The Human Perimeter

In this episode of the Human Parameter Podcast, we dive into the pressing topic of AI security vulnerabilities and their real-life implications. Discover how these vulnerabilities can affect your business and what proactive measures you can take to protect yourself.Key takeaways:* The shift from live streams to recorded episodes for better viewer engagement.* Understanding the recent PHP vulnerabilities and their impact on the web.* The importance of timely updates and security measures for website owners.* How AI can both expose and mitigate security risks.What's your biggest challenge with AI security? Drop it in the comments or send us an email.

Simon's on vacation, so this week it's a solo deep dive into two fraud cases that look nothing alike on the surface but share the exact same structural flaw.

In September 2026, 347,000 Trezor newsletter subscribers received a phishing email that passed every authentication check email security has: valid SPF, valid DKIM, valid DMARC. Not spoofed. Genuinely authentic, because attackers exploited an SSO misconfiguration at Brevo, Trezor's email platform, and sent the phishing mail through Trezor's own real, authorized channel. About 2,500 people clicked before it was shut down twenty minutes later.

Then I connect it to invoice fraud, which is quietly draining businesses of billions, sometimes through a compromised inbox, sometimes through a genuine man-in-the-middle attack where nobody's account is ever touched at all, because email encryption between mail servers is opportunistic, not enforced.

In this episode:

• How the Brevo/Trezor breach actually worked, and why most coverage got the mechanism wrong
• Why "valid DKIM" was never a promise that a message is trustworthy
• The difference between a compromised mailbox and a true network-level interception, and why victims often can't tell which one hit them
• Why "be more careful" is the wrong advice for either attack
• What actually stops both: out-of-band verification, and treating email infrastructure as critical infrastructure

This is the recurring argument on this show: the human decision point is always the last line of defense, and it's routinely handed zero usable information to make the call with. That's a structural failure, not a training problem.

The Human Perimeter is a cybersecurity podcast about the human decisions behind every technical failure, hosted by André Daus and Simon Gajdosik.

A customer on xCloud lost every site on their account this week. Vultr's hostdisk failed, backups were off, no snapshots existed, and support said there wasnothing to restore.I am not here to pile on. Hardware fails and no provider can promise it won't.But the backup was never the host's job. Unless a company puts it in writingthat they run backups and will restore them, assume nothing is being backed up."Managed" is a marketing word. Read what it covers.The painful part: Vultr's backup option is a checkbox that costs 20% on top ofthe server price. On a small VPS that is a few dollars a month.

In 2024, a single technique compromised roughly 165 companies that had never spoken to each other, never shared infrastructure, and in most cases never even knew they shared a vulnerability. No zero-day. No sophisticated exploit chain. Just stolen passwords, sitting unused for years, and one missing setting: multi-factor authentication.

In Episode 7, Simon and Andre dig into the Snowflake customer breach campaign — how threat actor UNC5537 (ShinyHunters) turned old infostealer malware logs into access at Ticketmaster (560M records), AT&T (109M customers, undisclosed ransom paid), Santander, Neiman Marcus, LendingTree, Advance Auto Parts, and half a dozen others, extorting each one individually with a price tag ranging from $150,000 to $2 million.

This wasn't 165 separate hacks. It was one repeatable gap, exploited at scale: credentials exposed years earlier that nobody rotated, and accounts nobody protected with MFA — even where the option existed.

We break down what actually happened, why "the password leaked in 2020" is still a live threat in 2026, and what one control would have stopped almost all of it.

Source: Push Security, "Snowflake: A Retrospective" — https://pushsecurity.com/blog/snowflake-retro

🔴 Live — join the chat, ask questions, tell us if your org has checked this.

Three seconds of audio. That's all it takes to clone a voice convincingly enough to fool a family member on the phone. AI scam calls now sound exactly like the people you trust — and in 2024 alone, seniors lost $4.9 billion to cybercrime, much of it accelerated by exactly this kind of fraud.

Recorded live, Simon and Andre break down how generative AI has turned voice, image, and video into the newest attack surface — and what to actually do about it. Simon covers the technical mechanics: how little source audio is needed, where AI still leaves subtle tells, and what real verification protocols look like. Andre covers the psychology: why fear defeats scrutiny by design, why a cloned voice you trust is a deeper betrayal than a stranger's, and why shame gives scammers the time they need.

