Ahead of the Breach

Parthasarathi Chakraborty on Building Architectural Assurance Functions

Most security architecture programs struggle to demonstrate their value because they focus on creating diagrams rather than driving implementation. Parthasarathi Chakraborty, Former Deputy CISO at Natixis CIB, shares his approach to transforming security architecture from theoretical frameworks to measurable business impact. 
With experience across Fortune 15 banks to mid-market companies, Partha gives Casey a peek into how his "architectural assurance function" bridges the critical gap between security requirements and engineering implementation, reducing incidents, accelerating deployment times, and proving security's ROI to business leaders.
Topics discussed:
Why many organizations have security architecture in name only, with PowerPoint diagrams and Word documents that provide little practical guidance to engineering teams.
How to turn high-level security principles into detailed engineering specifications that developers can actually implement.
Tracking how architecture maturity reduces time-to-market for applications, minimizes configuration drift, and decreases security incidents.
Building a specialized team with both technical depth and breadth to validate whether engineering implementations adhere to security requirements.
Incorporating compliance standards, threat data, and security operations insights to create risk-based architectural requirements that address real-world threats.
Codifying security blueprint requirements into cloud security posture management systems to detect and remediate drift automatically.
Ensuring security requirements remain simple enough for teams to adopt while still addressing critical risks.
Navigating initial resistance through clear communication, demonstrating value, and creating structured roles and responsibilities.
Creating feedback loops between security architecture, engineering teams, and assurance functions to continuously improve both requirements and implementation.
Evolving from reactive patching toward proactive security design that prevents vulnerabilities from reaching production.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

What Are the Common Myths About Continuous Pentesting?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses the most common myths around continuous pentesting. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
 
Listen to more episodes: 
Apple 
Spotify
YouTube 

Rocket Lawyer’s Tim Silverline on Why Clean Pentest Reports Can Be Red Flags

When Tim Silverline received a pentest report that was essentially a clean bill of health with zero evidence of actual testing, he knew his security program had a problem. As Vice President of Security at Rocket Lawyer, this experience sparked a complete transformation from annual security theater to continuous, evidence-based testing that provides actionable intelligence — with Sprocket! In his chat with Casey, recorded at RSA 2025, Tim shares hard-earned insights about building effective security programs in established organizations while navigating the complexities of rapid AI development and multi-compliance requirements. 
 
Tim touches on how static analysis tools create more noise than value, explaining how packages flagged as critical vulnerabilities often aren't even loaded into memory or used in exploitable ways. His solution involves runtime analysis with eBPF sensors that monitor actual execution rather than theoretical package inventories. He also discusses the unique challenges of implementing SOC 2 controls in an 18-year-old company versus a startup, emphasizing the critical importance of executive alignment before attempting cultural transformation. 
 
Topics discussed:
The limitations of traditional annual penetration testing and why continuous testing provides better coverage for organizations with rapid deployment cycles.
How runtime analysis with eBPF sensors eliminates false positives by monitoring actual code execution rather than static package inventories that generate noise.
The strategic approach to managing SOC 2 compliance implementation in established organizations, focusing on executive alignment before attempting cultural transformation.
Advanced attack surface management techniques that extend beyond hosted applications to include third-party platforms and exposed API keys.
The challenge of staying ahead of AI development from a security perspective, particularly as interconnected AI models create complex data flow patterns difficult to audit.
Why clean penetration test reports with no evidence of actual testing indicate vendor problems rather than strong security posture.
The evolution from static vulnerability scanning to context-aware prioritization based on actual exploitability and system exposure.
Strategies for integrating security findings into development workflows through two-way JIRA integration and regular cross-team security reviews.
The growing complexity of non-human identity management as DevOps practices increase the proliferation of API keys and service accounts across cloud environments.
How the NextJS vulnerability response demonstrates the value of runtime monitoring for rapidly identifying which instances actually use vulnerable middleware configurations.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

How Do You Prepare for the Future of Pentesting?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses how to prepare for the future of pentesting. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Casey Cammilleri: 
LinkedIn 
X
Website 
Listen to more episodes: 
Apple 
Spotify
YouTube 

