Ahead of the Breach

Sprinklr’s Roger Allen on Why Vendor Telemetry Only Gets You 90% There

Modern attackers have abandoned obvious indicators and now mimic legitimate engineering activities so closely that traditional detection methods fail. Roger Allen, Sr. Director, Global Head of Detection & Response at Sprinklr, has watched this evolution firsthand. He gives Casey the rundown of how his team's response involves outcome-based detection strategies that focus on what attackers accomplish rather than the specific actions they take to get there.
But detection is only part of the equation. From transforming UBA alerts into contextualized "events of interest" that correlate across the MITRE framework to implementing breach response scenarios that consider cloud-native production implications, Roger shares tactical approaches that bridge the gap between red team thinking and blue team operations.
Topics discussed:
Why focusing on what attackers accomplish rather than individual actions creates more effective monitoring as threat actors become increasingly sophisticated in mimicking legitimate engineering activities.
Filling the critical 10-20% gap in security coverage through business context enrichment and custom detection logic that vendors can't provide.
Converting traditional user behavior analytics from noise-generating alerts into correlated "events of interest" that map to MITRE kill chain stages for dynamic alert prioritization.
Systematic approaches to removing unnecessary tools like Netcat and Telnet while creating contextual detections for essential utilities.
Building tier-based response frameworks that account for production disruption risks when containing threats in environments where simply isolating hosts could shut down customer-facing services.
Implementing scenario-based training that goes beyond tabletop exercises to create muscle memory for security operations teams responding to active compromises.
Why having practitioners in both development and leadership chains at security vendors correlates with product effectiveness and company growth trajectories.
How to distinguish between genuine artificial intelligence capabilities and rebranded automation when evaluating security tools, plus practical applications for analyst efficiency without replacement
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

Why is Continuous Pentesting a Must for Dynamic Environments?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses why continuous pentesting is a must for dynamic environments. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
 
Get in touch with your host, Casey Cammilleri: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify

Armis’ Andrew Grealy on Left-of-Boom Threat Actor Intelligence

What if you could predict which vulnerabilities threat actors will weaponize months before CISA adds them to their Known Exploited Vulnerabilities list? Andrew Grealy, Head of Armis Labs, has built exactly that capability, providing organizations with threat intelligence that arrives 3-12 months ahead of traditional indicators. His "left of boom" approach changes how security teams prioritize patches and allocate resources.
But early warning is just the beginning, Andrew tells Casey. From mom and pop honeypots that catch nation-state actors to AI-powered supply chain attacks that slip malicious packages into enterprise applications, Andrew details how attackers are weaponizing the same AI tools that security teams use for defense. He also offers insights on the "triple threat" evolution of ransomware and practical frameworks for securing AI-generated code.
Topics discussed:
Building CVE early warning systems that identify threat actor targets 56% faster than CISA's Known Exploited Vulnerabilities list.
Implementing "left of boom" intelligence collection through honeypots in mom and pop infrastructure.
Moving beyond CVSS scores as risk indicators to prioritize patches based on actual threat actor behavior and CWE patterns.
Deploying strategic security controls like WAFs to eliminate 28% of ESX server console attacks, reducing patch urgency and operational disruption.
Understanding the "triple threat" ransomware evolution that combines traditional encryption with data exfiltration and AI-powered internal investigation for multiple revenue streams.
Combating AI-accelerated supply chain attacks where 54% of coding assistants automatically introduce vulnerabilities into generated code.
Preventing typosquatting attacks where threat actors create packages with similar name that AI tools recommend to infiltrate internal applications.
Establishing approved package repositories with exact version matching and implementing coding checks throughout the development pipeline as countermeasures.
Evaluating LLMs for security applications by testing with known answers first, then gradually increasing complexity to validate capabilities before deployment.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

How Do You Build an Offensive Security Program from Scratch?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses how to build an offensive security program from scratch. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Casey Cammilleri: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube

Covert Entry: Tools, Tricks, and True Stories from the Field

What happens when a covert entry specialist turns a Super Bowl hotel room into a rooftop breach point? Brent White, Sr. Principal Security Consultant & Covert Entry Specialist at Dark Wolf Solutions, offers Casey his approach to physical security testing that goes far beyond lock picking, rooted in understanding human psychology and building systematic infiltration strategies.
Brent shares how his team compressed an entire backpack of penetration tools into a concealed-carry belt system that even works with swimming trunks. But the real breakthrough isn't in the gear — it's in his multi-day reconnaissance methodology that builds familiarity before attempting entry.
Brent's "Post It flag" system transforms traditional physical assessments by having clients mark objects they're comfortable losing, leading to scenarios where his team wheels office chairs and $500 juice machines through bank lobbies while security guards helpfully watch their haul. This approach moves beyond simple "can you get in" to demonstrating real-world impact and exfiltration capabilities. 
Topics discussed:
Building familiarity through multi-day reconnaissance that establishes psychological comfort before entry attempts rather than relying on cold tailgating approaches.
Transitioning from backpack-based toolkits to concealed carry belt systems that house bypass tools for major door configurations, American padlock bypasses, and dimple lock rakes.
Mapping regional security culture patterns where Northeast locations show higher vigilance compared to South and Midwest willingness to help strangers.
Using Proxmark readers and modified Flipper Zero devices hidden in Starbucks cups to capture badge credentials during natural conversations.
Implementing hybrid covert-to-overt assessment methodology that escalates until detection then transitions to educational walkthroughs with clients.
Developing systematic drone security evaluation frameworks that assess radio frequencies, web interfaces, payload access, and MAVLink flight data to identify pilot locations.
Creating quick-change disguise systems using wig colors matched to facial hair combined with tactical clothing featuring concealed tool pockets.
Establishing post-engagement flag collection strategies where clients mark acceptable-loss items, enabling teams to wheel office chairs and expensive equipment through lobbies as proof of exfiltration capability.
Understanding how sUAS government standards are forcing commercial drone manufacturers to implement stronger security measures.
Navigating destructive versus non-destructive entry protocols when clients approve hinge removal and window manipulation while avoiding classified room decertification that triggers 24/7 guard requirements.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

