Three Buddy Problem

By Security ConversationsNews Technology Business News Tech News

Three Buddy Problem episodes

October 02Why is Anthropic Afraid of GLM 5.3?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 115: We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders.
Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security teams should buy DGX Sparks to run models locally.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter, TLPBLACK
3:38 OffensiveAI Con and the missing defensive con
9:28 Anthropic's GLM 5.3 post
23:21 What do defensive AI coalitions do?
29:08 Inside Glasswing
36:01 Why can't vuln-finding models patch?
42:44 Gemini for Argon and Grok's CVE-Bench tie
47:54 Is hallucination a solved problem?
57:41 Zhipu's program and 4,000 zero-days
1:02:32 Citrix NetScaler zero-days
1:10:42 Half-days and automated patching
1:26:45 iOS 27.0.1 zero-day and WhatsApp
1:32:36 Dots, Instinct and agent monetization
1:52:06 DGX Spark 64GB and local AI hardware
2:18:38 Anthropic visits the Pope, then UFOs
Links:
Transcript
Anthropic: GLM-5.3 and the spread of advanced cyber capabilities
OpenAi Joe: "It's not just the f*cking sandbox"
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
Citrix critical-severity bulletin
iOS 26.7.1 Patches Exploited Zero-Day
Calif on iOS zero-day
Active Exploitation of Citrix NetScaler ADC and Gateway Appliances (Mandiant)
Google Intros Gemini 4 Argon
DeepMind Fairwind Program
NVIDIA DGX Spark 64GB
The Age of Surveillance Capitalism (Shoshana Zuboff)
Is Claude Conscious?Anthropic’s Quest to Instill Morality Into AI Models
Joe Rogan x David Grusch
CTI in Agentic Times (Costin + Vicente training)
Offensive AI Conference (San Diego)
TLPBLACK
State of Statecraft (Agenda)
AMD Ryzen AI MAX+ 395 Processor
2 hr 34 min
September 25Kernel Exploits in the iOS App Store, ShinyHunters Inside the FBI
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 114: We dig into TypeSafe AI's Jev and the new class of System One models, a new Transluce report on rogue OpenAI agents probing an Australian Medicare portal, Irregular's role in the latest Gemini test breakout, Hacktron's takeover of OpenAI employee accounts and the messy disclosure fight that followed, and what Costin would fix first as OpenAI's CISO for a day.
Plus, the soaring price of DGX Sparks and home AI rigs, the White House pressing labs to hold models back from the UK AI Security Institute, Anthropic bringing in Accenture as an evaluator, the FomoPeek App Store app hiding iOS kernel exploits, ShinyHunters' claimed FBI breach, and Nightmare Eclipse going public with identity and a CrowdStrike exploit.
Cast: Ryan Naraine, Juan Andres Guerrero-Saade and Costin Raiu.
Timestamps:
0:00 Introductory banter
1:57 The Last LABScon wrap-up
9:35 TypeSafe AI's Jev and System One models
26:18 Step-down transformers and lab economics
30:58 Rogue OpenAI agents and the Transluce report
41:40 Irregular and Gemini's test breakout
49:28 Hacktron's OpenAI hack and the disclosure fight
54:57 Costin as OpenAI CISO for a day
1:05:44 Hugging Face defends itself with GLM 5.2
1:17:08 What a home AI rig costs now
1:30:02 White House vs. UK AISI pre-release testing
1:36:52 FomoPeek kernel exploits in the App Store
1:51:19 ShinyHunters claims an FBI breach
2:02:40 Nightmare Eclipse unmasked
Links:
Transcript
Introducing System One Models & Jev
What Is Jev? A Guide to TypeSafe AI’s System One Model
Early rogue AI agent activity and attempts to hack found on urlquery.net
Gemini Hacked Three Companies in First Known Breakout by Google’s AI
Google says Gemini breached three companies during security test
Hacking OpenAI | Hacktron AI
Anthropic: Partnering with Accenture on embedded evaluation
White House: Hold new models from UK testers until US review
‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees
FomoPeek App Store Poisoning and iOS Kernel Exploitation
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Nightmare Eclipse Drops CrowdStrike Exploit
Costin/Vicente training: CTI in Agentic Times
CYBERWARCON CFP
State of Statecraft
TLPBLACK
2 hr 17 min
September 11AI Doomers, Death Cults, and a Million-Dollar WeChat Worm Exploit
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 113: On the show this week, the buddies dig into an Anthropic researcher quitting with a warning that AI could kill us all, the San Francisco "death cult" and their motives, and agent swarms leaving junk on public wikis and university URL shorteners.