They also run a live, consent-based demo — cloning Andre's own voice to read a short ad read — so you can hear exactly how convincing this technology has gotten.

⚠️ Disclosure: This episode includes a clearly labeled AI-generated voice clone of Andre, created with his consent for educational purposes. The cloned segment is verbally announced before and after it plays. No real person is impersonated without permission.

In this episode:

• Why 3 seconds of audio is enough to clone a voice
• The FBI's December 2024 warning on generative AI fraud
• Why "it sounded just like them" is no longer a reliable gut-check
• Family and business verification protocols that don't rely on detecting a fake
• A live voice-clone demo, clearly labeled

Sources:
FBI/IC3 PSA — "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud" (Dec 3, 2024): ic3.gov/PSA/2024/PSA241203
FBI 2024 Elder Fraud data: fbi.gov/news/press-releases/fbi-recognizes-world-elder-abuse-day-and-reminds-americans-of-elder-fraud

The Human Perimeter — where security meets human behavior.

In this episode, Simon and Andre explain what a passkey is, why it beats passwords and SMS codes, and where hardware tokens still matter in 2026. The question is no longer whether passkeys are good. They are. The real question is who holds the private key, where it can move, and how someone gets back in when something goes wrong.

One email lands in the inbox:

• A supplier invoice.
• A SharePoint link.
• A DocuSign request.
• A password reset.
• A domain renewal notice.

Nothing dramatic. Just work.

In Episode 5, Simon and Andre take apart the phishing email that fools a whole company. Not the cartoon spam with bad spelling. The good one. The one that looks like the tools, vendors, bosses, deadlines, and workflows people already trust.

Security Magazine summarized Comcast Business research saying about 67% of breaches start with someone clicking a seemingly safe link, and that 80 to 95% of attacks begin with phishing. Comcast’s 2025 report analyzed 34.6 billion cybersecurity events, including 4.7 billion phishing attempts. The FBI’s 2024 IC3 report recorded 193,407 phishing and spoofing complaints, more than any other listed crime type.

The question is no longer why someone clicked. Episode 4 covered that.

The question now is what happens when the email becomes the attack path.

You know the link looks strange. You click anyway. Why?

Social engineering does not target your intelligence first. It targets the moment around it: pressure, trust, fear, curiosity, fatigue, and routine.

In Episode 4, Simon and Andre look at why smart people fall for scams. Not because they are careless. Because attackers design messages for the brain people actually use at 4:47 p.m., between two calls, with thirty unread emails and a manager waiting for an answer.

The episode draws on the paper Human Cognition through the Lens of Social Engineering Cyberattacks. The paper treats social engineering as a psychological attack. Workload, stress, low vigilance, limited domain knowledge, lack of experience, culture, trust, and attacker effort all shape the click.

Knowing about phishing does not always protect you. General technical skill does not always protect you. Suspicion alone does not always protect you.

A better defense starts with the pause.

In November 2023, the FBI and CISA put out a joint advisory on one of the most effective cybercriminal groups operating today: Scattered Spider.

What makes them unusual isn't the malware or the exploits. It's that they barely need any. A phone call, a convincing story, and a help desk employee trying to be helpful — that's often all it takes.

In this solo episode, André breaks down exactly how Scattered Spider operates: how they impersonate IT staff to extract credentials, how they hijack phone numbers to bypass two-factor authentication, and how they stay hidden inside a network by blending in with normal IT activity. Including, in some cases, joining the victim's own incident response calls to monitor how the investigation is going.

This is also a story about how security fails at the human layer — and what organisations actually need to do to close that gap.

What we cover:

• Who Scattered Spider is and what sets them apart
• Why your help desk is now a primary attack surface
• SIM swapping and MFA fatigue — two techniques that break most authentication setups
• How they maintain access even after passwords are changed
• Their move into ransomware via the BlackCat/ALPHV group
• The defences that actually work against this type of attack

Source: CISA/FBI Joint Advisory AA23-320A

🌐 human-perimeter.com