POPULARITY
134 episodes with Proofpoint
35 episodes with Proofpoint
25 episodes with Proofpoint
23 episodes with Proofpoint
34 episodes with Proofpoint
20 episodes with Proofpoint
22 episodes with Proofpoint
9 episodes with Proofpoint
13 episodes with Proofpoint
9 episodes with Proofpoint
9 episodes with Proofpoint
12 episodes with Proofpoint
7 episodes with Proofpoint
7 episodes with Proofpoint
3 episodes with Proofpoint
17 episodes with Proofpoint
9 episodes with Proofpoint
6 episodes with Proofpoint
3 episodes with Proofpoint
2 episodes with Proofpoint
4 episodes with Proofpoint
7 episodes with Proofpoint
3 episodes with Proofpoint
6 episodes with Proofpoint
3 episodes with Proofpoint
2 episodes with Proofpoint
4 episodes with Proofpoint
A pronounced infrastructure dependence on third-party AI models has emerged across the MSP ecosystem, largely due to the rapid adoption and integration of AI-powered features within vendor products. This structural shift is increasingly opaque, as providers are sold features rather than transparent access to underlying models, leaving MSPs exposed to changes in technologies and policies enacted upstream by vendors or regulators. The episode highlights how this dependency extends to delivery teams and end clients, with operational continuity tightly linked to decisions and actions outside the MSP's direct control. The most consequential development referenced is Anthropic's release and rapid withdrawal of its Fable 5 AI model following a directive from the U.S. Commerce Department, which ordered a cutoff of model access to foreign nationals within 72 hours of public launch. According to published benchmarks, Fable 5 surpassed GPT 5.5 in performance, but the government-mandated suspension exposed how quickly model access can be rescinded. The policy move immediately impacted any MSP or client with offshore or nearshore staff relying on AI features invisibly powered by that model. Further supporting the central theme, companies such as PAX8, Enforcer, and CloudRadio are embedding AI capabilities into platforms used by MSPs to manage Microsoft 365 environments, automate ticketing, and support scalable client operations. In parallel, vendors like Proofpoint are integrating compliance solutions directly with AI model APIs, further entwining risk management tools with the same core AI infrastructures. A Netrio survey cited in the episode found that while 82% of mid-market IT leaders have AI in production, only 26% report organization-wide governance, highlighting an accountability and visibility gap. Operationally, MSPs face heightened contract and vendor risk. Most lack an accurate inventory of which AI models underpin their services and how rapidly these dependencies can be affected by regulatory directives or vendor shifts. The discussion underscores the need for explicit procurement protocols, delivery mapping, and outage runbooks that account for opaque model dependencies. As clients seek greater transparency and contractual assurances regarding model use and continuity, MSPs who anticipate and document these dependencies may be positioned to reduce exposure and establish clearer accountability. 00:00 Switched Off 03:19 Painted Over 05:20 Govern or Absorb 08:41 Why Do We Care? Supported by: Pax8 Sign up for the SMB Online Conference: www.smbonlineconference.com
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts dive into the evolving threat of software supply chain attacks and the growing risks facing the open-source ecosystem. As developers increasingly rely on third-party packages and AI-powered coding tools, attackers are finding new ways to abuse trusted software to reach a wider range of targets. The discussion explores why these attacks are becoming more common, what recent incidents reveal about the state of software security, and what organizations can do to better protect themselves. Sources: Shai-Hulud worm returns stronger and more automated than ever before ‘Mini Shai-Hulud' malware compromises hundreds of open-source packages in sprawling supply-chain attack What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This week, our hosts dive into the evolving threat of software supply chain attacks and the growing risks facing the open-source ecosystem. As developers increasingly rely on third-party packages and AI-powered coding tools, attackers are finding new ways to abuse trusted software to reach a wider range of targets. The discussion explores why these attacks are becoming more common, what recent incidents reveal about the state of software security, and what organizations can do to better protect themselves. Sources: Shai-Hulud worm returns stronger and more automated than ever before ‘Mini Shai-Hulud' malware compromises hundreds of open-source packages in sprawling supply-chain attack What We Learned: Axios NPM Supply Chain Compromise Emergency Briefing Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
The core structural shift described in this episode is the integration of AI as an active workflow actor within managed service environments, not simply as an isolated tool. This mechanism alters the governance and accountability requirements for MSPs, as AI now interacts directly with core business platforms and operational data. Companies like Microsoft are embedding AI features—such as Copilot and a legal AI agent—across productivity and security environments, while reports from Axios Future of Cybersecurity and The Register highlight that AI activity is increasingly touching managed identity, email, data, and security infrastructures. The episode's primary evidence centers on the adoption of AI-driven productivity and legal tools within Microsoft 365, with broad rollout timelines targeting early June. Microsoft's deployment of legal AI agents in Word—as outlined by The Register and Thoreau—demonstrates that AI is being implemented to review contracts, draft language, and check citations, embedding itself into sensitive business workflows. Additionally, Proofpoint's formation of an MSP business unit around 365 security further reflects this shift, consolidating risk and workflow management where client data, identity, and security converge. Supporting developments reinforce this trend of workflow centralization and accountability ambiguity. Vendors are introducing dashboards—such as Anthropic's Claude code agent view—that offer improved visibility into AI-driven processes; however, as noted, visibility alone does not constitute governance. The emergence of platforms like Halo PSA and features from JumpCloud exemplify the market response, where vendors and MSPs are being forced to tighten control and monitoring around AI-driven work, including automation, ticketing, and remediation workflows. The episode notes that unmanaged automation creates governance risks that operators must close. The practical implication for MSPs is a set of new operational burdens: rising margin pressure from unpriced AI governance work, contract risk if responsibilities for AI-generated actions remain undefined, and new demands for auditability, evidence retention, and workflow documentation. Providers must build inventories not only of AI tools but also the workflows they touch, define explicit service scope, and establish pricing models for governance functions. The operational tradeoff is an increasing need for infrastructure and process maturity, as the expectation of transparent, accountable AI-driven work is now a baseline for client trust and risk management. 00:00 Managed AI Risk 03:50 Scope or Absorb 06:03 Four MSP Pressures 08:35 Why Do We Care? Supported by: MoovilaHaloPSA JumpCloud
