In this episode, host Elliot Volkman is joined by Carly Sherrod of Microsoft’s Detection and Response Team (DART) and Spencer McIntyre, Director of Exploit Development at VulnCheck to break down the critical PHP2Shell vulnerabilities. They explore how the exploits work, the reality behind reports of widespread attacks, and how AI is accelerating exploit development. The conversation also covers what security teams should look for, how to assess potential exposure, and why patching alone may not be enough to protect vulnerable systems.

AI-enabled attacks are on the rise, your analysts are drowning in alerts, and vendors are positioning an autonomous SOC as the solution. But what can AI agents actually do today? How will analyst roles evolve? And how much autonomy can you safely give? Cybersecurity researcher Jon Oltsik joins Johnny and Dustin to separate AI automation from AI autonomy. They explore what it takes to bring AI agents into the SOC safely, from testing agents in shadow mode to establishing clear guardrails and human oversight, and why trust in an agent has to be earned through proven performance.

In this episode, host Elliot Volkman is joined by Microsoft's Karina Sirota to explore the challenges of transitioning to post-quantum cryptography. They discuss Microsoft's post-quantum certificate pilot, the importance of industry collaboration, and why preparing for quantum threats involves much more than replacing encryption algorithms. Karina also shares practical steps organizations can take today to identify cryptographic dependencies, evaluate vendor readiness, and build a foundation for a quantum-resistant future.

Your AI initiative gets the green light. But now all the parameters and guardrails you built into your plan need to be executed. Who owns AI once it goes live? Who’s watching as AI use expands? And if the AI workflow fails, can anyone still run the process it replaced? In this episode, Maria Haight, Global Information Security Officer at Joyson Safety Systems, joins Dustin Childs to unpack the operational realities of AI security. She advocates for preserving human know-how, assigning business ownership, and backing up critical data to keep the business running should an AI system fail or dare we say it, go rogue.

On this special edition podcast, Dave Bittner is joined by ⁠John Kindervag⁠, Chief Evangelist at Illumio, and ⁠Dr Chase Cunningham⁠ to discuss the principles of zero trust, cyber resilience, and how AI is transforming cybersecurity strategies. They explore practical frameworks, misconceptions, and the future of security in a machine-speed world. John is the author of "⁠Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era⁠," and Chase is one of the book's contributors.

On this episode, Christine and Madison sit down with Kimanzi Constable to learn more about his experience as a freelance journalist.

In this episode, ⁠Dave Bittner⁠ joins ⁠Maria Varmazis⁠ to explore the evolution of public-private partnerships in cybersecurity over the past decade. Together, they discuss key incidents, trust-building, and the future challenges posed by AI and geopolitical shifts.

The “AI trust paradox” in cybersecurity goes like this: organizations invest in AI automation, then hold back from fully implementing it. Yet as attackers continue to use AI to move faster, defenders need to leverage AI to fix things as fast as it finds them. In this episode, Tyler Shields, Chief Marketing Officer at Allstacks and a cybersecurity industry analyst with more than 25 years advising security vendors and teams, shares the steps needed to build trust in autonomous remediation without sacrificing human judgment and control.

In this episode, host Elliot Volkman is joined by Chloe Messdaghi and Karen Frost for a behind-the-scenes look at Microsoft’s annual Digital Defense Report (MDDR). They explore how AI is reshaping the cybersecurity landscape by increasing the speed, scale, and automation of attacks while also giving defenders new tools to detect and respond to threats. The conversation covers AI agents, phishing and identity-based attacks, vulnerability management, security resilience, and the growing need for organizations to connect signals across their environments. Chloe and Karen also share practical priorities for CISOs and discuss what the rise of increasingly autonomous AI agents could mean for the future of cyber defense.

This week we are taking you back to Black Hat USA 2026 and exploring two sides of the security landscape. First, Microsoft incident response experts Adrian Hill and Terry Mee break down identity-based attacks, from compromised credentials and MFA bypasses to containment, logging, access controls, and the growing risks surrounding AI agents. Then, members of Microsoft’s Defender Purple Team discuss how they recreate full attack chains, including emerging AI-driven techniques, to identify detection gaps, strengthen defenses, and use AI to accelerate security research while keeping human expertise in the loop.