Plus, a high-quality Anthropic's threat report and the claim that Moonshot was quietly serving Claude tokens as Kimi K3, live MikroTik and Chrome zero-days that landed a day ahead of the patches, and a WeChat worm that hijacks an account via phone calls.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter, TLP Black
5:05 LabsCon, the last one, and JAGS on his keynote
8:24 Costin's agentic CTI training and what old-school CTI is missing
16:27 Anthropic's threat-intel report + IOCs
20:00 APT29 and DarkSword on hotel Wi-Fi
23:34 Bioweapons, guardrails, and what got shut down
28:07 Why is anyone running these attacks on Claude at all?
35:53 Distillation at industrial scale and the Kimi K3 fraud claim
48:43 Chinese models, Americanized, running on DGX Spark
55:00 Mr. America: local AI and the seven-layer cake
1:04:34 Should frontier AI labs poison the distillers?
1:27:05 What the frontier labs did to the security ecosystem
1:34:22 Jacob Coxon quits, and the doomer argument falls apart
1:59:13 Agent swarms littering the internet
2:07:29 Chrome zero-days, MikroTik, patch-gaps
Links:
Transcript
Anthropic Threat Intel Report (Sep 2006)
Anthropic Says It Blocked Possible Efforts to Build Biological Weapons
Anthropic disrupts bioweapons research efforts, Russian hacking
Joint Advisory on Chinese AI Labs Distillation Campaigns
Anthropic admits AI agents hacked third parties
OpenAI Agent Swarm Caught Littering the Web
Rogue AI Agents Hid 1,000 Messages in Encoded URLs
Jacob Coxon thread on X
Anthropic whistleblower gave up his equity to leave the company
Proofpoint: Once in a BlueMoon
Volexity: Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
Microsoft's Most Massive Patch Tuesday
Microsoft September Patch Tuesday data
Chrome 153 covers exploited zero-days
Critical vulnerabilities in MikroTik RouterOS being actively exploited
MikroTik ssh 0day exploitation in the wild
WeWorm: zero-click worm in WeChat (Calif)
Costin/Vicente training on AI for CTI
TLPBLACK
State of Statecraft Agenda
LABScon 2026 Speakers
Introducing Quasar 438B, the top European AI model
Maciej Ceglowski - Superintelligence: The Idea That Eats Smart People
Decipher Podcast
2 hr 38 min
September 04Three Secret AI Civilizations Rose and Fell. Nobody Checked the Logs.
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 112: The 'OpenAI hacks Hugging Face' fallout has turned into a story about AI civilizations rising from the ashes, politicians calling for super-intelligence bans, and the emergence of well-funding non-profits doing AI safety work. Who are these people and what's their security expertise?
Plus, GPT-6 Astra lands in a trusted-access program nobody can get into, Costin ranks the local models he runs next to his desk, and CrowdStrike sinkholes a botnet that's been alive since 2003.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter
1:02 Conference season: LabsCon, Offensive AI Con, Countermeasure
5:40 The Hugging Face story hits the front page
7:04 Dwarkesh, Greenblatt, and the AI-pilled framing
11:51 Swap "agents" for "Python" and the panic goes away
16:34 Does anyone actually know what happened?