The central structural shift identified is the acceleration and scaling of cyber risks due to artificial intelligence, which turns formerly expert-driven security processes into repeatable, rapid workflows. Major threat intelligence units, including Google's Threat Intelligence group, are now documenting the use of AI in both identifying and weaponizing software vulnerabilities. The landscape is further shaped by the proliferation of AI-generated and AI-assisted online content, contributing to an environment where traditional verification and control mechanisms are less reliable. The episode presents concrete evidence: Google reported criminal hackers leveraging AI models—explicitly noting the use of non-Google technology—to discover a previously unknown zero day, while The Verge and Wired highlighted AI-assisted attempts to bypass multi-factor authentication and the impact of synthetic content even within cybercrime forums. Research covered by 404 Media documented that by mid-2025, a third of newly published websites were AI-influenced. These observed changes drive threat intelligence teams to treat AI as a working hypothesis in live investigations. Additional supporting developments reinforce the broadening security and operational impact. Tools such as Proofpoint's Prism Investigator and OpenAI's Daybreak show the push toward automated threat detection, investigation, and reasoning pipelines, altering expectations from detection to defensible reconstruction and evidence generation. Analysis of supply chain compromises—such as tampered software installers and malware leveraging already-exposed cloud systems—demonstrates how automation reduces defender response windows while increasing operational pressure on providers. Reports from Small Biz Trends and channel Life show significant implementation gaps, with only a minority of small businesses deploying password managers, and a wide disparity between optimism and readiness for AI-powered security. For MSPs and IT leaders, these trends tighten operational accountability. The tradeoff shifts from focusing on technology stacks to delivering concrete evidence of patch application, identity verification, data retention, and audit support. Providers face increasing pressure to standardize verification workflows, reduce patch validation cycles, and make evidence retention a default process. The operational complexity intensifies—either the MSP develops controls to govern automation and evidentiary rigor, or becomes the default risk absorber for ambiguous, fast-moving attack paths shaped by both client and attacker use of automation. 00:00 Zero-Day 04:06 Speed Gap 06:25 Prove It 10:27 Why Do We Care? Supported by: Moovila Zero Networks
日本プルーフポイント株式会社は5月7日、完全自律型エージェンティックAIソリューション「Proofpoint Prism Investigator（特許出願中）」を発表した。
プルーフポイント開催のカンファレンスで毎回驚くことは、ユーザー事例の紹介である。こうした情報の共有は、セキュリティにおける情報共有の文化や文脈を知らない経営層などは「トクが無い」どころか明確に「損」と考えることも少なくないはずだ。それでも、内部不正対策の導入事例を社名を出して公の場で語るのは、同じ課題に向き合う他の企業への利他の精神にほかならない。
Mark Kelly, Staff Threat Researcher at Proofpoint, is discussing their work on "I'd come running back to EU again: TA416 resumes European government espionage campaigns." China-linked threat group TA416 has resumed large-scale phishing and malware campaigns targeting European governments, diplomatic missions tied to the EU and NATO, and more recently Middle Eastern entities following the outbreak of conflict in Iran. The group has continually evolved its tactics between mid-2025 and early 2026, using techniques like fake Cloudflare verification pages, Microsoft OAuth redirect abuse, and malicious C# project files to deliver customized PlugX malware through spearphishing campaigns. Researchers say the renewed activity reflects shifting geopolitical priorities tied to EU-China tensions, the Russia-Ukraine war, and instability in the Middle East, while highlighting TA416's ongoing focus on intelligence gathering against diplomatic networks. The research and executive brief can be found here: I'd come running back to EU again: TA416 resumes European government espionage campaigns Learn more about your ad choices. Visit megaphone.fm/adchoices
Mark Kelly, Staff Threat Researcher at Proofpoint, is discussing their work on "I'd come running back to EU again: TA416 resumes European government espionage campaigns." China-linked threat group TA416 has resumed large-scale phishing and malware campaigns targeting European governments, diplomatic missions tied to the EU and NATO, and more recently Middle Eastern entities following the outbreak of conflict in Iran. The group has continually evolved its tactics between mid-2025 and early 2026, using techniques like fake Cloudflare verification pages, Microsoft OAuth redirect abuse, and malicious C# project files to deliver customized PlugX malware through spearphishing campaigns. Researchers say the renewed activity reflects shifting geopolitical priorities tied to EU-China tensions, the Russia-Ukraine war, and instability in the Middle East, while highlighting TA416's ongoing focus on intelligence gathering against diplomatic networks. The research and executive brief can be found here: I'd come running back to EU again: TA416 resumes European government espionage campaigns Learn more about your ad choices. Visit megaphone.fm/adchoices
Today we are joined by Selena Larson, Threat Researcher from Proofpoint research team and co-host of Only Malware in the Building, talking about their work on "(Don't) TrustConnect: It's a RAT in an RMM hat." Proofpoint uncovered TrustConnect, a malware-as-a-service platform posing as a legitimate remote monitoring and management (RMM) tool, but actually functioning as a remote access trojan (RAT) sold to cybercriminals for $300/month. The operation used a fake business website, legitimate-looking certificates, and branded installers (like fake Microsoft Teams or Zoom apps) to trick victims, while providing attackers with full remote control, file transfer, and surveillance capabilities. Although parts of its infrastructure were disrupted, the threat actor quickly rebounded with new variants, highlighting both the resilience of the operation and its deep ties to the broader cybercriminal ecosystem abusing RMM tools. The research and executive brief can be found here: (Don't) TrustConnect: It's a RAT in an RMM hat Learn more about your ad choices. Visit megaphone.fm/adchoices
Today we are joined by Selena Larson, Threat Researcher from Proofpoint research team and co-host of Only Malware in the Building, talking about their work on "(Don't) TrustConnect: It's a RAT in an RMM hat." Proofpoint uncovered TrustConnect, a malware-as-a-service platform posing as a legitimate remote monitoring and management (RMM) tool, but actually functioning as a remote access trojan (RAT) sold to cybercriminals for $300/month. The operation used a fake business website, legitimate-looking certificates, and branded installers (like fake Microsoft Teams or Zoom apps) to trick victims, while providing attackers with full remote control, file transfer, and surveillance capabilities. Although parts of its infrastructure were disrupted, the threat actor quickly rebounded with new variants, highlighting both the resilience of the operation and its deep ties to the broader cybercriminal ecosystem abusing RMM tools. The research and executive brief can be found here: (Don't) TrustConnect: It's a RAT in an RMM hat Learn more about your ad choices. Visit megaphone.fm/adchoices
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Your favorite follow up story is back, this time Sue from Australia discusses why Joe's hen is losing feathers. Dave's story is on a sophisticated LinkedIn phishing scam that tricks professionals with fake notifications and counterfeit login pages to steal credentials. Joe discusses a bizarre Everest scam where climbers and Sherpas were targeted with fake rescue schemes, highlighting the surprisingly high number of visitors versus summiters. Maria has the story of IRS and tax-related scams warning taxpayers about ghost preparers, urgent payment demands, and fraudulent contact attempts, with Proofpoint noting the use of remote monitoring tools in 40% of 2026 cases. Our catch of the day comes from Reddit, where a likely “stranded in the woods” scam involving a man named Michael begins to unfold but quickly unravels after he overwhelms the interaction with constant ChatGPT-style questioning. Resources and links to stories: LinkedIn Phishing Scam Uses Fake Notifications to Hijack Accounts Everest guides accused of poisoning foreign climbers to force fake rescues in $20m scam Surge in sophisticated tax scams reported by BBB ahead of deadline Security brief: tax scams aim to steal funds from taxpayers The Guy in the Woods - Seduction on Scrabble - Part 1 Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we discuss findings from the Sophos Active Adversary Report 2026 by Sophos, highlighting how identity-related weaknesses like compromised credentials and gaps in MFA continue to drive a majority of security incidents. The conversation explores how attackers are moving faster, often operating after hours, and how a growing number of threat groups is adding to the complexity.
