The Cyber Resilience Brief: A SafeBreach Podcast

How is AI suddenly finding zero days that survived decades of human fuzzing? In April 2026, Anthropic's Claude Mythos and OpenAI's ChatGPT 5.5 rewrote what's possible with a keyboard. Host Tova Dvorin and offensive security expert Adrian Culley unpack the UK AISI's verdict — genuine step changes — through decades-old bugs in OpenBSD and FFmpeg, the 32-step autonomous attack chain, the Cyberstrike AI campaign across 648 firewalls, and why "capability doubling every 4.7 months" makes continuous validation non-negotiable for every CISO.

Most enterprises assume their zero trust architecture covers their AI agents. It doesn't. Hosts Tova Dvorin and Adrian Culley break down why zero trust breaks against the Model Context Protocol (MCP) — and why "verified" no longer means "safe." They unpack trust decay, the WhatsApp and GitHub MCP exploits, rug-pull tool poisoning, CVE-2025-49596, and the rise of "zero standing trust," then close with three moves for CISOs this quarter: inventory your MCP estate, mandate authentication, and validate your controls.

#cybersecurity #infosec #CISO #MCP #ZeroTrust #AgenticAI #AISecurity #BAS

The NSA just published a rare advisory on the Model Context Protocol (MCP)—the plumbing under nearly every agentic AI deployment of the last 18 months—and the verdict is stark: optional authentication, no token lifecycle, silent behavior changes, and no logging to catch any of it. Host Tova Dvorin sits down with defensive cybersecurity expert Adrian Culley to unpack the eight risk categories, the WhatsApp and GitHub MCP exploits, and why MCP is now a testable validation surface.

#cybersecurity #infosec #CISO #MCP #AgenticAI #NSA #CTEM #BAS

When a tired EU diplomat clicks "connect" on an airport Wi-Fi portal, his briefing — and his government's secrets — end up in Chengdu. Hosts Tova Dvorin and Adrian Culley unpack Mustang Panda (APT27 / Bronze President), the Chinese threat group running the long con against NGOs, ASEAN ministries, and Tibetan and Uyghur activists. Inside: captive-portal Wi-Fi Pineapples that bypass MFA, PlugX side-loading through legitimate apps, and the USB worm that jumps air-gapped military networks.

#cybersecurity #infosec #CISO #MustangPanda #APT27 #ChinaAPT #BAS #SafeBreach

In the finale of our Russian intelligence and proxy threat series, SafeBreach engineer Adrian Culley joins host Tova Dvorin to turn five episodes of analysis into concrete, actionable defense. The threat is real — now here's how you stop it.

Adrian and Tova walk through five critical mitigation layers your organization needs to implement today: hardening the human firewall through Continuous Automated Red Teaming (CART), enforcing adaptive MFA that Scattered Spider's session token theft and fatigue attacks can't bypass, locking down cloud and SaaS platforms — Salesforce, Snowflake, Okta — against FSB-linked privilege escalation, validating network segmentation against BlackCat ransomware's exact behavioral signatures, and disrupting intelligence sharing between GRU, SVR, FSB, and their criminal proxy networks by tracking IOC convergence in real time.

The central thesis: don't guess, test. Every control your team thinks is working needs to be validated against real adversarial behavior — because if SafeBreach can simulate the bypass, so can they.

China's cyber shadow has already reached your software. APT 41 — known as Double Dragon — isn't just stealing state secrets. They've pioneered a new generation of supply chain attacks, trojanizing the shared code libraries that thousands of organizations trust without question. And their latest splinter unit, UAT 7290, has been inside North American developer environments for over a year — not triggering anything, just watching, learning, and waiting to strike in a way that looks completely native.

In this episode, Tova Dvorin and Adrian Culley expose the group that breaks every rule of traditional espionage: how the MSS built an elite hacker force by letting them run their own criminal enterprise on the side, how APT 41 turned the video gaming industry into a personal ATM worth millions, and why China's 2026 cybersecurity law has given these groups a 48-hour head start on every new exploit.

