Security Cocktail Hour

Aid groups like the Red Cross work in nearly every war zone, and they hold some of the most sensitive data there is: missing persons, prisoners of war, even biometrics. Anna Beck joins co-hosts Joe Patti and Adam Roth to talk about what happens when that data, and the systems behind it, become a cyber target.

The laws of war weren't written with cyberspace in mind. Anna explains why, in her reading, a cyberattack that knocks an aid group offline may not legally count as an "attack," or a war crime. Then: who actually enforces the Geneva Conventions, why the Tallinn Manual's own experts disagree, and why the Red Cross is building a digital emblem that isn't a firewall.

In this episode:

- 1:54 What humanitarian organizations are, and why they're exposed

- 9:46 Is hacking an aid group a no-no? The Geneva Conventions

- 22:10 When is a cyberattack an "attack"?

- 28:01 Not an attack, not a war crime

- 33:26 Who enforces the laws of war?

- 40:31 Cyber doesn't even have a baseline yet

- 52:34 The Red Cross Digital Emblem Project

- 57:59 The emblem isn't a firewall

Anna Beck is a coordinator at AOBP, the Defence and Security Industry Association of the Czech Republic, and an international relations graduate student at Prague University of Economics and Business. Her peer-reviewed chapter, "Protecting Humanitarian Organizations in Cyberspace," appears in the CyCon 2026 proceedings from the NATO CCDCOE.

Recorded in two sessions in July 2026.

The Security Cocktail Hour: https://securitycocktailhour.com

Election security expert Antonia-Laura Pup talks with co-hosts Joe Patti and Adam Roth about how attacks are coming not just from the cyber world, but also through influencers and social media. Romania had to annul an election in response. And the small nation of Moldova fought back with the tools Antonia believes other countries will need to deploy to defend democracy.

Antonia is a Romanian security researcher focused on these issues in her home country and others.

In this episode:

• Why Romania's presidential election was annulled and why explaining that decision mattered.
• What the declassified reports on the Romanian election described about coordinated TikTok accounts, influencer payments, and attacks on election systems.
• 20:32 How the annulment deepened public distrust in Romania.
• 26:34 How Moldova handled their own election interference issues.
• 32:08 Moldova's pre-election disclosures, public warnings, civil-society fact-checking, and outside cyber help formed its response.
• 43:29 The wider lesson: why Antonia sees political will, not just technical capacity, as decisive, and why she does not want the military policing people's minds.
• 57:11 EU cyber sanctions: a potential response to cyberattacks, but too slow to be the whole answer.

What does a cyber policy cover when technology risk reaches beyond stolen data? AI-related mistakes, reliance on vendors, business interruption, and physical consequences can raise different questions for different kinds of insurance. One policy cannot be assumed to answer them all.

Michelle Faylo, Lockton's U.S. Cyber & Technology Leader, joins Joe Patti and Adam Roth to unpack cyber coverage and technology E&O; first- and third-party loss; physical versus nonphysical consequences; a competitive insurance market; and why war exclusions become difficult when attribution is contested. Michelle also talks about the controls insurers look for, broker conversations throughout the policy year, and what CISOs and boards need to understand before renewal.

This episode is a general discussion, not insurance or legal advice.

Michelle Faylo at Lockton: https://global.lockton.com/us/en/news-insights/lockton-names-michelle-faylo-u-s-cyber-and-technology-leader
Security Cocktail Hour: https://securitycocktailhour.com/

#CyberInsurance #TechnologyRisk #RiskManagement

Running a vulnerability scan is easy. Deciding what matters, what is noise, and what a business should do next is the real work.

Michael Simmons, founder of Elysium Trace, joins Joe Patti and Adam Roth to discuss business-focused vulnerability reporting for MSPs, IT consultants, and smaller security teams. They cover false positives, context, risk acceptance, repeatable reporting, automation, and why human judgment still matters.

Michael describes Elysium Trace and its product approach from his own experience. Learn more: https://elysiumtrace.com/

Cybersecurity was built for enterprises. Gaurav Keerthi explains what that leaves behind for the companies without a cyber team, and why their exposure becomes everyone else’s problem.

Gaurav, CEO of StrongKeep and a cybersecurity leader in the public and private sectors, joins Joe Patti and Adam Roth to break down why smaller organizations are still expected to buy, operate, and manage enterprise-style security. They discuss supply-chain risk, the “hopes and prayers” gap, cybersecurity’s IKEA problem, and what a usable baseline could look like for ordinary companies.