Mac Malware 'Infinity Stealer,' DarkSword iOS Exploits, China Telecom Espionage & TeamTNT Supply Chain Hits Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at Meter.com/cst David Shipley reports from Seoul on major threats: Malwarebytes details Infinity Stealer, a new macOS info-stealer delivered via "ClickFix" social engineering and built as a compiled Python payload (Nuitka) that steals browser credentials, Keychain data, crypto wallets, and developer secrets while notifying attackers via Telegram. Proofpoint links Russia-aligned TA446 (Cold River/Star Blizzard) to spear-phishing using the DarkSword iOS exploit kit to deliver GhostBlade, with DarkSword now leaked on GitHub and Apple pushing unusual on-device warnings for vulnerable iOS versions. Rapid7 describes China-linked "Red Menshen" using the kernel-level BPFdoor backdoor to persist in global telecom networks. TeamTNT compromises the Telnyx PyPI package with WAV-steganography payloads that steal secrets and target Kubernetes. Iran-linked activity includes a symbolic FBI director email breach and escalating, deliberate healthcare disruption via attacks on Stryker and a Pay2Key incident. 00:00 Show Intro and Sponsor 00:53 Mac ClickFix Stealer 03:25 Dark Sword iOS Exploits 06:30 China Telecom Backdoor 08:47 TeamTNT PyPI Supply Chain 12:20 Iran Cyber and Healthcare 17:41 Wrap Up and Thanks 18:43 Sponsor Message
RSA Conference 2026 produced hundreds of announcements from San Francisco’s Moscone Center this week. We curated the ones that matter for Canadian IT channel partners into three themes: agentic AI as the new attack surface, identity and hardware resilience, and partner economics. The big theme: agentic AI is the new attack surface The dominant message from RSA 2026 was clear — AI agents are a brand new attack surface, and the security industry arrived with its first wave of answers. Cisco extended its Zero Trust framework to treat AI agents as a new identity type, with visibility, access controls, and real-time monitoring for autonomous agents operating on the network. CrowdStrike launched Next-Gen SIEM support for Microsoft Defender for Endpoint with no Falcon sensor required, plus Shadow AI Discovery and AI Runtime Protection for finding unauthorized AI tools across client environments, and Agentic MDR for managed detection and response at machine speed. Proofpoint unveiled its AI Security platform and Agent Integrity Framework, defining a new standard for governing autonomous AI agents in the enterprise, alongside email and data security updates for the agentic workspace. Black Duck brought Signal to general availability, an agentic application security platform designed to secure AI-generated code in autonomous development workflows. Other notable RSA announcements along the agentic AI theme included Arctic Wolf’s Aurora Agentic SOC, Darktrace’s managed email security offering for MSSPs, and Huntress expanding ITDR coverage to Google Workspace while surpassing 10 million Microsoft 365 identities protected. Identity and resilience RSA launched ID Plus Sovereign Deployment, fully air-gapped, on-premises identity security for environments where cloud isn’t an option — directly relevant for Canadian organizations navigating data sovereignty requirements. RSA also announced an expanded partnership with Microsoft around M365 E7 and passwordless authentication, going deep on cloud integration at the same time as the sovereign deployment — both directions simultaneously. Dell Technologies expanded cybersecurity and resilience for the AI era and emerging quantum risks, including quantum-ready commercial PCs with post-quantum cryptography at the firmware level, AI-powered ransomware recovery for PowerProtect, and MDR extended to AI data platforms. HP launched TPM Guard from their Imagine event in New York, a hardware-enforced security feature protecting TPM-to-CPU communications from physical attacks — a similar hardware-level security play announced the same week. And here’s what you can sell Barracuda advanced the BarracudaONE cybersecurity platform alongside updates to the Partner Success Program, investing in both platform and partner program at the same time. Sectigo introduced an industry-first multi-tenant partner platform for certificate lifecycle management as a managed service, designed to help MSPs turn the shift to shorter certificate lifespans — now 200 days and eventually shrinking to 47 days by 2029 — into a scalable, recurring revenue stream. Further reading SecurityWeek’s RSAC 2026 Day 1 announcements summary SecurityWeek’s RSAC 2026 Day 2 announcements summary CRN: 10 hot new cybersecurity tools announced at RSAC 2026 Read Full Transcript Hello and welcome to a special midweek edition of In Case You Missed It from ChannelBuzz.ca. I’m Robert Dutt, and this week, RSA Conference 2026 took over San Francisco’s Moscone Center. Hundreds of announcements, dozens of press releases, and a whole lot of noise. So we went through the pile and pulled out what we think actually matters for Canadian IT channel partners. Let’s get into it. If there was one defining message from RSA this year, it’s this: the AI agents your clients are starting to deploy? They’re not just productivity tools. They’re a brand new attack surface, and the security industry just showed up with the first wave of answers. Cisco made the biggest splash, extending their Zero Trust framework to treat AI agents as a new identity type. Their pitch: if an AI agent can browse, query, and act on behalf of a user, it needs the same visibility, access controls, and real-time monitoring as any human on the network. CrowdStrike came in heavy across multiple days. Their Next-Gen SIEM now ingests Microsoft Defender for Endpoint telemetry with no Falcon sensor required — which is a big deal for MSPs managing mixed Microsoft environments. They also launched Shadow AI Discovery, which finds unauthorized AI applications running across client environments. If you’ve ever had to track down rogue SaaS subscriptions, imagine that problem, but with AI tools that can actually take actions on behalf of employees. CrowdStrike also introduced Agentic MDR — managed detection and response that operates at machine speed against AI-driven threats. Proofpoint went after the same problem from the email and collaboration side, launching their AI Security platform and Agent Integrity Framework. Their angle: securing the “agentic workspace” where humans and AI agents are operating side by side across email, cloud, and collaboration tools like Teams and Slack. And Black Duck brought their Signal platform to general availability — agentic application security designed specifically for AI-generated code. When your developers are using AI to write code, who’s checking the AI’s work? That’s the gap Signal is designed to close. They weren’t alone. Arctic Wolf launched what they’re calling the world’s largest commercial agentic SOC. Darktrace rolled out a managed email security offering for MSSPs. Huntress expanded their identity threat detection to Google Workspace. The message from the industry was unanimous: agentic AI security is not a future problem. It’s a right-now problem. If you’re advising clients on AI adoption, the