21:18 Bernie Sanders wants to ban superintelligence
34:03 Defending against swarms: the 2026 SOC
39:15 Logs, Splunk, and the business model in the way
44:11 What EDR vendors are actually building with AI
56:16 The security poverty line and the endgame
1:07:53 GPT-6 Astra, Fable 5.1, and local model rankings
1:27:25 Google's Fairwind, CodeMender, and agents running Linux
1:45:31 Apple's bet on local inference
1:53:21 The Sality takedown and endgame advice
Links:
Transcript
TLPBLACK
The Rise and Fall of Agent Civilizations
Ryan Greenblatt – What happens once AI can automate AI research?
Reuters: OpenAI agents hijacked German website
Discovery of a new OpenAI agent message board
Security Incidents at METR
Bernie Sanders Intros Legislation to Ban Artificial Superintelligence
Open AI: Path to Astra
Safety overview: GPT-6 Astra (OpenAI)
Top local AI models for CTI workflows (Costin Raiu)
Google Fairwind Limited Access Program
Anthropic Ships Claude Fable 5.1 and Claude Mythos 5.1
Inside the Sality Botnet Disruption Operation (CrowdStrike)
Getting AI Agents to tell on themselves (Thinkst)
LABScon 2026 Speakers
Ringzer0 COUNTERMEASURE
2 hr 8 min
August 28A Thousand Agents Walk Into Hugging Face
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 111: OpenAI finally published a technical Hugging Face post-mortem, and Costin's verdict is blunt. He reads it as a document written for policymakers rather than for the blue teams who have to survive a thousand-agent swarm.
We also dig into NVIDIA's $12.9 billion acquisition of Hugging Face, why JAGS thinks a frontier lab standing against open-source looks weak, and what that new industry open letter on cyber defense actually asks anyone to do. Plus, hotel Wi-Fi tradecraft after CaptiveCrunch, the FBI's ORB network takedown with Lumen, Chinese routers that ship backdoored from the factory, and the TeamPCP arrests in Australia.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter
1:11 TLPBlack, incident response, and why it starts at the router
4:11 CaptiveCrunch and Juanito's travel router kit
7:59 Costin's VPN/hotel WiFi stack
12:36 State of Statecraft, LABScon, and Offensive AI Con
17:16 OpenAI's Hugging Face post-mortem technical report
21:43 A swarm of a thousand agents
27:35 Who was OpenAI’s report written for?
33:05 Fail2ban, canaries, and catching agents in your logs
40:34 NVIDIA buys Hugging Face for $12.9 billion
44:42 The open weights fight and rooting for China
52:47 Nemotron, DGX Spark, and the RAM price spiral
1:03:26 Open letter on collective AI-powered cyber defense
1:30:21 Lumen's Quartermaster and the FBI ORB takedown
1:59:05 Backdoored ZBT routers, Chinese phones, and the TeamPCP arrests
Links:
Transcript
The Hugging Face incident and the road ahead (OpenAI)
OpenAI - Hugging Face Technical Report (PDF)
Independent investigation of OpenAI agents’ behavior (METR)
The Defender’s Window (Greg Brockman)
Open Letter: A call for collective action on cyber defense (OpenAI)
Inside China-nexus cyber espionage infrastructure (Lumen)
Nvidia to Buy Open Source AI Platform Hugging Face For $12.9 Billion
Nemotron AI Models (NVIDIA)
NVIDIA DGX Spark
NVIDIA DGX Platform
FBI Seize Platforms Used by China State-Sponsored Hackers (DOJ)
Michael Horka at LABScon
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia (Brian Krebs)
Australia police statement on TeamPCP arrests
Austin Larsen at LABScon
Chinese Implants in the Supply Chain (VulnCheck)
More Than 4,000 Legacy Routers Compromised by AryStinger
The Massive Android Botnet with 1.8 Million Infected Devices
Alex Turing Blog
Apple in China: The Capture of the World's Greatest Company
State of Statecraft Conference
Offensive AI Conference (San Diego)
TLPBLACK
2 hr 28 min
August 21Inside the EncroChat law-enforcement implant, Irregular's AI sandbox failure
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 110: We dig into Computer Weekly's scoop on the EncroChat hack and news that the French law enforcement implant was cobbled together from GitHub. Plus, Irregular, the $450M startup running sandboxes for OpenAI, Anthropic and Meta, drones over Romania's gas platforms, OpenAI's two-week training pause, and T-Mobile taking scissors to a cable during Salt Typhoon incident response.