Episode Takeaways:

• Most organizations do not have a dedicated cybersecurity professional.
• Enterprise security programs cannot fully protect an organization when exposed suppliers remain unprotected.
• Security products need to be simpler, more bundled, and more realistic for companies without specialist teams.
• Doing something proportionate is better than doing nothing while waiting for a perfect plan.

Guest:

- Gaurav Keerthi, CEO, StrongKeep

- LinkedIn: https://sg.linkedin.com/in/gaurav-keerthi

- StrongKeep: https://www.strongkeep.com/

Resources:

- CyCon: https://cycon.org/

- NATO Cooperative Cyber Defence Centre of Excellence: https://ccdcoe.org/

Security Cocktail Hour Podcast:

- https://securitycocktailhour.com

Eva Galperin explains how stalkerware, ordinary phone access, coercion, and weak privacy defaults can let someone close create devastating real-world harm.

In this episode, we cover:

• What stalkerware is and why hiding from the user matters
• Why intimate-partner abuse changes the cybersecurity threat model
• Privacy as consent and control, not isolation
• Why end-to-end encryption is not magic if the endpoint is compromised
• Password managers, VPN myths, patching, and backups
• What security teams miss when they only focus on exotic adversaries

Guest: Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation and co-founder of the Coalition Against Stalkerware.

Resources:

• EFF Surveillance Self-Defense: https://ssd.eff.org/
• Coalition Against Stalkerware: https://stopstalkerware.org/

This is the full interview version of our conversation with Chad Butler.

Chad previously worked in product security at Amazon and was involved with Prime Air, Amazon's drone delivery program. He joins Joe Patti and Adam Roth to talk about drone delivery, FAA rules, GPS spoofing, detect-and-avoid, ADS-B, autonomous vehicles, AI agents, and the engineering culture needed when software failures can become physical-world safety failures.

Topics include:

• Prime Air and product security
• commercial drone delivery risk
• Part 107 and Part 108
• beyond visual line of sight operations
• GPS spoofing and drone capture
• detect-and-avoid vs right of way
• ADS-B tradeoffs
• why pilots may not reliably see drones
• autonomous vehicles and AI agents
• adversarial inputs and edge cases
• public trust after catastrophic failures
• Challenger, Feynman, and ignored engineering warnings

Autonomous systems are already moving into the physical world. Drones can fly themselves, robot taxis are carrying passengers, and AI systems are taking more action without direct human control.

Chad Butler joins the Security Cocktail Hour to explain why that changes the risk model.

The issue is what happens when autonomous systems make real-world decisions from sensor data, routing logic, and AI-driven judgment that may be wrong, spoofed, or manipulated.

In this feature version, Chad talks with Joe Patti and Adam Roth about:

• GPS spoofing and drone capture
• beyond visual line of sight drone operations
• trusted and untrusted sensor data
• AI agents and autonomous vehicles
• why optimal-environment testing is not enough
• why "nobody will do that" is not a defense
• how cyber failures can become safety failures
• what Challenger and Feynman still teach us about launch pressure and ignored warnings

This is a feature cut of the conversation. Th full interview will be released soon.

This time we’re revisiting our conversation with Luke Canfield and focusing on how drones are becoming a cybersecurity problem.

Luke walks through war-flying, drone-mounted Wi-Fi Pineapples, rogue access points, cartel drone operations, prison contraband drops, hybrid warfare, and why most security teams are still thinking too flat. The core takeaway: security exists in three dimensions now, and defenders need to start looking up.

Full original episode with Luke Canfield: https://open.spotify.com/episode/18TYWLjiLpqGX995iDmqdL?si=67c757474cc84d33

Security Cocktail Hour:
https://securitycocktailhour.com

Former NASA Administrator and astronaut Charles Bolden joins the Security Cocktail Hour to explain why space is not as isolated as people assume.

We cover:

• Why mission control still sits in the middle
• Why messages get routed, reviewed, and filtered before reaching a vehicle
• How consumer devices expand the attack surface in space
• What cooperation in orbit teaches about security and civics
• Why he does not buy the hype about easy moon or Mars colonization

Organizations mentioned in this episode:

Intrepid Museum: https://intrepidmuseum.org/

Astronauts for America: https://www.astronautsforamerica.org/