From teaching AP art history to brokering cyber insurance deals. 🎓➡️🛡️

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Andy Runyan from Yukon to break down everything blue teamers need to know about cyber insurance — before an incident happens. Andy shares his unconventional journey from fourth-generation educator and baseball coach to becoming a cyber insurance specialist, and explains why understanding your policy is just as important as your incident response plan.

What you'll hear:
🔹 How cyber insurance actually works (and what it doesn't cover)
🔹 Why having an incident response retainer matters — before you need it
🔹 The role of cyber insurance in incident response and recovery
🔹 Third-party contract requirements and state mandates on the rise
🔹 Common mistakes companies make when filing claims
🔹 FTC Safeguard Rules and what they mean for businesses
🔹 How to prepare your organization for cyber insurance requirements
🔹 What lowers premiums (and what should, but doesn't)

Why This Matters for Blue Teamers:
If you're in a SOC or handling incident response, you will interact with cyber insurance at some point. Understanding how policies work, what triggers coverage, and how to prepare can make the difference between a smooth recovery and a catastrophic financial loss. This episode gives you the insider knowledge to help your organization be ready.

⏱️ Timestamps:
00:00 Introduction and Welcome
00:15 Andy's Unique Background: From Teacher to Cyber Insurance
03:00 Getting Into Cyber Insurance in 2019
04:00 The Wild West of Cyber Insurance During COVID
06:00 When Companies Actually Buy Cyber Insurance
08:00 What Blue Teamers Need to Know About Insurance
10:00 The Problem with Incident Response Retainers
12:00 How Insurance Companies Handle IR vs. What You Need
15:00 Multi-Factor Authentication and Premium Discounts
18:00 Why Having an IR Plan Doesn't Lower Your Premium (But Should)
21:00 Third-Party Contract Requirements on the Rise
24:00 State Mandates: What's Coming Next?
27:00 FTC Safeguard Rules and Compliance Reality
30:00 Where to Learn More About Yukon

🔗 Connect with Andy Runyan:
→ Yukon Website: https://www.ukon.com
→ LinkedIn: https://www.linkedin.com/in/andy-runyan
→ Email: [email protected]

👥 Connect with the Hosts:
→ Josh Mason: https://www.linkedin.com/in/joshuacmason/
→ Wade Wells: https://www.linkedin.com/in/wadingthrulogs/
→ Swimlane: https://www.linkedin.com/company/swimlane

🎙️ Listen on Your Favorite Platform:
→ Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
→ Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1773806182
→ Full Playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4

👍 If you enjoyed this episode, don't forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity professionals who are doing the work.

=========================
Sponsored by @ThreatLocker - Free 30-day trial visit:
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

Josh Mason and Wade Wells sit down with Brian Carrier, the creator of Sleuth Kit and Autopsy, two of the most widely used digital forensics tools in the world. They dig into how Brian got his start in the early days of computer forensics, how open source shaped his career, and what he’s building now with Cyber Triage.

From stories about government funding and tool rewrites to the evolving balance between open source and commercial software, this episode is packed with insight for blue teamers, DFIR pros, and anyone who cares about investigation tooling that actually works.

Watch to hear:

• The 25-year evolution of Sleuth Kit & Autopsy
• How Cyber Triage simplifies investigations for SOCs
• The tradeoffs between open source and commercial tools
• What Brian sees next in AI-driven forensics

⏱️ Timestamps:
 00:00 Introduction and Guest Introduction
 00:15 Brian Carrier's Journey with Sleuth Kit and Autopsy
 02:06 Evolution and Funding of Autopsy
 06:52 Open Source vs. Commercial Software
 10:16 Future Roadmap and Innovations
 14:16 Autopsy and Cyber Triage for Blue Teamers
 16:24 Challenges in EDR and SOC Analysis
 16:41 Investigative Process and Clues
 17:18 Handling Noisy Data in EDR
 17:49 Importance of Tracing Malware
 18:28 Deploying Additional Collectors
 19:25 Feedback from the Community
 21:21 Cyber Insurance and Incident Response
 23:34 Automation in Forensics
 28:41 Advice for Blue Teamers
 30:12 Conclusion and Final Thoughts

Links:
 🎧 Listen on Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
🍎 Listen on Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1668519478
💻 Learn more about Sleuth Kit: https://sleuthkit.org/
🔍 Try Autopsy: https://www.autopsy.com/
🧠 Explore Cyber Triage: https://www.cybertriage.com/

Connect with Brain:
👤 Brian Carrier on LinkedIn: https://www.linkedin.com/in/brian-carrier-169243/
🏢 Sleuth Kit / Basis Technology on LinkedIn: https://www.linkedin.com/company/basis-technology/
💼 Cyber Triage on LinkedIn: https://www.linkedin.com/company/cyber-triage/

Don't forget to like, subscribe, and hit the bell icon for more blue team content!