security conversation just got significantly more complex. And that complexity is an opportunity — because your clients are going to need help navigating it. RSA — the company, at their own conference — made two announcements that pulled in opposite directions, and that was the point. They launched ID Plus Sovereign Deployment — fully air-gapped, on-premises identity security for environments where cloud is not an option. Think regulated industries, government, anyone with serious data sovereignty requirements. For Canadian partners dealing with OSFI E-21 or federal procurement, that’s directly relevant. At the same time, they announced an expanded Microsoft partnership around M365 E7 and passwordless authentication. So RSA is going both directions: as sovereign as you need on one end, as deeply cloud-integrated as you need on the other. On the hardware side, Dell announced quantum-ready commercial PCs with post-quantum cryptography built into the firmware, AI-powered ransomware recovery for their PowerProtect line, and an extension of their managed detection and response service to cover AI data platforms like PowerScale. HP made a similar hardware security move from their own event in New York this week, launching TPM Guard to protect TPM-to-CPU communications from physical attacks. The common thread: the security conversation is moving below the operating system and into the silicon. Two announcements that translate directly to partner economics. Barracuda — a hundred percent channel company — advanced their BarracudaONE cybersecurity platform alongside updates to their Partner Success Program. Platform investment and partner investment at the same time. That’s the kind of announcement that tells you a vendor is serious about the relationship, not just the product. And Sectigo launched a new partner platform built around the reality that SSL certificate lifespans that are already shrinking and headed to 47 days. When certificates need to be renewed every 47 days instead of every year, that’s either a massive headache or a recurring revenue opportunity. Sectigo is betting that partners who automate the process will turn a compliance burden into a managed service. That’s RSA Conference 2026 through the Canadian channel lens. Agentic AI security dominated the conversation. Identity and hardware resilience matured. And a couple of vendors made moves that directly affect your bottom line. Links and details for everything we covered are in the show notes. We’ll be back on Monday with the regular edition of ICYMI. Until then, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.
Social engineering attacks may evolve with new technology, but the core tactic hasn't changed in decades: exploiting human trust. In this episode of The Segment, host Raghu Nandakumara sits down with Timothy Kromphardt, Senior Threat Researcher at Proofpoint to explore how modern scams actually work behind the scenes. Tim spends his days engaging directly with threat actors—sometimes for months at a time—to understand how fraud campaigns operate, how scammers build trust, and how they ultimately convince victims to hand over money or sensitive information. Together, they unpack the mechanics of today's most common scams, including TOAD (telephone-oriented attack delivery) attacks, business email compromise, and the increasingly sophisticated “pig butchering” investment scams that can drain victims' life savings after months of relationship-building. Together, Raghu and Tim unpack: Why social engineering continues to succeed—even as security technology improves How pig butchering scams build trust over months before stealing massive sums What happens when researchers directly engage with scammers Why AI is helping attackers scale operations—but not necessarily replace humans Practical steps organizations and individuals can take to reduce their risk If you've ever wondered how scammers actually operate—or why even highly successful professionals sometimes fall victim—this episode offers a rare inside look at the human side of cybercrime. Stay Connected with our host, Raghu on LinkedIn For more information about Illumio, check out our website at illumio.com
日本プルーフポイント株式会社は3月17日、企業のAIエージェントを保護するインテント認識型AIセキュリティソリューション「Proofpoint AI Security」を発表した。
The AI revolution isn't coming—it's already here, and it's systematically breaking legacy email security as we know it. In this episode of Born in Silicon Valley, Alan LeFort, Co-Founder and CEO of StrongestLayer, reveals exactly why pattern-matching defenses are failing against AI-generated attacks and how his team is engineering reasoning-based detection to secure the future of enterprise communication. Alan brings over 25 years of experience scaling products at tech giants like Proofpoint, McAfee, and Intel. We dive into the critical pivot from large corporate life to startup innovation, exploring why true disruption requires a 10X leap in performance, not just incremental improvement. We also unpack the reality of the cybersecurity landscape: what hackers are really after, why AI is the ultimate double-edged sword, and how StrongestLayer is building the third generation of email security specifically for the AI era. Chapters 00:00 Introduction to Alan LeFort and StrongLayer 03:01 Alan's Unique Career Journey 06:13 The Decision to Join a Startup 07:52 The Role of Age in Startup Leadership 09:44 AI's Impact on Business and Email Security 13:12 The Challenges of Email Security 16:10 Disrupting Existing Categories in Sales 19:29 Key Metrics for Email Security Success 19:55 Common Threats in Email Security 21:57 Advice for Employees on Email Security 24:47 AI and Data Privacy in Security 27:32 StrongLayer's Growth and Future Plans 29:30 Navigating Change Management in Growth 32:31 The Future of Email Security 35:38 Dealing with Ransomware and Cyber Threats 38:12 Preparing for AI-Driven Attacks 39:34 Building a Strong Team for Growth 43:55 Identifying Key Roles for Success Host: Jake Aaron Villarreal leads the top AI recruitment firm in Silicon Valley, www.matchrelevant.com, uncovering stories of funded startups and going behind the scenes to tell their founders' journeys. If you are growing an AI startup or have a great story to tell, email us at: jake.villarreal@matchrelevant.com
This week on Cyber Uncut, David Hollingworth and Daniel Croft unpack the week's cyber and AI news and entertain a special guest to boot! The pair kick off the podcast discussing Qantas facing a backlash over a series of job cuts that may be informed by the company embracing AI, while WiseTech's announcement of 2,000 job cuts definitely is driven by AI uptake. The pair also talk about CrowdStrike's latest research, which shows hackers are embracing AI as much as everyone else. Hollingworth then unpacks a hacking spree targeting Australian small and medium-sized businesses by the Qilin ransomware operation, as well as a hack that has taken a major Aussie poultry producer offline. The pair also discuss the implications of an Australian man charged for selling cyber secrets to a broker linked to Russia. Hollingworth introduces this week's guest, ProofPoint CEO Sumit Dhawan, before the pair have a chat about agentic AI threats and how CISOs can educate their boards, and then they have a look at a more lighthearted – somewhat – sex toy data breach. Enjoy, The Cyber Uncut team
