The Cyber Threat Perspective

200 episodes! Thank you to everyone who has listened, watched, and shared The Cyber Threat Perspective along the way. To mark the milestone, Brad Causey and Jordan Natter are back with Part 6 of our OWASP Top 10 series, breaking down A06: Insecure Design. These flaws show up when an application does exactly what it was designed to do, but nobody stopped to ask how that functionality could be abused. Brad and Jordan walk through what insecure design looks like in practice, share real-world war stories from pen tests and beyond, and explain how to catch these flaws before they ever reach production.
In this episode:
Why insecure design fell from #4 to #6 in the OWASP Top 10, and why that isn’t good news
Rate limiting, user enumeration, and why secret questions are a no go
How a teenager’s AOL trial CD experiment turned into a career
Abusing rewards programs, group bookings, and first-purchase coupons
Taking over insurance accounts using publicly available census data
Prevention through misuse cases, threat modeling, and DevSecOps
Why a flaw caught in the design phase costs a fraction of one found in a pen test
Need web app pen testing? Visit https://securit360.com
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

We’re halfway through the OWASP Top 10, and this one is a favorite. Brad Causey is joined by Jordan Natter, SecurIT360’s resident web app pen tester, to cover A05: Injection. They explain how injection flaws work, why it slipped two spots on the list but is no less dangerous, and what developers can do to shut it down.
Along the way, they share real stories from the field. There’s a first-ever pen test that turned a blood drive gift card app into $25,000 in gift cards and a destroyed production database. There’s a harmless-looking hub status dropdown that became a reverse shell. And there’s a username field that handed over session cookies.
In this episode:
What injection is and why it can happen anywhere from the browser to the data layer
Reflected, stored, and DOM-based cross-site scripting, and how they differ
SQL, NoSQL, LDAP, and why no data layer is immune to injection
Why injection moving to #5 doesn’t make it a lower priority
How CSP, HttpOnly cookies, CSRF tokens, and SameSite attributes break attack chains
Why client-side validation is a usability feature, not a security control
Whitelisting vs. blacklisting, parameterized queries, and output encoding
The case for never testing in production, and backing up your staging data too
Resources mentioned: OWASP Input Validation Cheat Sheet and the OWASP Cheat Sheet Series
Need a web app pen test or have questions about application security? Reach out to the SecurIT360 team.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

It’s Cybersecurity Awareness Month, so we’re bringing back one of the most practical episodes in our catalog. Strong passwords are one of the basics of good security, but weak and reused credentials are still a common way attackers get in.
In this episode, Brad and Spencer look at why weak passwords keep showing up in real-world compromises. They cover the habits and identity management gaps that cause them and what organizations can do to close those gaps.
In this episode:
Why weak passwords are still a painfully persistent problem
How poor password habits and identity gaps expose organizations to compromise
Common mistakes attackers take advantage of
Practical defensive measures you can put in place
Originally released November 2024.
Sources:
Verizon 2023 Data Breach Investigations Report: https://www.verizon.com/about/news/2023-data-breach-investigations-report
1Password, Challenges of Shadow IT: https://blog.1password.com/challenges-of-shadow-it/
Microsoft Digital Defense Report 2024: https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024
Links:
Work with us: https://securit360.com
Blog: https://offsec.blog/
YouTube: https://www.youtube.com/@cyberthreatpov
X/Twitter: https://x.com/cyberthreatpov
Spencer Alessi: https://spenceralessi.co
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

Users will get compromised. Someone will click the link, and credentials will get stolen. The question that really matters is what happens next.
In this episode, Spencer and Brad walk through the Post-Compromise Risk Framework (PRID), a simple, repeatable way for IT and security teams to judge how exposed their environment is once an attacker gets in. Using a real-world-style ClickFix scenario involving "Susie in accounting," they trace how one compromised account can lead to lateral movement, credential dumping and sensitive data exposure. They also cover why so many of those steps go undetected.
In this episode:
Why the assume breach mindset is the best way to measure your security
Privileges: what can a compromised user actually do?
Reach: where can they go with that access?
Impact: how bad would it be?
Detection: would you even know it happened?
How least privilege and network segmentation map to each step
Why PS Remoting to a domain controller goes undetected nine times out of 10
Why "that couldn't happen here" is not proof, and how to verify your controls
"Inspect what you expect": testing your EDR instead of trusting it
Pick a user, assume they're compromised, and walk the path. You'll learn more about your environment, and you'll likely find issues you didn't know were there.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com

One threat actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, using AI to run the same playbook at scale. The fastest path to domain admin took five minutes. But out of hundreds of organizations hit, the attacker only got domain admin at 12 of them.
Spencer and Tyler use GreyNoise's recent PaperCut report to make the case that the basics matter more now than they ever have. The attack itself was not novel. It used a known vulnerability, a lab environment built to test exploits, an internet scanning service, and familiar offensive tools. AI (Codex and DeepSeek) is what took it from one target to hundreds.
In this episode:
How the attacker built a PaperCut and Active Directory lab to test exploits before going wide
Why five minutes to domain admin is fast but not unheard of, and how certificate abuse makes it possible
The Conti playbook comparison, and how LLMs are turning attack playbooks into automated campaigns
The toolkit: Certify, Rubeus, SpoolSample, Impacket, NetExec, BloodHound, Mimikatz, and AMSI bypasses
Why letting hosts reach GitHub directly is a red flag, and how DNS and category filtering slow attackers down
The one case where Cloudflare's WAF stopped the attack
Why the 12 domain admin compromises are a hopeful sign that hardening works
Where to start with AD hardening: tier zero permissions, dangerous rights on broad groups, service accounts, and certificate templates
Moving past EDR alone with application control, NDR, and identity-based detections
Comparing what a security tool costs to what a compromise costs
Spencer and Tyler are penetration testers at SecurIT360.
If you get something out of the show, subscribe and leave a rating or review. It helps more than you would think.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com