Digital Turbine’s Vivek Menon on Quarterly Pentesting Frameworks

The shift from annual compliance-driven security testing to continuous validation represents one of the most critical evolutions in modern cybersecurity practice. Vivek Menon, CISO & Head of Data at Digital Turbine, discovered this firsthand when his team's focus on modern cloud applications nearly missed a critical legacy system that could have triggered cascading failures across their entire infrastructure. On this episode of Ahead of the Breach, Vivek tells Casey how quarterly penetration testing aligned with engineering roadmaps delivers superior security outcomes while building rather than eroding trust with development teams.
Vivek has developed frameworks that balance thorough security validation with business agility. His approach to shadow AI governance, stakeholder communication strategies, and leveraging AI simulation for previously impossible attack scenarios offers practical guidance for security leaders navigating today's rapid development cycles while maintaining robust defensive postures.
Topics discussed:
Quarterly penetration testing frameworks that align with product roadmaps and engineering milestones rather than annual compliance cycles to catch vulnerabilities as they're introduced.
The critical importance of comprehensive asset discovery, particularly legacy systems that may be interconnected with modern cloud infrastructure in ways that create cascading vulnerability risks.
Building trust equations with engineering teams through consistent, non-disruptive testing practices that demonstrate security as an enabler rather than a blocker to development velocity.
Shadow AI governance challenges as employees enthusiastically adopt tools like Zapier agents without proper controls, creating new data exposure vectors that require immediate attention.
Risk register development using business risk alignment rather than treating all systems equally, focusing testing resources on revenue-generating and business-critical components.
AI-driven attack simulation capabilities that make previously cost-prohibitive or technically impossible testing scenarios accessible for better adversary understanding.
Stakeholder communication strategies that tailor security messaging across three distinct audiences: technical implementers, middle management, and executive leadership with board reporting requirements.
Leveraging AI agents for frictionless continuous testing that reduces visible pain points for engineering organizations while maintaining security thoroughness.
Integration strategies for penetration testing platforms with existing productivity tools like Jira, Confluence, and Slack to streamline vulnerability management workflows.
Non-traditional hiring approaches for security teams, particularly recruiting from MLOps and data science backgrounds to address machine learning security gaps that traditional cybersecurity professionals often miss.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

What’s Broken About Legacy Pentesting?

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today's episode, Casey addresses what is broken about legacy pentesting. 
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you're looking for an answer!

WhoisXML’s Alex Ronquillo on Domain Age as a Security Signal

From a casual gaming project at NASA's JPL to powering 700+ cybersecurity vendors, WhoisXML API has become the foundation of modern threat intelligence. In this episode of Ahead of the Breach, recorded at RSA Conference 2025, Casey sits down with Vice President Alex Ronquillo to explore how domain registration data has become critical infrastructure for security tools and how penetration testers can leverage this intelligence in their work.
Alex takes us behind the scenes of the massive data collection operation that tracks billions of domain events monthly, explaining how even the most heavily reviewed security tools rely on WhoisXML API to identify potentially malicious domains based on registration patterns. He also reveals surprising research showing that 90% of subdomains in security databases don't actually exist — they're artifacts of security scanning against wildcard DNS configurations that respond to any query. 
Topics discussed:
Research showing that domains created within the last 30 days are significantly more likely to be malicious, forcing penetration testers to deliberately "age" domains to avoid detection by security tools that automatically flag new registrations.
How security professionals can use reverse WHOIS lookups based on email addresses, organization names, and nameservers to discover hidden attack surfaces and verify domain ownership during testing.
Rather than performing millions of individual WHOIS queries, major security platforms license structured data dumps to perform local lookups for domain intelligence at massive scale.
Since GDPR implementation in 2018, approximately 80-90% of domains have non-public registrant information, forcing security teams to rely on alternative signals like SSL certificates and hosting infrastructure.
WhoisXML API's partnership network with cybersecurity vendors creates a collaborative intelligence platform that tracks malicious domains and infrastructure across the internet ecosystem.
How security tools inadvertently pollute passive DNS databases by triggering wildcard DNS records, creating the illusion that millions of non-existent subdomains are real assets.
How the Registration Data Access Protocol is modernizing domain registration data access while preserving the critical information that security tools need for threat intelligence.
How companies like Doppel use WhoisXML API's data to identify phishing domains targeting their customers within minutes of registration, enabling rapid takedown before damage occurs.
How investment analysts and technology companies use WHOIS and hosting data to track market share and adoption patterns across cloud providers and services.
Listen to more episodes: 
Apple 
Spotify 

Why Continuous Pentesting Outperforms Bug Bounties

Welcome to a special edition of Ahead of the Breach, where our host Casey Cammilleri answers the top questions our listeners have asked us. In today’s episode, Casey addresses “Why does continuous penetration testing outperform bug bounties?”
Would you like to have Casey answer one of your questions in a future episode? Email podcast@sprocketsecurity.com with your question and a short summary of why you’re looking for an answer!