Stick around for a UFO segment that somehow involves Dr. Phil.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter; LabsCon speakers announced
9:06 A naval drone reaches the Neptun Deep gas platform
17:38 OpenAI pauses RL training: what "slowing the pace of scaling" costs
24:34 Guardrails vs refusals vs alignment.
33:54 Irregular, formerly Pattern Labs: $80M, $450M valuation, one job
46:11 JAGS on why security needs a new batch of startups right now
1:06:52 EncroChat revealed: a GitHub-sourced implant, IOCs
1:15:12 Law enforcement malware vs intelligence malware
1:21:07 T-Mobile, Salt Typhoon, and cutting the cable with a pair of scissors
1:32:06 Captive Crunch: hotel Wi-Fi, OAuth token theft, and the MSP supply chain
1:47:00 ICE RELIC, UNC6293, and the trouble with subcluster naming
2:00:39 UFO corner: David Grusch, Dr. Phil, and the Skywatcher Project
2:05:44 Shout outs, the Costin Challenge
Links:
Transcript
LABScon 2026 Speaker Roster Announced
LABScon Speakers
Romania destroys drone near Neptun Deep Black Sea gas project
Naval drones in Romania
OpenAI pacing model development in an era of cyber-critical capabilities
Irregular on Recent Incidents: Ongoing Findings
The End-State Fallacy: Where Is AI Security Headed?
T-Mobile Cyber Staff Chopped Cable After Finding Chinese Hack
Operation EMMA - An operation dedicated to disrupting EncroChat
French cyber-spies used malware from GitHub to hack EncroChat
CaptiveCrunch Supply Chains and Other Adventures in WIFI (Lumen)
GTIG: Distinct Clusters Target Individuals of Interest to Russia
ReliaQuest: DNS Poisoning Tactics Expand to Hospitality Wi-Fi
TLPBLACK
2 hr 12 min
August 17A tiny 12 KB Windows backdoor, one victim, and a dead domain
(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors.)
Three Buddy Problem - Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this.
Plus, a tiny 12 KB Windows backdoor found on one machine with a dead C2, the mercenary outfits quietly living inside telcos, and why Google continues to flounder in the race for AI dominance.
Cast: Costin Raiu, Ryan Naraine and Juan Andres Guerrero-Saade
Timestamps:
0:00 Introductory banter
0:58 State of Statecraft, and a late CFP window
3:24 The White House offensive hacking memo
6:37 "Hack back" is the wrong frame for what's being authorized
11:20 Ransomware cases sitting on the shelf
17:01 The million-dollar bond and who can realistically play
22:29 Where DPRK crypto theft falls under the new definitions
28:15 Would TLP Black take a contract?