🔗 Follow the hosts:
Josh Mason: https://www.linkedin.com/in/joshuacmason/
Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

💡 Brought to you by ThreatLocker – Secure your business with zero trust application control. https://www.threatlocker.com/simplydefensive

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by @ThreatLocker - Free 30-day trial visit:
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

In this episode of Simply Defensive, host Josh Mason and co-host discuss their experiences and challenges in cybersecurity, along with guest Victoria, a student and SOC analyst at UNLV.

The conversation covers the complexities of building a Security Operations Center (SOC) and compares academic learning with real-world applications. Victoria shares insights from her studies and practical work, including developing a SOC program at UNLV and addressing common cybersecurity misconceptions.

The episode highlights the importance of communication, real-world projects, continuous learning, and the balance between technical and business aspects of cybersecurity.

00:00 Introduction and Host Banter
00:20 Guest Introduction: Victoria
01:03 Building a SOC: Challenges and Experiences
01:29 Education vs. Real-World Experience
02:29 SOC Class and Practical Training
03:49 Group Projects and Communication
07:14 Real-Life Incident Stories
10:33 Getting into Cybersecurity: Victoria's Journey
12:54 Business Side of Cybersecurity
16:17 The Cost of MFA and Free Alternatives
16:31 Lock Picking and Security Value
17:30 Teaching Cybersecurity Concepts
18:44 Consulting Experience for Students
19:15 Client Feedback and Confidential Reports
19:52 Challenges in Cybersecurity Projects
20:27 Transitioning into the SOC
22:34 Federal and State Regulations
26:16 Advice for Blue Teamers
28:06 Conclusion and Farewell

Don't forget to like, subscribe, and hit the bell icon for more blue team content!

🔗 Follow the hosts:
Josh Mason: https://www.linkedin.com/in/joshuacmason/
Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

💡 Brought to you by ThreatLocker – Secure your business with zero trust application control. https://www.threatlocker.com/simplydefensive

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by @ThreatLocker - Free 30-day trial visit:
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber 
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

What happens when you go from fixing executives’ laptops at Goldman Sachs to defending against cyber threats in a SOC?

In this episode of Simply Defensive, hosts Josh Mason and Wade Wells sit down with Kevin Apolinario — better known as KevTech — to unpack his journey from IT support to cybersecurity analyst, all without a single certification.

Kev gets real about what it’s actually like to land your first SOC role: the flood of alerts, the burnout, learning Excel the hard way, and relying on ChatGPT to survive scripting. He also shares how TryHackMe, Hack The Box, and constant hands-on practice built the foundation for his success.

If you’ve ever wondered what breaking into cybersecurity really looks like, this conversation pulls back the curtain — no fluff, no spin, just honest talk from the trenches.

Chapters:
00:00 Introduction and Welcome
00:29 Guest Introduction: Kev Apolinario
00:51 Transition to SOC Analyst Role
01:53 Challenges and Learning in Cybersecurity
06:43 Handling Alerts and Fatigue
10:26 Importance of Teamwork and Asking for Help
19:56 Executive Support Experience
27:02 Advice for Aspiring Blue Teamers

Follow Kevin on YouTube: https://youtube.com/@kevtechitsupport
Connect with Kevin on LinkedIn: https://www.linkedin.com/in/itprofessionalkevinapolinario

Don't forget to like, subscribe, and hit the bell icon for more blue team content!

🔗 Follow the hosts:
Josh Mason: https://www.linkedin.com/in/joshuacmason/
Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

💡 Brought to you by ThreatLocker – Secure your business with zero trust application control.

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by @ThreatLocker - Free 30-day trial visit:
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber  
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

In this episode of Simply Defensive, we sit down with JB, a Senior Cybersecurity Engineer working in detection engineering. JB shares his journey from SOC analyst to detection engineer, diving deep into the challenges of cloud-native security, Kubernetes logging, and building a sustainable career in cybersecurity.