On this week's show, Patrick Gray, Adam Boileau and James WIlson discuss the week's cybersecurity news. They cover: Palo Alto threat researchers want to attribute to China, but management says shush An increasing proportion of ransomware is data extortion. Is this good? Cambodia says it's going to dismantle scam compounds CISA sufferers through yet another shutdown Google Gemini's training secrets are being systematically harvested to improve other LLMs Academics assess SaaS password managers' resilience against a malicious server This episode is sponsored by SSO-firewall integration vendor Knocknoc. Chief exec Adam Pointon joins to talk about the latest in defences… which is to say Knocknoc for Solaris/Sparc and HPUX on PA-RISC?! Okay also that other little known OS… Windows. This episode is also available on Youtube. Show notes Data-only extortion grows as ransomware gangs seek better profits | Cybersecurity Dive Arctic Wolf Threat Report 2026 Exclusive: Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say Risky Bulletin: Cambodia promises to dismantle scam networks by April - Risky Business Media Age of the ‘scam state': how an illicit, multibillion-dollar industry has taken root in south-east Asia | Cybercrime | The Guardian Critical flaw in BeyondTrust Remote Support sees early signs of exploitation | Cybersecurity Dive CISA Navigates DHS Shutdown With Reduced Staff - SecurityWeek Kimwolf Botnet Swamps Anonymity Network I2P – Krebs on Security BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign — Elastic Security Labs Over 500,000 VKontakte accounts hijacked through malicious Chrome extensions | The Record from Recorded Future News Password managers' promise that they can't see your vaults isn't always true - Ars Technica Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers Google finds state-sponsored hackers use AI at 'all stages' of attack cycle | CyberScoop Google: Gemini hit with 100,000+ prompts in cloning attempt Proofpoint acquires Acuvity to tackle the security risks of agentic AI | CyberScoop Cisco Redefines Security for the Agentic Era with AI Defense Expansion and AI-Aware SASE Sophos Acquires Arco Cyber to Bring CISO-Level, Agentic AI-Powered Expertise to Every Organization Dave Kennedy on X: "Regarding this, there was a couple questions on does the pacemaker continue to advertise - most BLE implantable devices go into a sleep type mode. In this case, we are lucky - it does not. We know based on law enforcement answers that she is using a more modern pacemaker with" / X Clash Report on X: "BIG: Dutch Defence Minister Gijs Tuinman hints that software independence is possible for F-35 jets. He literally said you can “jailbreak” an F-35. When asked if Europe can modify it without US approval: “That's not the point… we'll see whether the Americans will show https://t.co/f11cGvtYsO" / X Dutch police arrest man who refused to delete confidential files shared by mistake | The Record from Recorded Future News
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss how attackers are increasingly abusing legitimate, trusted Microsoft workflows to make phishing campaigns more convincing and harder to spot. In device code phishing, victims are socially engineered into completing a real Microsoft OAuth login flow, inadvertently granting attackers valid access tokens without ever sharing a password. They also examined abuse of Microsoft 365 Direct Send, which allows threat actors to send phishing emails that appear to originate from inside an organization, reinforcing a broader shift toward weaponizing built-in cloud services rather than relying on obviously malicious infrastructure.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss how attackers are increasingly abusing legitimate, trusted Microsoft workflows to make phishing campaigns more convincing and harder to spot. In device code phishing, victims are socially engineered into completing a real Microsoft OAuth login flow, inadvertently granting attackers valid access tokens without ever sharing a password. They also examined abuse of Microsoft 365 Direct Send, which allows threat actors to send phishing emails that appear to originate from inside an organization, reinforcing a broader shift toward weaponizing built-in cloud services rather than relying on obviously malicious infrastructure.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we dive into supply chain attacks through the lens of a massive Android malware campaign that infects devices before they ever reach users, embedding itself in firmware and reseller-installed system images. We connect the dots to other high-impact supply chain incidents—from SolarWinds to the recent F5 breach—and share new intelligence on Android devices compromised during manufacturing and distribution in China. Together, these cases highlight how attacks at the source can quietly scale, persist, and evade traditional defenses.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we dive into supply chain attacks through the lens of a massive Android malware campaign that infects devices before they ever reach users, embedding itself in firmware and reseller-installed system images. We connect the dots to other high-impact supply chain incidents—from SolarWinds to the recent F5 breach—and share new intelligence on Android devices compromised during manufacturing and distribution in China. Together, these cases highlight how attacks at the source can quietly scale, persist, and evade traditional defenses.
While our team is out on winter break, please enjoy this episode of Research Saturday. Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon. These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft's upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks. The research can be found here: Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing Learn more about your ad choices. Visit megaphone.fm/adchoices
While our team is out on winter break, please enjoy this episode of Research Saturday. Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon. These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft's upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks. The research can be found here: Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing Learn more about your ad choices. Visit megaphone.fm/adchoices
While our team is out on winter break, please enjoy this episode of Only Malware in the Building. Welcome in! You've entered, Only Malware in the Building — but this time, it's not just another episode. This is a special edition you won't want to miss. For the first time, our hosts are together in-studio — and they're turning up the heat. Literally. Join Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED, along with N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you've seen them tackle malware mysteries before? Wait until you see them sweat. This one's too good for audio alone — you'll want to watch the full video edition to catch every spicy reaction, every laugh, and maybe even a few tears. So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building.
