The BlueHat Podcast

By Microsoft

Since 2005, BlueHat has been where the security research community, and Microsoft, come together as peers; to debate, discuss, share, challenge, celebrate and learn. On The BlueHat Podcast, Micro... more

· Technology

4.1

1212 ratings

Download on the App Store

Download on the App Store

Get it on Google Play

FAQs about The BlueHat Podcast:

How many episodes does The BlueHat Podcast have?

The podcast currently has 59 episodes available.

The BlueHat Podcast episodes:

July 09, 2025Hunting Variants: Finding the Bugs Behind the Bug
In this episode of The BlueHat Podcast, host Nic Fillingham is joined by George Hughey from Microsoft who returns to discuss his Blue Hat India talk on variant hunting, explaining how MSRC uses submission data from hacking competitions like Pwn2Own and Tianfu Cup to uncover additional security vulnerabilities in Windows. George shares how incentives in competitions differ from bug bounty programs, how tools like CodeQL assist variant hunting, and why collaborating with the security research community is key to improving Windows security.

In This Episode You Will Learn:
How hacking competitions help find real-world Windows vulnerabilities
The role of MSRC in hunting variants beyond submitted vulnerabilities
Why fuzzing is not always effective for modern edge cases

Some Questions We Ask:
How do you decide which cases to pursue for variant hunting?
What advice do you have for researchers submitting variants?
How does the CodeQL team collaborate with your team?

Resources:
View George Hughey on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
39min
June 25, 2025Securing Redirections with Mike Macelletti
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Mike Macelletti from Microsoft’s MSRC Vulnerabilities and Mitigations team to explore Redirection Guard, a powerful mitigation designed to tackle a long-standing class of file path redirection vulnerabilities in Windows. Mike shares how his interest in security began, the journey behind developing Redirection Guard, and how it's helping reduce a once-common bug class across Microsoft products. He also explains how the feature works, why it's impactful, and what developers can do to adopt it. Plus, a few fun detours into Solitaire hacking, skiing, and protein powder.

In This Episode You Will Learn:
What Redirection Guard is and how it helps prevent file system vulnerabilities
How Microsoft identifies and addresses common bug classes across their ecosystem
Why some vulnerabilities still slip past Redirection Guard and what’s out of scope

Some Questions We Ask:
What is a junction and how is it different from other redirects?
How does Redirection Guard decide which shortcuts to block?
Are there vulnerabilities Redirection Guard doesn’t cover?

Resources:
View Mike Macelletti on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
43min
June 11, 2025Ignore Ram Shankar Siva Kumar’s Previous Directions
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone share Ram Shankar Siva Kumar’s dynamic keynote from BlueHat India 2025, where he explores the evolving threat landscape of AI through the lens of the Microsoft AI Red Team. From adversarial machine learning to psychosocial harms and persuasive AI, Ram highlights real-world case studies, including prompt injection, content safety violations, and memory poisoning in AI agents. Ram underscores the urgent need for robust red teaming practices to secure AI systems against traditional security flaws and emerging threats across images, text, audio, and autonomous agents.

In This Episode You Will Learn:
Why old-school security flaws still break modern AI systems
Real-world AI red teaming in action, from scams to memory hacks
How small input tweaks can fool AI across images, audio, and text
Some Questions We Ask:
Can attackers fool AI using just slight image changes?
Are generative AI systems vulnerable to prompt manipulation?
Do you need to be an expert to break an AI model?

Resources:
Watch Ram’s BlueHat India 2025 Keynote: BlueHat India 2025 Day 2 Keynote - Ram Shankar Siva Kumar
Listen to Ram’s Previous Appearance on The BlueHat Podcast: Not with a Bug but with a Sticker

View Ram Shankar Siva Kumar on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
40min
May 28, 2025Protecting AI at the Edge with David Weston
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone share David Weston’s keynote from BlueHat India 2025. David explores the growing role of on-device AI in Windows, the security risks it introduces, and how Microsoft is rethinking architecture to defend against new threats like model tampering, data exfiltration, and AI-powered malware. He also shares insights on innovations like Windows Recall, biometric protection, and the future of secure, agentic operating systems.

In This Episode You Will Learn:
How AI integration in Windows (like Windows Recall and MS Paint) is evolving
Emerging threats from protocols like MCP and CUAs
What a “confused deputy” attack is, and how Microsoft is protecting users
Some Questions We Ask:
What are the biggest security threats in on-device AI—data, model, or runtime?
Can AI be used to accelerate post-compromise attacks?
What will it take to bring Azure-level confidential computing to the consumer device?

Resources:
View David Weston on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn


Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
40min
May 14, 2025Hacking at the Weeds with Felix Boulet
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Felix Boulet fresh off his participation in Zero Day Quest. Felix talks about his unique journey from industrial maintenance to becoming a full-time vulnerability researcher, and how that background fuels his passion for hacking and bug bounty work. He explains his method for finding bugs in Microsoft products—particularly in identity systems—and why identity is such a valuable target for attackers. Felix also shares highlights from the Zero Day Quest event, where he focused on building connections, learning from Microsoft engineers, and experiencing the collaborative side of the security community.

In This Episode You Will Learn:
Why identity-based bugs are especially valuable and dangerous in the security world
When breaking identity controls can be the key to pivoting through an entire system
How SharePoint's concept of "virtual files" impacts vulnerability validation

Some Questions We Ask:
What was your first bug bounty experience?
Can you explain what the flash challenges were and what your experience was like?
Do you think sharing bug ideas could cost you a bounty?