What We Cover:

• What detection engineering actually means in 2025
• Working with dual-cloud environments (AWS + GCP)
• The challenges of Kubernetes logging and ephemeral containers
• SANS FOR508 (Digital Forensics and Threat Hunting) experience
• How to avoid burnout in InfoSec
• Building a SOC career: What do entry-level analysts really need to know?
• Work-life balance with kids and an ambitious security career
• DefCon stories and the Octopus Games competition

Resources & Links Mentioned:

• Live Overflow's Hextree.io learning platform: https://hextree.io
• SANS FOR508 (GCFA): https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/
• Marcus Hutchins (MalwareTech) on LinkedIn: https://www.linkedin.com/in/malwaretech/
• Graham Helton's Kubernetes security work: https://www.linkedin.com/in/grahamhelton3/
• Simply Defensive Podcast: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
  
  

Connect with JB:

• YouTube: @JBCulbert
• Twitter/X: @JBTweetsStuff

Timestamps: 

00:00 Introduction and Guest Welcome

00:50 JB's Day-to-Day Role in Cybersecurity

01:47 Past Experiences and Career Journey

02:27 Challenges in Detection Engineering

03:23 Kubernetes and Incident Investigation

03:51 SANS Classes and CTF Experiences

09:07 Remote vs In-Person Learning

11:21 Future Plans and Learning Platforms

14:13 Docker and Kubernetes in Labs

16:11 The Reality of Cybersecurity Skills

16:40 Defcon and Octopus Games

22:04 Balancing Cybersecurity and Personal Life

31:01 Advice for Aspiring Blue Teamers

32:57 Final Thoughts and Farewell

Don't forget to like, subscribe, and hit the bell icon for more blue team content!

🔗 Follow the hosts:
Josh Mason: https://www.linkedin.com/in/joshuacmason/
Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

💡 Brought to you by ThreatLocker – Secure your business with zero trust application control.

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by @ThreatLocker - Free 30-day trial visit:
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber  
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Markus Schober, founder of Blue Cape Security, to talk all things digital forensics, incident response (DFIR), and why hands-on training beats theory every time.

We dig into:
 🔹 The hidden value of building your own cyber range
 🔹 How IR pros train using real attacks (and why they need red team skills)
 🔹 Eric Zimmerman's forensics tools and practical lab setups
 🔹 Ransomware war stories from Fortune 100 response
 🔹 The role (and limitations) of AI in forensics
 🔹 How to break into DFIR as a practitioner — not just a paper tiger

Whether you’re building detections, teaching DFIR, or just figuring out where to start, this one’s for you.

👇 Timestamps https://www.bluecapesecurity.com/& Resources
 0:00 Intro & ThreatLocker sponsorship
 2:00 Markus' journey from responder to trainer
 5:00 What makes a good DFIR workshop?
 7:00 Building a cyber range that doesn’t suck
 10:00 Favorite open-source tools (hint: Zimmerman)
 14:00 Consulting vs. in-house IR
 19:00 APT10, ransomware, and real-world incidents
 24:00 Can AI replace forensic analysts?
 27:00 Where to find Markus' courses
 29:00 Parting wisdom for aspiring defenders

📚 Check out Blue Cape Security:
→ https://www.bluecapesecurity.com/
→ Hands-on IR & Forensics Labs
→ Certification (coming soon!)

🔗 Follow the hosts:
 Josh Mason: https://www.linkedin.com/in/joshuacmason/
Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

💡 Brought to you by ThreatLocker – Secure your business with zero trust application control.

From Army recon missions to building Morado, COO Jordan Kalm reveals how military intelligence tactics translate into modern cyber threat intelligence. In this Simply Defensive episode, Josh Mason and Wade Wells dive into what really works for blue teams and SOC analysts — and what’s just noise.

👉 If you’ve ever wondered how to turn raw intel into actionable defense, this conversation is packed with practical takeaways you can use right away.

⏱ Timestamps
 0:00 – Intro & Jordan’s background
 4:00 – From infantry recon to threat intel
 12:00 – Building a threat intel platform that works
 20:00 – What blue teams actually need
 33:00 – Advice for new defenders

🔗 Connect with Jordan & Morado
 Jordan Kalm: https://www.linkedin.com/in/jordan-kalm-2a562b5b/
Morado: https://www.morado.io/

👥 Connect with us on LinkedIn:
- Josh Mason (Co-Host): https://www.linkedin.com/in/joshuacmason
- Wade Wells (Co-Host): https://www.linkedin.com/in/wadingthrulogs/
- Kevin Mata (Guest): https://www.linkedin.com/in/kevinmata
- Swimlane: https://www.linkedin.com/company/swimlane

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by ThreatLocker - Free 30-day trial of ThreatLocker
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

From the streets to the SOC. 💻

In this episode of Simply Defensive, Josh Mason and Wade Wells talk with Andrew Crotty — aka Ginger Hacker. A former detective turned Tier 3 SOC analyst and Army reservist, Andrew shares his journey into cyber, the struggles of breaking in, and the lessons he’s learned (including the rookie mistake that accidentally dosed the DMV 👀).