What Should You Ask Before Choosing an Offensive Security Platform?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey covers what you should ask before choosing an offensive security program. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Casey Cammilleri: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube 

Phillip Wylie on How IoT Devices Become Corporate Network Entry Points

After 21 years in cybersecurity, Phillip Wylie, Penetration Tester & Podcast Host at The Phillip Wylie Show, has learned how a critical flaw in how most organizations approach security testing when a "low-risk" vulnerability suddenly became exploitable between scheduled assessments. He shares this knowledge with Casey, and more, including why annual penetration testing creates dangerous gaps that threat actors are increasingly exploiting through non-traditional attack vectors like IoT devices. 
Phillip's dual perspective as both a penetration tester and IoT security professional provides unique insights into how threat actors are adapting their tactics. As traditional endpoints become harder to exploit, attackers are pivoting to security cameras, printers, and other connected devices that often maintain default credentials and poor security hygiene. His systematic approach to community building and client relationships demonstrates how technical expertise must be balanced with communication skills and ego management to create lasting security improvements.
 
Topics discussed:
The critical security gaps created by annual penetration testing schedules, demonstrated through real-world examples of vulnerabilities that became exploitable between scheduled assessments.
How threat actors are pivoting to IoT devices as primary attack vectors when traditional IT endpoints become more difficult to exploit.
Essential IoT security controls including credential management, firmware updates, network segmentation, and protocol security to prevent corporate network compromise through connected devices.
The evolution of Windows security from insecure-by-default configurations in NT4.0 to locked-down modern systems, and how this shift has changed offensive security methodologies.
Advanced penetration testing reporting strategies that build client trust through adequate documentation, proof-of-concept demonstrations, and balanced presentations of security posture.
Why focusing on data discovery through network shares and file systems often provides more business-relevant findings than achieving elevated privileges like domain admin.
Practical approaches to building cybersecurity communities through combined virtual and in-person engagement, including structured meetups and CTF-based learning sessions.
The importance of highlighting positive security controls during assessments to provide balanced risk perspectives and maintain productive client relationships.
Strategies for staying current with emerging technologies including AI adoption to avoid becoming obsolete in rapidly evolving cybersecurity landscapes.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

What Tools Do You Need for an Offensive Security Stack?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses the tools needed for an offensive security stack. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer! 
Listen to more episodes: 
Apple 
Spotify
YouTube

AccessIT Group’s Brett Price on Governance-Driven Cybersecurity

Many cybersecurity programs fail because they prioritize tools over understanding what they're protecting. Brett Price, Lead Cybersecurity Consultant & vCISO at AccessIT Group, brings decades of experience to explain why data discovery and governance create more security value than any technology purchase. His approach starts with mapping critical data to business functions before implementing solutions — a methodology that has helped organizations discover everything from unsecured credit card data in S3 buckets to massive compliance gaps that traditional scanners missed entirely.
Drawing from his experience as a reformed QSA and virtual CISO across multiple industries, Brett tells Casey how successful security leaders build programs around culture and relationships rather than technical controls. His framework transforms overwhelming vulnerability backlogs into focused remediation strategies by prioritizing currently exploited vulnerabilities over theoretical risks, enabling resource-constrained organizations to eliminate real attack vectors first.
Topics discussed:
The evolution of cybersecurity leadership from Steve Katz's appointment as Citigroup's first CSO in 1995 to today's business-aligned security executives.
Why organizations fail by throwing tools at security problems without first understanding their critical data locations and business functions.
Building incident response plans that include communication trees, out-of-band protocols, and muscle memory development through tabletop exercises.
DSPM strategies for discovering, classifying, and protecting crown jewel data across cloud and on-premises environments.
Vulnerability prioritization methodologies that focus on currently exploited vulnerabilities rather than overwhelming teams with thousands of theoretical risks.
Creating security cultures through trust-building and gradual implementation rather than forcing dramatic changes that trigger organizational resistance.
The limitations of compliance frameworks like PCI DSS and HIPAA that create false security by protecting only specific data types while missing broader organizational risks.
Essential security metrics for boardroom reporting, including mean time to detect, mean time to resolve, and vulnerability burn-down rates.
How healthcare and manufacturing industries struggle with cybersecurity implementation due to budget constraints and rapidly expanding attack surfaces.
Building holistic security programs using frameworks like NIST CSF and CIS Controls that address governance, technical controls, and business alignment simultaneously.
Get in touch with Brett:
brettp@accessitgroup.com
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website
 

What Steps Should You Take to Build a Modern Pentesting Program?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses 5 steps to building a modern pentesting program. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Casey Cammilleri: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube