Find the exact control, technique, lesson, or book.
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
Don’t wait to learn the fire drill while the building’s on fire. In this Cyber Talk developed by BareMetalCyber.com, Army veteran and cyber resilience strategist Daniel Hammond shows how to move past check-the-box drills and turn exercises into a core learning culture. He walks through goal-driven planning (so every exercise serves a sponsor’s real need), the HSEEP spectrum from seminars and workshops to tabletops…
Excel is great for many things — but it is not a governance, risk, and compliance (GRC) platform. In this Cyber Talk developed by BareMetalCyber.com, Dr. Jason Edwards sits down with Dean Charlton, Managing Director of DC CyberTech, to unpack why even the most well-intentioned GRC programs stall out when they live in spreadsheets. Dean walks through the real-world pain points of “Excel-driven” GRC, from version…
In my Cyber Talks conversation with Craig Taylor the co-founder and CEO of CyberHoot, we dive into a problem that is evolving faster than most organizations can keep up: phishing in the age of agentic AI. Cyber Talks, developed by BareMetalCyber.com, is all about learning from practitioners who are pushing the field forward, and Craig has spent three decades on the front lines of security, risk, and cyber literacy.…
In my conversation with Detective Richard Wistocki (Ret.), we talked candidly about a reality that many school leaders and law enforcement professionals already feel in their bones: online threats are constant, confusing, and often paralyzing. This Cyber Talk, developed by BareMetalCyber.com, focuses on what it really takes to track school swatters and potential shooters through “leakage” in social media and online…
The dark web isn’t just a hidden corner of the internet—it’s a thriving underground economy where cybercriminals buy and sell stolen data, hacking tools, and access to compromised systems. In this episode, we take a deep dive into the shadowy world of dark web intelligence, exploring how security professionals monitor these spaces to track emerging threats. From illicit marketplaces fueling ransomware operations to…
In this narrated edition of “Data Gravity Wells: Where Sensitive Information Inevitably Sinks,” we walk through why your most critical data rarely stays inside the neat boxes on your architecture diagram. Sensitive records drift into logs, analytics environments, collaboration suites, and emerging AI stores, quietly forming a handful of platforms that now define your real exposure. You will hear how data gravity…
Malware is the backbone of modern cyber threats, evolving rapidly to outsmart security defenses and infiltrate systems undetected. In this episode of Bare Metal Cyber, we take a deep dive into advanced malware analysis, exploring the techniques used to dissect malicious code, uncover obfuscation tactics, and understand how attackers evade detection. From reverse engineering malware with tools like IDA Pro and…
When deepfakes become cheap and convincing, the hardest question inside an enterprise is no longer “Was this compromised?” but “Did this ever really happen?” In this narrated audio version of “Deepfake Governance: Policy, Evidence, and the New ‘I Didn’t Say That’ Defense,” we explore how synthetic media erodes trust in real recordings, chats, and logs. You will hear how the liar’s dividend plays out in executive…
Hybrid threats are changing what it means to “handle an incident,” and this narrated episode walks through how that plays out when protests, outages, and digital campaigns collide. You’ll hear how physical demonstrations spill into doxxing, harassment, and pressure on online services, and why outages are increasingly used as leverage rather than just unfortunate side effects. We’ll explore how shared…
Disasters rarely look like the neat scenarios in your continuity binder. In this narrated Headline, we explore “Disaster by Design: Proving Your Business Can Survive Its Own Kill Switch” as a practical playbook for leaders who want evidence, not comfort. You will hear how hidden kill switches emerge from identity platforms, cloud control planes, device agents, and vendor dependencies, and why traditional disaster…
In this episode, we explore why email is both the oldest and most dangerous application in your enterprise. You’ll learn how protocols built in the 1970s still carry modern business logic, why attackers thrive on its openness, and how Business Email Compromise has evolved into one of the most profitable cybercrimes in history. The discussion traces the history of email’s insecure DNA, the patchwork of fixes that…
In today's episode, we explore how ChatOps—the integration of collaboration and operations through platforms like Slack and Teams—has reshaped modern workplaces, delivering unprecedented speed and agility. But these powerful productivity tools come with hidden dangers, attracting cyber intruders eager to exploit casual conversations, misplaced trust, and overlooked configurations to breach security unnoticed. We’ll…
In this episode, we unpack why the popular slogan “don’t paste {Sensitive Thing} into {Cool Bot}” has become the lazy default for GenAI policy—and why it fails. Listeners will learn how vague rules fuel shadow AI, create inconsistent behavior, and ultimately increase risk rather than reduce it. We explore how to replace empty slogans with real frameworks: data tier maps, risk-based tool catalogs, guardrails that…
In this narrated edition of Ghosts in the Training Data: When Old Breaches Poison New AI, we explore how years of incidents, leaks, and scraped datasets quietly shape the behavior of your most important models. You will hear how stolen code, rushed hotfixes, crooked incident logs, and brokered context move from “someone else’s breach” into the background radiation of modern AI platforms. This Wednesday “Headline”…
In this episode, we explore the strange yet critical world of adversarial machine learning—where tiny, unseen manipulations can fool AI systems into making dangerous and bizarre mistakes. From autonomous cars misinterpreting road signs to AI-driven medical devices misdiagnosing patients, we uncover real-world scenarios illustrating how subtle digital tweaks can create major real-life consequences. We’ll also…
In this episode, Hacked by a Human: The Future of Social Engineering and Phishing, breaking down how cybercriminals are evolving their tactics to manipulate people with unprecedented precision. Social engineering is no longer just about phishing emails—it’s AI-driven, deeply personalized, and spans multiple platforms. Attackers are using deepfakes, real-time adaptive AI, and multi-channel deception to target…
When your identity data stops matching reality, every dashboard and control you rely on starts to wobble. In this audio edition of “Identity Bankruptcy: When Your Organization Runs Out of Trust,” we walk through what it looks like when a mature organization quietly runs out of confidence in its own answers to “who is this” and “what should they be able to do.” The episode unpacks identity debt, the idea of an…
In this episode, we dive deep into the growing cyber threats targeting Industrial Control Systems (ICS) and SCADA environments—critical infrastructure that keeps power grids running, water flowing, and manufacturing plants operational. These systems, originally designed for reliability rather than security, are now prime targets for ransomware groups, nation-state actors, and supply chain attacks. From legacy…
Secrets management for API keys, tokens, and passwords is often the quiet difference between a minor configuration mistake and a major breach. In this narrated audio version of my Tuesday “Insights” feature from Bare Metal Cyber Magazine, we walk through what secrets management really means in day-to-day work. You will hear how vaults, runtime retrieval, rotation, and access policies fit together, and why they…
In this episode of BareMetalCyber, we delve into the shadowy world of state-sponsored cyber sabotage, examining how nations increasingly leverage digital attacks for espionage, economic disruption, and geopolitical advantage. We explore sophisticated hacking tactics—from zero-day exploits and psychological warfare to supply chain infiltration—and reveal why attribution remains so notoriously difficult in today's…
This audio edition of “LLM Roulette: When Every Employee Has a Different AI in Their Browser” walks through what really happens when large language models (LLMs) arrive one browser tab at a time instead of through a formal program. You will hear how shadow AI tools quietly become a decision layer across sales, engineering, marketing, finance, and legal, shaping tone, risk appetite, and customer experience without…
Mergers and acquisitions are great for growth, but they can be brutal for your risk profile if you treat cyber as an afterthought. In this audio version of “M&A Malware: Security Debt Hidden Inside Acquisitions,” we walk through how security debt quietly rides along with deal synergies and why traditional due diligence often fails to surface what really matters. You will hear how the deal room blind spot forms…
In this audio edition of “Machine Identity Riot: Certificates, Tokens, and Bots Gone Wild,” we walk leaders through the trust fabric that actually runs their business. You will hear how certificates, tokens, API keys, service accounts, and bots have quietly become the dominant identity layer in most organizations, far outnumbering human users. The episode explains where this machine identity surface comes from, how…
When you look past the wall of dashboards in most security operations centers, a tougher reality appears: leaders can see alert volumes and colorful charts, but they cannot always say which attacker behaviors they truly catch with confidence. In this narrated audio version of “Making Alerts Great Again: Detection Engineering, Not Dashboard Worship,” we walk through why that gap exists and what it means for security…