On this special edition podcast, N2K CyberWire's Dave Bittner spoke with ⁠Camille Stewart Gloster⁠⁠. Camille is the author of The Insider You Built: How Organizations Stay in Control of Autonomous AI Agents, and founder of⁠⁠ CAS Strategies⁠⁠. Dave and Camille discuss her new book and the broader questions it raises about AI agents.

In traditional IT, isolating a compromised endpoint can stop an attack. In operational technology (OT) environments, that same action could disrupt control of a pipeline, cause a rupture, or trigger environmental damage. That’s why adopting AI in critical infrastructure requires a fundamentally different security approach. Drawing on more than 25 years of experience across energy, pipelines, aerospace, and defense, Jason Cradit, CTO and CISO at Everline, explains how security leaders can move beyond blanket restrictions and establish practical AI governance and guardrails.

In this Special Edition episode, ⁠Maria Varmazis⁠⁠ and ⁠⁠Dave Bittner⁠⁠ from N2K Cyberwire get back together to reflect on the past decade of critical infrastructure attacks, evolving threats, and lessons learned from incidents like the Ukraine power grid attack and Colonial Pipeline ransomware. They discuss how these events have shaped current cybersecurity practices and the importance of resilience and preparedness.

There's no silver bullet when it comes to AI security strategy, and treating one model, tool, or vendor as the answer can limit an organization’s ability to adapt. Morgan Adamski, who leads PwC’s Cyber, Data & Technology Risk practice, joins us to tackle two pressing questions: How should organizations choose between closed frontier models and open-weight alternatives? And how can they build a multi-model architecture flexible enough to keep pace as AI technology rapidly evolves? Drawing on her work with boards, CISOs, and security teams, Morgan cuts through the “paralysis by analysis” surrounding these questions and offers security leaders a practical path forward.

In this episode of the Microsoft Threat Intelligence Podcast, recorded live at Black Hat, Microsoft Threat Intelligence Director Elliot Volkman is joined by Andrew “Spike” Grant, Principal Threat Intelligence Incident Commander at Huntress. They explore how cybercriminals are increasingly abusing legitimate remote monitoring and management (RMM) tools, why trusted remote-access software has become an attractive alternative to traditional malware, and how AI is improving phishing and social engineering. Spike also breaks down a real-world attack that deployed multiple RMM tools to maintain access, shares stories from his years of interacting directly with threat actors and offers practical guidance for detecting suspicious RMM activity before it leads to ransomware or data theft.

On this episode of #IMM, Christine and Madison chat with Ken Underhill to learn more about his role and coverage at eSecurity Planet.

In this Special Episode, ⁠Maria Varmazis⁠ and ⁠Dave Bittner⁠ are joined by friend of the show, ⁠Brandon Karpf⁠, to unpack a new bipartisan congressional investigation into the lingering presence of Chinese state-owned telecommunications companies inside U.S. internet infrastructure. The House Select Committee on China says China Mobile, China Unicom, and China Telecom remain deeply embedded in American networks even after federal regulators denied or revoked their authority to provide certain telecommunications services over national security concerns. The investigation found that restrictions imposed by the FCC limited what the companies could sell, but did not necessarily remove their equipment, network connections, or commercial relationships from the U.S. internet ecosystem.

In this episode, ⁠Maria Varmazis⁠ and ⁠Dave Bittner⁠ from N2K Cyberwire get back together to discuss the evolution of advanced persistent threats (APTs), threat actor landscape, attribution changes, and the future of cyber espionage over the past decade. Join Dave and Maria as they explore how geopolitical factors, organizational professionalism, and emerging technologies like AI are shaping cybersecurity threats.

Is your organization truly AI native, or did you just bolt AI onto existing infrastructure? Your answer could be an indicator to how much risk you’re carrying without realizing it. Zach Evans, Chief Technology Officer at Xsolis, has a simple test for telling the difference: strip out the AI and see if your process still works. If it does, you may be exposing your organization to security blind spots and workflows that quietly erode organizational knowledge and skills. Zach joins Johnny Hand and Dustin Childs to unpack what it actually takes to build an AI-native organization, and why the stakes of getting agentic AI wrong can be unforgiving for every organization, not just those in healthcare.