The Cyber Threat Perspective

In this episode, Spencer and Tyler discuss why deception is one of the best ways to catch threat actors.
Resources
Spencer's Cyber Deception Webinar
Spencer's X posts on the topic of cyber deception
https://thinkst.com/, https://canary.tools/
@_subtee on X, @haroonmeer on X
https://tracebit.com/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

Need a pentest or vCISO? Work with us! https://www.securit360.com/

A major leadership failure in Cybersecurity is l buying tools first then figuring out where they fit and how to use them. That’s super backwards. Here’s what I would do instead. Plan first, buy & implement second. I’m going to cover just the planning part this week. Next week we will talk about buying and implementing. Because honestly, implementation is where a lot of security teams go wrong. 
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

In this episode Spencer and Tyler discuss real life Active Directory attack paths, taken from real internal pentest engagements over the last several years.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

Some of the most dangerous security gaps aren't sophisticated — they're the ones hiding in plain sight.
In this replay, Brad and Spencer break down the biggest blind spots they see over and over in mid-size companies: poor asset inventory, flat networks, flat identities, overconfidence in security tools, credential reuse, and the emerging risks with AI.
If any of these hit home, go to our website, fill out the form, and see if we're a fit for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

AI agents can search the web, manipulate files, run commands, make API requests, access cloud platforms, and operate fully autonomously. They are powerful, they are here, and most organizations have no security controls around them whatsoever.
In this episode, Brad and Spencer break down the five major AI agent risk categories security teams need to understand right now, using Simon Willison's "lethal trifecta" as a framework and building on it with two additional risk areas they see in the field.
In this episode:
- What an AI agent actually is and why the definition matters before you can secure it
 - What AI agents are capable of: files, commands, APIs, memory, cloud access, and autonomous execution
 - The lethal trifecta: access to private data, exposure to untrusted content, and external communication
 - Risk category 1: Access to private data - why agents inherit your permissions and why that is dangerous
 - Risk category 2: Exposure to untrusted content and prompt injection attacks
 - Risk category 3: External communication and data exfiltration (including a real canary token experiment)
 - Risk category 4: Privileged access and limiting blast radius with least privilege identities
 - Risk category 5: Autonomous actions, approval gates, rate limits, and kill switches
 - Why backups, rollback plans, and recovery playbooks are more important than ever in an AI agent world
Resources mentioned:
- Simon Willison's lethal trifecta post (June 2025): https://simonwillison.net
- Zach Korman's ContinuumCon sandbox escape workshop: https://continuumcon.com/schedule/
- offsec.blog | securit360.com
Need a pen test before end of year? Q3 slots are filling up fast. 
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.