection (and how to avoid bad signals)
• (21:44) Trust & privacy: where the data goes (and why)
• (23:16) “Battle scars” from SIEM life: parsers, missing fields, manual grind
• (29:32) Selective ingestion vs. “pipe everything” into the magic box
• (31:32) Validation: replaying history + simulation to prove detections
• (35:35) Biggest high-risk wins: insider threat + slow-burn intrusions
• (39:13) Jaguar Land Rover breach story + business impact
• (47:27) Quickest wins: what to connect first by maturity level
• (49:55) What tools he’d remove first (and why)
• (59:39) Platform vs point solutions: the real trade-off

Connect with Ralph on LinkedIn

Powered by controld.com

What does provable security mean, and why do black-box platforms fail CISOs? Maxime Lamothe-Brassard explains transparency, threat modeling, and measurable security outcomes.

Security leaders will learn how treating security like cloud infrastructure can improve vendor accountability, SecOps flexibility, and responsible AI use.

He explains:

• Why “trust me bro” security models quietly fail CISOs
• How government cyber ops reshaped his view of threat modeling
• What provable security actually looks like in practice
• Why transparency beats vendor magic every time
• How AI should amplify SecOps teams, not replace them

Episode Timeline:

(00:00) From hacker curiosity to cybersecurity foundations

(07:45) Lessons from government cyber operations

(16:07) The shock of moving into private-sector security

(25:35) Why most security platforms repeat the same mistakes

(32:15) Provable security vs “trust me” security

(41:40) Treating security like cloud infrastructure

(49:50) AI’s real role in the future of SecOps

(59:52) What CISOs should demand next from security vendors

Connect with Maxime on LinkedIn

Powered by Control D

What can CISOs and MSPs learn from a ransomware attack that disrupted 26 client businesses and caused millions in losses? Matt Lee reconstructs the incident and its aftermath.

Security leaders will learn how merger due diligence, supply-chain visibility, cyber insurance, incident leadership, and secure-by-default software affect ransomware resilience.

Matt is a battle-tested cybersecurity leader known for translating complex technical crises into practical security transformation. In this raw, revealing episode, he opens up about the breach that changed everything - and how it helped shape the philosophy behind Secure by Demand.

Matt explains:

• How a hidden ransomware infection derailed a multi-company merger
• What most MSPs get dangerously wrong about security risk
• The real cost of reactive security: layoffs, lawsuits, and insurance gaps
• What “Secure by Demand” really means (and why it’s missing from most strategies)
• Why security maturity is the new battleground (not just tooling)
• How to lead through cyber chaos without losing your sanity

Episode Timeline:

• (00:00) Intro: Who is Matt Lee and why this episode matters
• (02:42) Matt’s origin story - from hacker kid to MSP tech
• (06:19) Falling into security: “I just added ‘and Security’ to my badge”
• (11:30) The merger that hid a ticking ransomware time bomb
• (17:04) Voldemort incident discovery: “We bought a company mid-breach”
• (20:47) The day it hit: Ransomware spreads to 26 client businesses
• (25:15) What went wrong: due diligence gaps, supply chain blindness
• (30:22) Incident response chaos and internal suspicion
• (36:48) Fallout: 18-month recovery, insurance battles, FBI involvement
• (41:35) Live Compromised: The philosophy Matt built from the wreckage
• (47:10) The birth of “Secure by Demand” - a challenge to the industry
• (53:01) Software design flaws: why vendors ship insecure defaults
• (56:20) Advice for CISOs and MSPs: mindset, tooling, and where to start
• (59:40) Real-world examples: empathy, leadership, and rebuilding trust
• (01:03:15) Final reflections: Why the industry needs hard conversations

Connect With Matt on LinkedIn

Powered by Control D

When a breach hits, the first 72 hours decide everything. But the stories, decisions, and philosophies behind those critical hours rarely make it into public conversation. That’s what Full Metal Packet is here to change.

Hosted by Yegor and Alex - the founders of Control D (and before that, Windscribe, now trusted by 90M+ people) - this podcast is where operators, CISOs, and security leaders finally get candid.

Season 1 brings you:

• Breach Incidents → Inside the calls leaders had to make under fire, anonymized and NDA-safe.
• SecOps Therapy → The frictions nobody talks about: burnout, workflows, and the daily grind of running security.
• Security Futures → What’s underrated, what’s overhyped, and how AI will reshape security in the years ahead.

No blame. Just raw, operator-grade conversations from the people who’ve lived it.

Guests already include CISOs from SaaS, healthcare, and hospitality — the voices shaping security today.

If you’re a security leader, this is where your peers will be telling their stories. And if you’re listening, it’s where you’ll find the missing conversations you’ve been waiting for.

Subscribe now and join us for Season 1 of Full Metal Packet.