The Cyber Threat Perspective

Need a pentest or vCISO? Work with us! https://www.securit360.com/

A major leadership failure in Cybersecurity is l buying tools first then figuring out where they fit and how to use them. That’s super backwards. Here’s what I would do instead. Plan first, buy & implement second. I’m going to cover just the planning part this week. Next week we will talk about buying and implementing. Because honestly, implementation is where a lot of security teams go wrong. 
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

In this episode Spencer and Tyler discuss real life Active Directory attack paths, taken from real internal pentest engagements over the last several years.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

Some of the most dangerous security gaps aren't sophisticated — they're the ones hiding in plain sight.
In this replay, Brad and Spencer break down the biggest blind spots they see over and over in mid-size companies: poor asset inventory, flat networks, flat identities, overconfidence in security tools, credential reuse, and the emerging risks with AI.
If any of these hit home, go to our website, fill out the form, and see if we're a fit for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

AI agents can search the web, manipulate files, run commands, make API requests, access cloud platforms, and operate fully autonomously. They are powerful, they are here, and most organizations have no security controls around them whatsoever.
In this episode, Brad and Spencer break down the five major AI agent risk categories security teams need to understand right now, using Simon Willison's "lethal trifecta" as a framework and building on it with two additional risk areas they see in the field.
In this episode:
- What an AI agent actually is and why the definition matters before you can secure it
 - What AI agents are capable of: files, commands, APIs, memory, cloud access, and autonomous execution
 - The lethal trifecta: access to private data, exposure to untrusted content, and external communication
 - Risk category 1: Access to private data - why agents inherit your permissions and why that is dangerous
 - Risk category 2: Exposure to untrusted content and prompt injection attacks
 - Risk category 3: External communication and data exfiltration (including a real canary token experiment)
 - Risk category 4: Privileged access and limiting blast radius with least privilege identities
 - Risk category 5: Autonomous actions, approval gates, rate limits, and kill switches
 - Why backups, rollback plans, and recovery playbooks are more important than ever in an AI agent world
Resources mentioned:
- Simon Willison's lethal trifecta post (June 2025): https://simonwillison.net
- Zach Korman's ContinuumCon sandbox escape workshop: https://continuumcon.com/schedule/
- offsec.blog | securit360.com
Need a pen test before end of year? Q3 slots are filling up fast. 
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.

Think Active Directory is dead? Think again. According to Microsoft data, 86% of organizational workloads still touch Active Directory, and nearly 20% of organizations don't expect to reach a hybrid state for 10-20+ years. In this episode, Brad and Spencer break down why AD attack paths remain one of the most critical threats in enterprise environments and what defenders can do about it right now.

Spencer also previews his ContinuumCon workshop "Killing AD Attack Paths Once and For All" where he demonstrates how authentication policies and silos can eliminate an entire class of lateral movement attacks built into Windows and Active Directory.

In this episode:

- Why Active Directory is still alive, well, and heavily targeted
- What an Active Directory attack path is and how attackers use them
- The four prerequisites attackers need to abuse AD attack paths
- Real-world examples: Kerberos ticket theft, SCCM abuse, certificate misconfigurations, and misconfigured permissions
- Tools defenders should know: Bloodhound, PingCastle, Purple Knight, Locksmith, and ADelegator
- How to prioritize remediations based on ease of exploitation vs. impact
- Why retesting is the most overlooked step in any remediation cycle

Resources mentioned:

- Spencer's ContinuumCon Workshop (Fri. June 12, 10:30am PT / 1:30pm ET): https://continuumcon.com/schedule/
- Hybrid Identity Protection Podcast (Semperis): https://www.semperis.com/hybrid-identity-protection-podcast/
- Bloodhound CE: https://github.com/SpecterOps/BloodHound
- PingCastle: https://www.pingcastle.com
- Purple Knight: https://www.purple-knight.com
- Locksmith: https://github.com/TrimarcJake/Locksmith
- offsec.blog | securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.