In Part 4 of our Russian intelligence series, host Tova Dvorin and Adrian Culley map the proxy bridge between Western teenage hackers and Moscow. BlackCat (ALPHV) ransomware-as-a-service is the operational hinge: Scattered Spider breaks in, BlackCat encrypts, and the FSB watches the dashboard. Hear how the Kremlin earns plausible deniability, why a $115M extortion stream self-funds Russian intelligence, and what MI6's new "hybrid shadow war" warning means for defenders simulating Rust-based ransomware in their own networks.

Are you still stuck on the vulnerability hamster wheel?

In this episode of the Cyber Resilience Brief, host Tova Dvorin is joined by SafeBreach VP of Product Koby Bar and offensive security expert Adrian Culley to unpack a major shift in how enterprises approach proactive security — and to announce the launch of SafeBreach Helm, the AI validation layer built for Continuous Threat Exposure Management (CTEM).

They break down all five pillars of CTEM — scoping, discovery, prioritization, validation, and mobilization — and explain exactly why most organizations stall before operationalizing any of them. You'll learn why nearly 40% of actionable exposures aren't CVEs at all, why CVSS scores without context are dangerous, and how an LLM-driven engine can turn 10,000 vulnerabilities into 12 surgical priorities — validated against your actual environment.

Whether you're a CISO trying to prove security ROI, a security engineer drowning in alerts, or a practitioner exploring CTEM frameworks, this episode delivers the blueprint for moving from theoretical risk to proven, validated exposure management.

Topics covered:

• What CTEM actually means and why the detect-and-patch model is broken
• How AI-powered scoping keeps pace with a dynamic attack surface
• Why toxic combinations of misconfigs and identity risks outrank many high-CVSS CVEs
• Adversarial Exposure Validation (AEV): testing controls, not just checking boxes
• How Helm bridges the IT/security communication gap to accelerate remediation

Learn more about how SafeBreach supports CTEM: https://www.safebreach.com/solution-brief/ctem-by-safebreach/

Your home router isn’t just sitting there. It might already be part of a global cyberattack.

In Part 2 of our deep dive into Chinese cyber operations, Tova Dvorin and Adrian Culley unpack the “Typhoon” threat groups—Volt Typhoon, Salt Typhoon, and Flax Typhoon—and how they’re quietly reshaping modern cyber warfare.

This isn’t about stealing data.

It’s about staying hidden, pre-positioning, and being ready to strike.

In this episode, you’ll learn:

• How hackers are living inside networks for years without detection
• What “living off the land” really means—and why security tools miss it
• How compromised home routers became a global proxy network
• Why telecom systems—and even lawful surveillance tools—were targeted
• The real strategy behind China’s cyber operations: preparing for future conflict
  

From power grids to personal devices, this episode reveals how the battlefield has already expanded—and why most organizations still aren’t ready.

The EU Cyber Resilience Act (CRA) is set to transform cybersecurity—from a best practice into a legal requirement. But what does that actually mean for security teams, product leaders, and CISOs?

In this episode of The Cyber Resilience Brief, host Tova Dvorin and cybersecurity expert Adrian Culley break down the CRA in plain terms—and explain why the shift to continuous security validation is unavoidable.

You’ll learn:

• What the CRA means by “products with digital elements (PDEs)”—and why almost everyone is in scope
• The real obligations manufacturers, importers, and distributors must meet
• How CRA connects to DORA and TIBER—and why this is just the beginning of a broader regulatory wave
• Why point-in-time testing is officially obsolete
• How BAS, CART, and Adversarial Exposure Validation (AEV) enable continuous compliance and real resilience

With enforcement deadlines approaching and significant penalties on the horizon, the message is clear: If your security testing isn’t continuous, it’s not CRA-ready.

Whether you're selling into the EU or building digital products anywhere in the world, this episode will help you understand what’s coming—and how to stay ahead of it.

Listen now to learn how to shift from reactive security to continuous cyber resilience.

Read more about EUCRA in our blog: https://www.safebreach.com/blog/eu-cyber-resilience-act-readiness/