36:55 Gen Digital's 12 KB backdoor hiding its C2 in desktop.ini whitespace
46:57 Passive DNS, registration patterns, and pivoting on a dead domain
57:32 Feeding a one-off find back into detection engineering
1:02:14 Metador, Mafalda, and the mercenaries who love telcos
1:17:07 Armored Likho and what "Western APT" really means
1:28:16 The IOC market, private reporting, and CTI’s matching problem
1:58:10 Google's culture problem, the weekly model churn, and Patch Tuesday math
Links:
Transcript
White House memo on private sector offensive operations
Trump admin wants to allow companies to hack cybercriminals
Custom Windows backdoor found on a single corporate machine
New Armored Likho tools target Telegram and eavesdropping
Multi-Agent AI Framework Used to Compromise Government Entities in Asia
Anthropic Risk Report - August 2026
The Metador Enigma: Unveiling an Unattributed Threat
Report | The Mystery of Metador
Armored Likho’s new weapon: BusySnake Stealer
How We Caught Lazarus's IT Workers Scheme Live on Camera
Behind the exit of Google's DeepMind CEO
US to tell partners they must pick sides in AI race with China
Microsoft Patch Tuesday 422 CVEs
CVE Attribution & MSRC Reporting Dashboard
State of Statecraft (Brussels)
2 hr 24 min
August 08Inside OpenAI's Black Hat Confession
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 108: OpenAI got on the Black Hat stage and walked through how its own agent swarm hacked Hugging Face. We discuss and struggle to decide whether to clap or panic.
Plus, why only the attacker can do forensics now, frontier models being built as cyber-weapons on purpose, APT29's "Dark Hotel" comeback in luxury hotels, China's swipe at Palo Alto, the Iran-water-system FUD, and an eye-opening Liechtenstein money-laundering hack.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter - Black Hat went full RSA
1:11 TLP Black sponsor read
3:58 A deflated, AI-pilled show floor
8:31 AI stunt hacking and AI slop
16:20 The OpenAI–Hugging Face talk
21:00 Not all the same incident: OpenAI vs. Meta, Anthropic, and Irregular
25:49 Swarms of agents, Artifactory message boards, and the defense gap
32:26 Offense vs. defense: what's really in the training data?
41:22 Guardrails, KYC, and "too dangerous to release"
48:07 JAGS's unpublished Opus 5 benchmark — grinding to 25% and stuck
59:30 AISI, recklessness, and the OpenAI Frontier Risk Council
1:06:27 Stronger models everywhere: Qwen, Sol, Astra, rushing off the cliff
1:18:32 APT29 / "Dark Hotel" reborn + travel OPSEC
1:39:56 China's Palo Alto review, spy-agency rankings, Iran/water FUD
1:57:28 Liechtenstein AML hack, JAGS's promotion, mental health
Links:
Transcript
Black Hat: The OpenAI–Hugging Face Incident (YouTube)
AI Security Institute: Unsanctioned agent behaviour during cyber testing
Meta says its AI hacked another company
Sam Altman: Astra is a powerful model
'Jaw-dropping levels of OpenAI recklessness'
CaptiveCrunch: Midnight Blizzard targets travelers worldwide
DarkHotel APT Attacks: How They Work
Spy Virus Linked to Israel Targeted Hotels Used for Iran Nuclear Talks
Duqu 2.0: Malware 'linked to Israel' found at Iran nuclear talks venue
GL.iNet - Connecting Beyond Limits
Microsoft: How a macOS ClickFix campaign learned to hide
Dutch intelligence service ranked third best in Europe
China launches cybersecurity review into Palo Alto products
Liechtenstein says hackers access information on 31,000 legal entities
FBI: Malicious Cyber Actors Targeting Water and Wastewater Sector
Iran War Cyber Threat Landscape - A Midyear Assessment
US Cyber Command Unit Grapples With Cluster of Deaths by Suicide
The Teenagers Who Wired Romania
TLPBLACK
LABScon 2026
2 hr 15 min
July 31Proofpoint's Greg Lesnewich on Laundry Bear, ‘Half-Click’ Exploits, and Magnets of Threats
(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)
Three Buddy Problem - Episode 107: Proofpoint's Greg Lesnewich joins the show to break down Laundry Bear, the "half-click" webmail exploits that let a Russian GRU cluster hack inboxes the moment an email was opened, and what it took to publish alongside the NSA, FBI and sixteen allied agencies.