Sentry’s Cody Florek on AppSec Programs That Create Partnerships Not Problems

How do you effectively measure security operations in a world where vulnerabilities never stop coming? Cody Florek, Director of Information Security Operations at Sentry, brings a refreshing approach that combines agile methodology with practical security execution. In this episode of Ahead of the Breach, he tells Casey how his journey from computer repair technician to security leader shaped his perspective on measuring capacity, building AppSec programs that don't antagonize developers, and communicating security risk effectively to leadership.
Cody explains why many AppSec programs fail by overwhelming development teams with vulnerability findings without context, and offers a better approach using DREAD modeling to prioritize what truly matters. He also reveals his strategies for conducting effective tabletop exercises that uncover critical security blind spots most organizations miss. Whether you're running security operations or building an application security program, Cody's practical insights on balancing project work with operational demands will transform how you measure security effectiveness.  
Topics discussed:
Measuring security operations capacity with agile methodology, using story points to quantify both project work and operational demands, with each day representing two points to realistically plan team bandwidth.
The evolution of application security implementation from vulnerability scanning to strategic DREAD modeling that helps prioritize findings based on context, exploitability, and real-world impact rather than overwhelming developers.
Strategic approaches to communicating security risk to leadership by translating technical issues into business impact while leveraging technical background to accurately assess vulnerability context.
Implementing structured vulnerability prioritization frameworks that combine CVSS scores with business context, exploitability analysis, and threat intelligence to focus remediation on what truly matters.
Building effective partnerships with development teams by avoiding the "throw it over the fence" mentality and instead providing context-driven vulnerability assessments with prioritized remediation plans.
Practical shift-left security implementation strategies that recognize organizational maturity levels and gradually empower developers after cleaning up existing vulnerabilities.
Designing and conducting effective tabletop exercises that uncover critical security blind spots, including encouraging reluctant participants to actively engage in scenario planning.
Holistic security metrics frameworks that balance operational effectiveness, program impact measurement, and threat intelligence to provide comprehensive security oversight.
Creating comprehensive security coverage using a "Plinko game" metaphor to ensure multiple defensive layers prevent attacks from finding direct paths through defenses.
The importance of curiosity-driven incident analysis that goes beyond immediate fixes to understand root causes and systemic improvements needed for long-term security posture enhancement.
Listen to more episodes: 
Apple 
Spotify 
YouTube
Website

Block Harbor’s Ayyappan Rajesh on Advanced RF Exploitation Techniques for Automotive Systems

From intercepting key fob signals with HackRF devices to setting up rogue cellular networks with USRP transceivers, Ayyappan Rajesh, Offensive Security Engineer at Block Harbor Cybersecurity, takes Casey deep into the technical underbelly of wireless security testing in this illuminating episode of Ahead of the Breach. 
As an offensive security engineer with Block Harbor's VCL team, Ayyappan specializes in testing "everything that has a radio on it" — from automotive systems operating at 315 MHz to Bluetooth-enabled tire pressure monitoring systems and cellular networks requiring sophisticated Faraday cage environments. He shares how teams can intercept SPI and I2C communications to extract firmware directly from chips, implement GPS spoofing using NASA satellite constellation data, and why many vulnerabilities now require physical access rather than just wireless interception.
Topics discussed:
The evolution of RF exploitation from replay to rollback methodologies that deliberately desynchronize key fob counter synchronization, allowing security testers to exploit implementation weaknesses rather than breaking encryption algorithms directly.
Hardware-based firmware extraction techniques using direct chip interfaces that bypass wireless protections entirely, revealing how security researchers connect via SPI and I2C protocols to obtain proprietary algorithms from automotive security chips.
Lateral movement strategies from infotainment systems to critical vehicle controls through careful analysis of gateway implementations that act as rudimentary firewalls between entertainment and control networks.
Creating isolated cellular test environments using programmable SIM infrastructure and open-source base stations that enable comprehensive security testing without FCC violations through controlled Faraday environments.
Manipulating GPS-dependent systems through satellite constellation spoofing that leverages NASA ephemeris data processed through GPS-SDR-SIM to generate deceptive signals targeting both location and time-dependent security controls.
Building cost-effective wireless security testing labs that leverage increasingly affordable software-defined radio platforms like HackRF and USRPs, enabling more researchers to conduct sophisticated wireless security assessments.
Leveraging automotive security education resources like the Cyber Auto Challenge that provide aspiring security researchers with manufacturer-supported environments for learning without the significant financial barriers traditionally associated with automotive security testing.