Resources:
View Felix Boulet on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
34min
April 30, 2025Evolutions in Hacking with Marco Ivaldi
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Marco Ivaldi, co-founder and technical director of HN Security, a boutique company specializing in offensive security services, shares his journey from hacking as a teenager in the '80s to becoming a key figure in the security research community. With nearly three decades of experience in cybersecurity, Marco digs into the ongoing challenges, particularly in Active Directory and password security, highlighting vulnerabilities that continue to pose significant risks today. He recounts his unexpected path into bug bounty hunting, including his involvement in Microsoft's Zero Day Quest and his passion for auditing real-time operating systems like Azure RTOS.

In This Episode You Will Learn:
How Marco taught himself BASIC and assembly through cassette tapes and trips to local libraries
Why mentorship and positive leadership can catapult your cybersecurity career
When measuring network response times can unintentionally leak valuable info
Some Questions We Ask:
Do you remember the first time you made code do something unexpected?
What was your experience like in the Zero Day Quest building for those three days?
How are you thinking of approaching fuzzing after Zero Day Quest?
Resources:
View Marco Ivaldi on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

HN SECURITY
Learn More About Marco

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
50min
April 16, 2025From Facebook-phished to MVR Top 5 with Dhiral Patel
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Dhiral Patel, Senior Security Engineer at ZoomInfo and one of MSRC’s Most Valuable Researchers (MVR). Dhiral shares how a hacked Facebook account sparked his passion for ethical hacking. From web development to penetration testing, Dhiral has become a top bug hunter, landing multiple spots on the MSRC leaderboards. Dhiral reflects on his early MSRC submissions and lessons learned. He also discusses the importance of mastering web security basics, practicing on platforms like TryHackMe and Hack the Box, and staying connected with the bug bounty community.

In This Episode You Will Learn:
The importance of mastering web security basics before diving into bug bounty hunting
Why hands-on platforms like TryHackMe and Hack the Box are perfect for beginners
Dhiral’s journey from blogging to freelancing and security research
Some Questions We Ask:
How do you balance competition and collaboration in the bug bounty community?
Can you explain what clickjacking is and if it still works today?
Why did you start with Power BI, and how did it lead to your journey in security?
Resources:
View Dhiral Patel on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
42min
April 02, 2025AI & the Hunt for Hidden Vulnerabilities with Tobias Diehl
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by security researcher Tobias Diehl, a top contributor to the Microsoft Security Research Center (MSRC) leaderboards and a Most Valuable Researcher. Tobias shares his journey from IT support to uncovering vulnerabilities in Microsoft products. He discusses his participation in the upcoming Zero Day Quest hacking challenge and breaks down a recent discovery involving Power Automate, where he identified a security flaw that could be exploited via malicious URLs. Tobias explains how developers can mitigate such risks and the importance of strong proof-of-concept submissions in security research.

In This Episode You Will Learn:
Researching vulnerabilities in Power Automate, Power Automate Desktop, and Azure
The importance of user prompts to prevent unintended application behavior
Key vulnerabilities Tobias looks for when researching Microsoft products
Some Questions We Ask:
Have you submitted any AI-related findings to Microsoft or other bug bounty programs?
How does the lack of visibility into AI models impact the research process?
Has your approach to security research changed when working with AI versus traditional systems?
Resources:
View Tobias Diehl on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
36min
March 19, 2025Bug Hunting from the Beach with Brad Schlintz
In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Brad Schlintz, independent security researcher and bug bounty hunter. Brad shares how he transitioned from a decade-long career as a software engineer to hacking Microsoft products while traveling the world with his wife. He recounts his early days tinkering with RuneScape bots, his experience working in SharePoint and Azure at Microsoft, and the moment he first encountered a real-world cybersecurity incident. He also discusses his journey into ethical hacking and his qualification for the upcoming Zero Day Quest, showcasing how he turned bug hunting into a lifestyle that allows him to work from anywhere—including a stunning island in Brazil.

In This Episode You Will Learn:
How a single discovered bug can lead to finding multiple vulnerabilities in the same area
The importance of exploring app integrations when searching for security vulnerabilities
Why building on prior discoveries can make it easier to uncover more hidden security issues
Some Questions We Ask:
What guidance can you share with other researchers and hackers on how to find vulnerabilities?
Why did your background in software engineering help you in your bug bounty work?
How did you transition from working on the website incident to more full-time security research?
Resources:
View Brad Schlintz on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks


Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
39min
March 05, 2025PoCs, Patching and Zero Day Quest Participation with Michael Gorelik
In this episode of The BlueHat Podcast, Nic and Wendy are joined by seasoned security researcher, and CTO of Morphisec, Michael Gorelik. Michael discusses his approach to security research, which often begins by exploring PoCs released by other researcher groups and continues through to the release and validation of – sometimes multiple rounds of – fixes. Michael also provides an overview of this BlueHat 2024 presentation from last October and discusses his upcoming participation in the Zero Day Quest Onsite Hacking Challenge.

In This Episode You Will Learn:
How Michael Gorelik transitioned from security researcher to company founder
Deeper motivations driving ethical hackers like Michael Gorelik beyond money
The importance of identifying incomplete security patches before attackers do
Some Questions We Ask:
What are you looking forward to with Zero Day Quest?
Did you have a moral dilemma about hacking when you were younger?
What was your experience like at Deutsche Telekom Laboratories?
Resources:
View Michael Gorelik on LinkedIn
View Wendy Zenone on LinkedIn
View Nic Fillingham on LinkedIn

Related Microsoft Podcasts:
Microsoft Threat Intelligence Podcast
Afternoon Cyber Tea with Ann Johnson
Uncovering Hidden Risks


Discover and follow other Microsoft podcasts at microsoft.com/podcasts

The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.
...more
47min

FAQs about The BlueHat Podcast:

How many episodes does The BlueHat Podcast have?

The podcast currently has 59 episodes available.