What you’ll hear:
🔹 Andrew’s pivot from law enforcement to cybersecurity
🔹 SOC life, schedules, and fighting burnout
🔹 Job hunting, recruiters, and landing that first role
🔹 Why soft skills matter as much as technical skills
🔹 Andrew’s advice for blue teamers: ask why, stay curious, fight alert fatigue

📺 Check out Andrew’s channel, Ginger Hacker: https://www.youtube.com/@gingerhacker

🎙️ More episodes of Simply Defensive: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4&si=TqefAfDjdR1AYt1c

👥 Connect with Us on LinkedIn:
- Josh Mason (Co-Host): https://www.linkedin.com/in/joshuacmason
- Wade Wells (Co-Host): https://www.linkedin.com/in/wadingthrulogs/
- Kevin Mata (Guest): https://www.linkedin.com/in/kevinmata
- Swimlane: https://www.linkedin.com/company/swimlane

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by ThreatLocker - Free 30-day trial of ThreatLocker
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

Automation is changing the way defenders work. In this episode of Simply Defensive, we sit down with Kevin Mata, Director of Cloud Operations at Swimlane, to talk about his journey from flipping burgers at In-N-Out to flipping SOC alerts with automation, SOAR, and AI.

Kevin shares how he got started in cybersecurity, how Swimlane helps Blue Teams save time and reduce alert fatigue, and where AI is already making a difference in the SOC. Along the way, he and Wade swap stories about early career struggles, Python hacks, and the future of automation in security operations.

If you’ve ever wondered how much you can trust automation, what SOAR really does in a SOC, or how AI will shape the future of defenders—this episode is for you.

👉 What You’ll Learn in This Episode:
- Kevin’s unique career journey: In-N-Out → SOC → Swimlane leadership
- How to use automation to supercharge Blue Team efficiency
- The role of SOAR platforms in ticketing, response, and orchestration
- Where AI fits into SOC operations (and where it doesn’t…yet)
- Tips for defenders at any stage of their career

🔗 Links & References from the Episode:
- Swimlane: https://swimlane.com
- Recorded Future: https://www.recordedfuture.com
- VirusTotal: https://www.virustotal.com
- Mistral AI: https://mistral.ai

👥 Connect with Us on LinkedIn:
- Josh Mason (Co-Host): https://www.linkedin.com/in/joshuacmason
- Wade Wells (Co-Host): https://www.linkedin.com/in/wadingthrulogs/
- Kevin Mata (Guest): https://www.linkedin.com/in/kevinmata
- Swimlane: https://www.linkedin.com/company/swimlane

🎙️ More Simply Defensive
- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4
- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4
- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182

👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.

=========================
Sponsored by ThreatLocker - Free 30-day trial of ThreatLocker
https://www.threatlocker.com/simplydefensive
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group

Ready to level up your defensive cybersecurity skills? In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Dan Regalado and Belem — the founders of Hack Defender Academy — to explore how they’re using CTF-style challenges, real malware cases, and gamification to prepare the next generation of defenders.

💡 We cover:

• Why gamified, CTF-style learning works better than traditional training
• How Hack Defender Academy helps beginners grow into skilled malware analysts
• The role of AI in threat research — friend, foe, or both?
• The importance of staying hungry and keeping your edge as a blue teamer

🚨 Special Gift for Our Listeners: Hack Defender Academy is giving away one free certification pass! Details in the episode.

🔗 Links from the episode

Hack Defender Academy
 🌐 Website: academy.hack-defender.com
 ▶️ YouTube: Hack Defender Official
📱 TikTok: @HackDefOfficial
📸 Instagram: @HackDefOfficial
🐦 X (Twitter): @HackDefOfficial
💼 LinkedIn: Hack Defender
📘 Facebook: Hack Defender

Connect with our guests
🔹 Dan Regalado – LinkedIn
🔹 Belem – LinkedIn

Simply Defensive Podcast
🎧 Spotify: Simply Defensive
🎧 Apple: Simply Defensive

Sponsor
 💼 Thanks to ThreatLocker for supporting this episode.

👍 If you enjoyed this conversation, hit Like, Subscribe, and ring the 🔔 so you don’t miss our weekly episodes!
Drop a comment with the biggest challenge you’ve faced as a blue teamer — we’d love to hear your story.

=========================
Sponsored by ThreatLocker - Free 30-day trial of ThreatLocker
https://www.threatlocker.com/simplydefensive
=========================
Connect with your hosts:
Josh Mason: https://www.linkedin.com/in/joshuacmason
Wade Wells: https://www.linkedin.com/in/wadingthrulogs
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================
This podcast is presented by Simply Cyber Media Group