While our team is out on winter break, please enjoy this episode of Only Malware in the Building. Welcome in! You've entered, Only Malware in the Building. Wrap yourself in a warm blanket, pour your favorite mug of tea, and join us each month as we unwrap the season's juiciest cyber mysteries. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore Remote access, real cargo: cybercriminals targeting trucking and logistics. From clever schemes to protect shipments to the tools cybercriminals use, our guests discuss how organizations can safeguard physical goods in an increasingly connected world—because even during the season of hustle and bustle, the threats don't take a holiday. Learn more about your ad choices. Visit megaphone.fm/adchoices
Join us for this week's Defender Fridays as we explore the reality of AI-powered malware threats with Randy Pargman, Senior Director of Threat Detection at Proofpoint.At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.In this episode, Randy challenges the hype around AI-powered polymorphic malware and examines how threat actors actually operate in practice. He discusses why defenders should focus on real-world threats rather than theoretical sophisticated attacks.Key Topics:The gap between AI malware hype and practical realityWhy threat actors prefer simple, effective methods over sophisticated techniquesThe prevalence of legitimate RMM tools in modern attacksBuilding practical detection strategies for actual threatsLessons from physical security that apply to cybersecurity defenseRandy Pargman is Senior Director of Threat Detection at Proofpoint, where he leads detection engineering, sandbox development, and threat actor tracking initiatives. Join us every Friday at 10:30am PT for live, interactive discussions with industry experts. Whether you're a seasoned professional or just curious about the field, these sessions offer an engaging dialogue between our guests, hosts, and you – our audience. Register here: https://limacharlie.io/defender-fridaysSubscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!This episode is brought to you by LimaCharlie, the world's first SecOps Cloud Platform (SCP). Build and customize your security stack like "lego blocks" with our flexible, API-first solution.Eliminate vendor sprawl and tool complexityDeploy and scale effortlessly on native multi-tenant architectureReduce costs with intelligent data routing and free 1-year retentionBuild custom solutions with 100+ security capabilities on-demandImprove response times with automation and real-time capabilitiesTry the SecOps Cloud Platform free: https://limacharlie.ioHost: Maxime Lamothe-Brassard - Founder at LimaCharlie
Welcome in! You've entered, Only Malware in the Building. Wrap yourself in a warm blanket, pour your favorite mug of tea, and join us each month as we unwrap the season's juiciest cyber mysteries. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore Remote access, real cargo: cybercriminals targeting trucking and logistics. From clever schemes to protect shipments to the tools cybercriminals use, our guests discuss how organizations can safeguard physical goods in an increasingly connected world—because even during the season of hustle and bustle, the threats don't take a holiday.
Welcome in! You've entered, Only Malware in the Building. Wrap yourself in a warm blanket, pour your favorite mug of tea, and join us each month as we unwrap the season's juiciest cyber mysteries. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore Remote access, real cargo: cybercriminals targeting trucking and logistics. From clever schemes to protect shipments to the tools cybercriminals use, our guests discuss how organizations can safeguard physical goods in an increasingly connected world—because even during the season of hustle and bustle, the threats don't take a holiday.
Please enjoy this encore of Only Malware in the Building. Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore what makes information sharing actually work. From public-private partnerships to actionable intelligence, our guests discuss how organizations can prioritize, process, and operationalize shared cyber threat data to stay ahead of emerging risks. Plus, catch Dave, Selena, and Keith on their road trip adventure in our video on YouTube — full of laughs, unexpected detours, and plenty of sleuthing! Learn more about your ad choices. Visit megaphone.fm/adchoices
Today, I had the privilege of having Tracey Newell on as a guest. We chatted about more women making their way to the top, no matter what the level means to you. Listen in to be inspired and challenged to reach your next level.Here's more about Tracey:Tracey Newell is the former president of Informatica, where she also served as a member of the company's board of directors for two years prior to being asked to join the management team. Prior to joining Informatica, Newell served as executive vice president of global field operations at Proofpoint, where she led sales through a five-year period of hypergrowth. Recognized as a Top 100 Sales Leader by The Modern Sale, Newell led Proofpoint's go-to-market team to become a top five leader in the cybersecurity market. Newell has also served as executive vice president of global sales at Polycom and held sales leadership positions at Juniper Networks, Webex, and Cisco Systems.Newell currently serves in the non-profit organization Impact 100, and is also a member of the board of advisors for the University of California, Santa Barbara's economics department. In addition to Druva, Newell serves on the board of directors of DataRobot, Highspot, Sailpoint, and Sumo Logic. Before we begin, if the Brave Women at Work Podcast has helped you personally or professionally, please share it with a friend, colleague, or family member. And your ratings and reviews help the show continue to gain traction and grow. Thank you again!Also, a Brave Women at Work Affirmation Deck is available in time for the holidays! It is a 54-card deck that is a beautiful compilation of advice and hard-won wisdom from podcast guests, Brave Women at Work Podcast guests, authors in the anthology series, and community members! You can grab a copy of the deck for $19.99 plus $10 shipping. To purchase your deck, visit Brave Women at Work and click on Resources. From there, you will see the Affirmation Cards page. I hope you enjoy them!
November 5, 2025 ~ Selena Larson, senior threat intelligence analyst at Proofpoint, joins Chris and Jamie to discuss a recent trend in hackers and organized crime groups working together to pull off cargo thefts. Hosted by Simplecast, an AdsWizz company. See https://pcm.adswizz.com for information about our collection and use of personal data for advertising.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore what makes information sharing actually work. From public-private partnerships to actionable intelligence, our guests discuss how organizations can prioritize, process, and operationalize shared cyber threat data to stay ahead of emerging risks. Plus, catch Dave, Selena, and Keith on their road trip adventure in our video on YouTube — full of laughs, unexpected detours, and plenty of sleuthing!
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, we explore what makes information sharing actually work. From public-private partnerships to actionable intelligence, our guests discuss how organizations can prioritize, process, and operationalize shared cyber threat data to stay ahead of emerging risks. Plus, catch Dave, Selena, and Keith on their road trip adventure in our video on YouTube — full of laughs, unexpected detours, and plenty of sleuthing!
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this spooky special episode, our hosts ponder which threat actor, malware, or campaign name would be the most terrifying — from the spectral stealth of GhostRAT silently haunting your systems, to the deceptively sweet lure of ILoveYou that once spread chaos across the globe. Along the way, they share some of their favorite “ghost stories” from the cyber underworld — legendary incidents and infamous operations that still haunt defenders today — and explore why these names and their real-world impacts have left such lasting scars on the digital landscape. Plus, we've cooked up a fun, mystery-solving video to accompany this episode — complete with spooky clues, masked sleuths, and a few laugh-out-loud moments that fans of classic cartoon detectives will appreciate. Check it out on YouTube and see if you can unmask the culprit!
AI is moving too fast for regulation to keep up. Sumit Dhawan, CEO of Proofpoint, discusses how industries are adopting AI without knowing how to handle the technology. He notes that sensitive data, financial information, and critical infrastructure are being exposed as it's fed into the AI, and Sumit emphasizes that the machine doesn't know who is allowed to see what. He discusses how companies can keep data more secure and how to build stronger systems.======== Schwab Network ========Empowering every investor and trader, every market day. Subscribe to the Market Minute newsletter - https://schwabnetwork.com/subscribeDownload the iOS app - https://apps.apple.com/us/app/schwab-network/id1460719185Download the Amazon Fire Tv App - https://www.amazon.com/TD-Ameritrade-Network/dp/B07KRD76C7Watch on Sling - https://watch.sling.com/1/asset/191928615bd8d47686f94682aefaa007/watchWatch on Vizio - https://www.vizio.com/en/watchfreeplus-exploreWatch on DistroTV - https://www.distro.tv/live/schwab-network/Follow us on X – https://twitter.com/schwabnetworkFollow us on Facebook – https://www.facebook.com/schwabnetworkFollow us on LinkedIn - https://www.linkedin.com/company/schwab-network/ About Schwab Network - https://schwabnetwork.com/about
How do we future-proof the digital payment experience so it becomes invisible to customers—yet keep it working harder than ever for brands?Agility requires a deep understanding of how technology can simplify the customer journey without compromising security or trust. Today we're going to talk about the future of secure digital payments, how in-app and frictionless experiences are redefining customer loyalty, and why platform providers need to take the in-app payment shift seriously.To help me discuss this topic, I'd like to welcome Peter Galvin, Chief Marketing Officer at NMI. About Peter Galvin Peter is Chief Marketing Officer at NMI and is a 20-year veteran of global technology organizations, specializing in promoting innovative enterprise and Cloud-based software companies to leadership positions. He previously served as Chief Marketing Officer at Entrust and Proofpoint, as well as Chief Strategy & Marketing Officer for nCipher (formerly Thales e-Security). Peter has also served in senior marketing leadership roles at leading technology companies including Openwave, Inktomi (acquired by Yahoo) and Oracle. He's passionate about skiing and travel, and enjoys cooking and spending time with his family. Peter Galvin on LinkedIn: https://www.linkedin.com/in/petergalvin/ Resources NMI: https://www.nmi.com The Agile Brand podcast is brought to you by TEKsystems. Learn more here: https://www.teksystems.com/versionnextnow Register now for Sitecore Symposium, November 3-5 in Orlando Florida. Use code SYM25-2Media10 to receive 10% off. Go here for more: https://symposium.sitecore.com/Don't Miss MAICON 2025, October 14-16 in Cleveland - the event bringing together the brights minds and leading voices in AI. Use Code AGILE150 for $150 off registration. Go here to register: https://bit.ly/agile150 Connect with Greg on LinkedIn: https://www.linkedin.com/in/gregkihlstromDon't miss a thing: get the latest episodes, sign up for our newsletter and more: https://www.theagilebrand.showCheck out The Agile Brand Guide website with articles, insights, and Martechipedia, the wiki for marketing technology: https://www.agilebrandguide.com The Agile Brand is produced by Missing Link—a Latina-owned strategy-driven, creatively fueled production co-op. From ideation to creation, they craft human connections through intelligent, engaging and informative content. https://www.missinglink.company
How do we future-proof the digital payment experience so it becomes invisible to customers—yet keep it working harder than ever for brands?Agility requires a deep understanding of how technology can simplify the customer journey without compromising security or trust.Today we're going to talk about the future of secure digital payments, how in-app and frictionless experiences are redefining customer loyalty, and why platform providers need to take the in-app payment shift seriously.To help me discuss this topic, I'd like to welcome Peter Galvin, Chief Marketing Officer at NMI. About Peter Galvin Peter is Chief Marketing Officer at NMI and is a 20-year veteran of global technology organizations, specializing in promoting innovative enterprise and Cloud-based software companies to leadership positions. He previously served as Chief Marketing Officer at Entrust and Proofpoint, as well as Chief Strategy & Marketing Officer for nCipher (formerly Thales e-Security). Peter has also served in senior marketing leadership roles at leading technology companies including Openwave, Inktomi (acquired by Yahoo) and Oracle. He's passionate about skiing and travel, and enjoys cooking and spending time with his family. Peter Galvin on LinkedIn: https://www.linkedin.com/in/petergalvin/ Resources NMI: https://www.nmi.com The Agile Brand podcast is brought to you by TEKsystems. Learn more here: https://www.teksystems.com/versionnextnow Register now for Sitecore Symposium, November 3-5 in Orlando Florida. Use code SYM25-2Media10 to receive 10% off. Go here for more: https://symposium.sitecore.com/Don't Miss MAICON 2025, October 14-16 in Cleveland - the event bringing together the brights minds and leading voices in AI. Use Code AGILE150 for $150 off registration. Go here to register: https://bit.ly/agile150 Connect with Greg on LinkedIn: https://www.linkedin.com/in/gregkihlstromDon't miss a thing: get the latest episodes, sign up for our newsletter and more: https://www.theagilebrand.showCheck out The Agile Brand Guide website with articles, insights, and Martechipedia, the wiki for marketing technology: https://www.agilebrandguide.com The Agile Brand is produced by Missing Link—a Latina-owned strategy-driven, creatively fueled production co-op. From ideation to creation, they craft human connections through intelligent, engaging and informative content. https://www.missinglink.company Hosted on Acast. See acast.com/privacy for more information.
In this episode of Inside the Network, we sit down with Sumit Dhawan, CEO of Proofpoint, one of the largest private cybersecurity companies in the world. With over $2 billion in ARR, Proofpoint protects 85 of the Fortune 100 and is on a bold path toward $5 billion in revenue by 2030.Sumit's journey is a masterclass in modern leadership. Having graduated with degrees in engineering and business from IIT Roorkee, the University of Minnesota, and the University of Florida, Sumit led major business lines at Citrix and VMware, including overseeing VMware's $70 billion divestiture to Broadcom, before making the leap to cybersecurity. In 2023, he joined Proofpoint as CEO and began executing an ambitious strategy: consolidate the sprawl of human-centric security, go deep instead of broad, and prepare the company for its next chapter of growth.In our conversation, Sumit shares why he believes empathy is the most underrated CEO trait, how acting like a founder, even inside large enterprises, shaped his leadership, and what it means to have “Apple Watch governance” under Thoma Bravo. He explains how Proofpoint has evolved from email security leader to a broader platform for human and data protection, including its acquisitions of Tessian (AI-native email protection), Hornetsecurity (MSP-focused email security), and Normalyze (DSPM).Sumit also pulls back the curtain on the AI threat landscape, including how prompt injection attacks are already targeting copilots and agents, why AI is both supercharging attackers and empowering defenders, and how Proofpoint built intent-based detection models to defend against sophisticated zero-link phishing. Finally, he lays out three categories of viable cybersecurity startups today: gap-fillers, AI defenders, and category disruptors, and why the last two are more likely to be successful.Whether you're scaling a cyber startup, selling into the enterprise, or navigating PE-backed growth, this episode is full of hard-earned wisdom from a leader who's operated at every level of the stack.
Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon. These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft's upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks. The research can be found here: Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing Learn more about your ad choices. Visit megaphone.fm/adchoices
Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon. These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft's upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks. The research can be found here: Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing Learn more about your ad choices. Visit megaphone.fm/adchoices
Welcome in! You've entered, Only Malware in the Building — but this time, it's not just another episode. This is a special edition you won't want to miss. For the first time, our hosts are together in-studio — and they're turning up the heat. Literally. Join Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED, along with N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you've seen them tackle malware mysteries before? Wait until you see them sweat. This one's too good for audio alone — you'll want to watch the full video edition to catch every spicy reaction, every laugh, and maybe even a few tears. So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building. Learn more about your ad choices. Visit megaphone.fm/adchoices
Welcome in! You've entered, Only Malware in the Building — but this time, it's not just another episode. This is a special edition you won't want to miss. For the first time, our hosts are together in-studio — and they're turning up the heat. Literally. Join Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED, along with N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you've seen them tackle malware mysteries before? Wait until you see them sweat. This one's too good for audio alone — you'll want to watch the full video edition to catch every spicy reaction, every laugh, and maybe even a few tears. So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our three hosts discuss several articles covering a new wave of social engineering attacks tied to the so-called Contagious Interview campaign. In this operation, threat actors linked to North Korea are reportedly posing as tech recruiters to trick job seekers into downloading malware. The discussion highlights updates to two malware strains—BeaverTail and InvisibleFerret—that have been retooled with cross-platform capabilities and new data theft features, raising fresh concerns about how targeted individuals could become a gateway into larger organizational networks. You can find the links to the stories here: Lazarus Group Infostealer Malwares Attacking Developers In New Campaign Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware North Korean State Sponsored Supply Chain Attack on Tech Innovation Lazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting Scam
Officials in St. Paul, Minnesota declare a state of emergency following a cyberattack. Hackers disrupt a major French telecom. A power outage causes widespread service disruptions for cloud provider Linode. Researchers reveal a critical authentication bypass flaw in an AI-driven app development platform. A new study shows AI training data is chock full of PII. Fallout continues for the Tea dating safety app. Hackers are actively exploiting a critical SAP NetWeaver vulnerability to deploy malware. CISA and the FBI update their Scattered Spider advisory. A Florida prison exposes personal information of visitors to all of its inmates. Our guest today is Keith Mularski, Chief Global Ambassador at Qintel, retired FBI Special Agent, and co-host of Only Malware in the Building. CISA and Senator Wyden come to terms —mostly— over the long-buried US Telecommunications Insecurity Report. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Our guest today is Keith Mularski, Chief Global Ambassador at Qintel, retired FBI Special Agent, and co-host of Only Malware in the Building discussing what it's like to be the new host on the N2K CyberWire network and giving a glimpse into some upcoming episodes. You can catch Keith and his co-hosts Selena Larson, Staff Threat Researcher and Lead, Intelligence Analysis and Strategy at Proofpoint, and our own Dave Bittner the first Tuesday of each month on your favorite podcast app with new episodes of Only Malware. Selected Reading Major cyberattack hits St. Paul, shuts down many services (Star Tribune) French telecom giant Orange discloses cyberattack (Bleeping Computer) Power Outage at Newark Data Center Disrupts Linode, Took LWN Offline (FOSS Force) Critical authentication bypass flaw reported in AI coding platform Base44 (Beyond Machines) A major AI training data set contains millions of examples of personal data (MIT Technology Review) Dating safety app Tea suspends messaging after hack (BBC) Hackers exploit SAP NetWeaver bug to deploy Linux Auto-Color malware (Bleeping Computer) CISA and FBI Release Tactics, Techniques, and Procedures of the Scattered Spider Hacker Group (gb hackers) Florida prison data breach exposes visitors' contact information to inmates (Florida Phoenix) CISA to release long-buried US telco security report (The Register) Audience Survey Complete our annual audience survey before August 31. Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
Today we are joined by Selena Larson, Threat Researcher at Proofpoint, and co-host of Only Malware in the Building, as she discusses their work on "Amatera Stealer - Rebranded ACR Stealer With Improved Evasion, Sophistication." Proofpoint researchers have identified Amatera Stealer, a rebranded and actively developed malware-as-a-service (MaaS) variant of the former ACR Stealer, featuring advanced evasion techniques like NTSockets for stealthy C2 communication and WoW64 Syscalls to bypass user-mode defenses. Distributed via ClearFake web injects and the ClickFix technique, Amatera leverages multilayered PowerShell loaders, blockchain-based hosting, and creative social engineering to compromise victims. With enhanced capabilities to steal browser data, crypto wallets, and other sensitive files, Amatera poses a growing threat in the wake of disruptions to competing stealers like Lumma. Complete our annual audience survey before August 31. The research can be found here: Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication Learn more about your ad choices. Visit megaphone.fm/adchoices
Please enjoy this encore of Only Malware in the Building. Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by N2K Networks Dave Bittner and our newest co-host, Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss the growing trend of cybercriminals using legitimate remote monitoring and management (RMM) tools in email campaigns as a first-stage payload. They explore how these tools are being leveraged for data theft, financial fraud, and lateral movement within networks. With the decline of traditional malware delivery methods, including loaders and botnets, the shift toward RMMs marks a significant change in attack strategies. Tune in to learn more about this evolving threat landscape and how to stay ahead of these tactics.
Welcome in! You've entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today's most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York's exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss Chinese-speaking threat actors are targeting Japan with a massive phishing campaign using a sneaky new kit called CoGUI, which has hit organizations with over 170 million messages in a single month. The campaign mimics trusted brands like Amazon, PayPay, and Rakuten to steal login and payment info—lining up with warnings from Japan's Financial Services Agency about attackers cashing out and buying Chinese stocks. While the CoGUI kit is slick with its evasion tricks and browser profiling, your hosts are hot on its trail with new detections to help stop the phishing frenzy.
© 2020-2026 Ivy Podcast Discovery LLC