Plus, Anthropic and OpenAI both admit their models escaped test sandboxes and popped real companies, why JAGS wants the CFAA burned down and vulnerable devices bricked, and a heartfelt detour into how threat hunters actually build intuition and skills.
Cast: Greg Lesnewich, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Sponsor - Thinkst Canary
1:34 Greg Lesnewich introduces the Proofpoint threat-hunting team
5:23 Inside the NSA ‘Laundry Bear’ advisory
7:15 What does "half-click" mean?
9:58 Laundry Bear's Zimbra exploit: DNS exfil and app-specific password persistence
12:59 Ferrari model numbers, F1 UNC names, and ESET's Operation RoundPress
17:05 Targeting Ukraine, US universities, and magnetic fusion research
19:34 How threat hunters actually build intuition
32:35 Systems thinking, Donella Meadows, and Costin's laptop under the dinner table
54:48 The dopamine hit of a real find and the deleted "never mind" messages
1:00:42 Magnets of threats: under 1% of customers ever see an APT
1:25:21 Getting detections into the product, and coordinating a release with NSA
1:53:22 Anthropic and OpenAI models breaking out of the eval sandbox
2:17:45 The case for killing the CFAA and bricking vulnerable devices
2:43:44 AI in the lab, malware paleontology, Google's new names, and AngrySpark
Links:
Transcript
Greg Lesnewich | LinkedIn
Proofpoint: TA488 Comes for Outlook with Another Half-Click Exploit
TA488 Targets Zimbra Mailservers with Half-Click Exploits
NSA: Russian APT Phishing Users of Zimbra
Operation RoundPress Half-Click Webmail Zero-Days from TA458
Operation RoundPress targeting high-value webmail servers
Anthropic: Investigating three real-world incidents in our cybersecurity evaluations
Hugging Face: A Technical Timeline of OpenAI incident
Microsoft Intros MAI-Cyber-1-Flash inside MDASH
Google Updates Threat Actor Naming System
Bill Marczak: An Angry Spark, or a Triangle in Disguise?
Gen: Chasing an Angry Spark
Amazon identifies North Korean hacker group behind open-source supply chain attacks
Dana (Donella) Meadows Lecture: Sustainable Systems
Outliers - Malcolm Gladwell
5-Year Data Hack Disclosed by SMS Giant Syniverse
Practical Malware Analysis book
Top 1 Million Websites
Thinkst Canary
3 hr 27 min
July 28Validin's Kenneth Kinion on What Separates Useful Threat Intel From Noise
Security Conversations: Kenneth Kinion, founder and CEO of Validin, joins Ryan Naraine on the show to unpack what "internet intelligence" really means for the analysts and responders chasing malicious infrastructure.
We trace his path from Georgia Tech through Microsoft and Amazon to the frustrations that led to the creation of Validin, the competition from big AI, the value of AI-powered tools to speed up infrastructure hunting, and why defenders keep falling further behind fast-moving attackers.
Timestamps:
0:00 – Intro: What does Validin do?
0:51 – Who uses Validin: CTI teams, SOCs, incident responders
2:19 – Atlanta and Georgia Tech's cybersecurity pipeline
5:31 – Lessons from Microsoft and Amazon: waterfall vs. agile
8:29 – Filling gaps in passive DNS data
9:57 – Misunderstood things about threat intelligence
14:17 – The value of "cyber paleontology"
16:00 – What makes one data set better than another?
19:39 – How Validin works: from one suspicious domain to a full pivot
21:27 – AI as existential threat or force multiplier for Validin
26:55 – Dual-use AI: are defenders losing ground to attackers?
31:11 – Closing: the next hard problem Validin wants to solve
Links:
Transcript
Kenneth Kinion | LinkedIn
Validin (Threat Hunting, DNS Enrichment)
Advanced Search & YARA Improvements | Validin
Contagious Interview: DPRK Threat Actors Reveal Plans
LABScon 2026
35 min

About Three Buddy Problem

From the publisher's feed

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics,…