Free Daily Podcast Summary
Threat Talks - Your Gateway to Cybersecurity Insights: Daily Summaries Delivered
by Threat Talks
Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 4 days ago14 min
Why Can Your Printer Talk to Your Domain Controller?
No patch, no defense. That's how most teams think about zero-days.So what decided how far an AI agent got inside the Dutch Institute for Vulnerability Disclosure (DIVD)?It came in through two unknown flaws in the DIVD's ticketing system, leaving notes in its own code as it went. Some data got out. Then it hit walls, because the ticketing system had never been allowed to reach the rest of the network.Rob Maas, Field CTO at ON2IT, and Gabriel Reis, ON2IT SOC analyst and DIVD volunteer, go through the first three days, including why the DIVD went public before it had the full story.You can't patch what nobody knows about. You can decide today what your "boring" systems are allowed to reach. - When the hackers got hacked - What the DIVD does - The first three days: contain, investigate, go public - An AI agent in the ticketing system - Two zero-days and why segmentation limited the damage - Transparency as a defense - What to do next Monday Key topics covered:Public breach disclosure: timing, legal pressure and credibilityAn AI-driven attack that left notes behind, and one defender's prompt-injection countermeasureLimiting how far a zero-day reaches with network segmentationAssume breach as both a technical and a communication principleMapping systems and transaction flows before an incident forces you toRelated ON2IT content & referenced resources:DIVD: https://www.divd.nl/DIVD, We got hacked, here's everything we know: https://www.divd.nl/hacked/DIVD CSIRT case DIVD-2026-00014: https://csirt.divd.nl/cases/DIVD-2026-00014/DIVD CSIRT case DIVD-2026-00015 (Zammad zero-days): https://csirt.divd.nl/cases/DIVD-2026-00015/CVE-2026-102489: https://www.cve.org/CVERecord?id=CVE-2026-102489CVE-2026-102490: https://www.cve.org/CVERecord?id=CVE-2026-102490ON2IT (Zero Trust as a Service): https://on2it.net/Threat Talks: https://threat-talks.com/AMS-IX: https://www.ams-ix.net/amsSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- 1 weeks ago31 min
How to Prove to Your Board That Zero Trust Is Working
Your board wants to know one thing: are we safer than last year? Alert counts can't answer that. Twice as many events can mean twice as many attacks, or a sensor that finally works. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, asks Rob Maas, Field CTO at ON2IT, what to report instead: one score from one to five that shows whether the business is aligned behind Zero Trust and whether the controls are really in place. Black-and-white criteria, so nobody can polish the number before the board meeting. - The one metric worth reporting to your board - The worst metric in security: counting events - Why minutes to detect is already too late - Readiness and fitness: measuring Zero Trust properly - Local heroes vs. all talk: why programs stall - A score nobody can fudge: binary criteria and 32 controls - Do you need level five? Why most organizations aim for three Key Topics Covered:What to report to the board instead of alert volume and mean time to detectWhy Zero Trust programs stall on alignment between the board, the CISO and IT, not on technologyHow to tell if your program depends on a few people who could leave tomorrowA one-to-five maturity score built on true-or-false criteria, based on CMMIWhich level your organization needs, and when aiming higher is worth the budgetRelated ON2IT Content & Referenced Resources: ON2IT (Zero Trust as a Service): https://on2it.net/ON2IT BLOG: https://on2it.net/blog/zero-trust-maturity-score/ Threat Talks website: https://threat-talks.com/MITRE ATT&CK framework: https://attack.mitre.org/Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- 2 weeks ago16 min
Citrix NetScaler Zero-Day: Three Weeks Without a Patch
Citrix left customers exposed to two live zero-days for three and a half weeks. Rob Maas sits down with ON2IT CTI specialist Lars Nobelen to break down how attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler appliances, why a single log injection bug let them run arbitrary commands, and what actually stopped the attacks before the patch ever arrived. - Cold open: three and a half weeks without a patch - Meet CTI specialist Lars Nobelen - Exploitation timeline: fingerprinting in August to the patch in September - Two zero-days: how the log injection technique worked - Gaining persistence with disguised web shells - Why SSL inspection blocked the exploit before the patch existed - Advice: rebuild, patch, and prepare for the next edge device Key Topics CoveredAnatomy of the two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) and the log injection technique behind themWhy exploitation outpaced the patch timeline by over three weeks, and what that gap cost defendersHow SSL/TLS inspection on the firewall blocked exploitation attempts before a patch was availableWhy Citrix's own indicator-of-compromise script could miss an active web shellLessons for any edge device: disabling unused features, network segmentation, and inbound decryptionRelated ON2IT Content & Referenced ResourcesThreat Talks – Citrix NetScaler: Does Remote Work (2024): https://threat-talks.com/citrix-netscaler-zero-day-three-weeks-without-a-patch/ CVE-2026-88771: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlCVE-2026-88772: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlWhy SSL Decryption Matters: https://www.youtube.com/watch?v=Xv_jVHVsD9w NCSC.nl advisory on Citrix NetScaler: https://advisories.ncsc.nl/2026/ncsc-2026-0394.htmlZ-CERT (Dutch healthcare sector) advisory: https://z-cert.nl/actueel/nieuws/z-cert-waarschuwt-zorgsector-voor-kritieke-citrix-kwetsbaarhedenSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- 3 weeks ago30 min
Stolen iPhone, Tracked Live, Thief Caught
Fifteen minutes after Lars Nobelen's iPhone was stolen at a scrapyard, it was already useless to the men holding it. An hour after that, police had all three of them in custody. Lieuwe Jan Koning talks with Lars Nobelen, ON2IT's Information Security Officer, and Robbert van der Linden, Site Reliability Engineer, about the mobile device management commands that turned a stolen phone into the evidence that caught its own thief.Key Topics CoveredHow mobile device management (MDM) locks and tracks a stolen iPhone through Apple's Lost ModeWhy police can act on a stationary phone location but not a moving oneThe distraction technique three thieves used to steal a phone in secondsZero-touch enrollment: how ON2IT devices join MDM automatically before an employee opens the boxThe MFA "chicken and egg" problem when your authenticator lives on the phone that just got stolenRelated ON2IT Content & Referenced Resources:ON2IT (Zero Trust as a Service): https://on2it.net/ Threat Talks website: https://threat-talks.com/ Episode code for a free Threat Talks T-shirt (email to code@threat-talks.com): 100125Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- Oct 13, 202632 min
When to call the Police when you're hacked
Do first you call the police when you're hacked, or a lawyer?In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Stan Duijf, Head of Operations at the NIS (National Investigations Special Operations) of the Dutch National Police, to break down what actually happens after a data breach. Stan reveals that only 20% of the 150+ reported Dutch data breaches each year ever reach the police, and explains why that gap puts both companies and their customers at risk.They cover when a breach is serious enough to call the police, why paying a ransom never makes your data safe again, and what belongs in your incident response playbook before you ever need it. - Cold open: when do you call the police after a hack - Meet Stan Duijf, Head of Operations at the NIS - The real scale of data breaches in the Netherlands - Intrusion vs exfiltration: when the police actually opens a case - Why informing victims late leaves them exposed to scams - Should you ever pay the ransom - Build your playbook: who to call before you're hacked 4. Key Topics CoveredWhen a data breach is serious enough to involve the Dutch police, and why company size is not the deciding factor.What early, confidential police involvement makes possible, from tracing stolen bitcoin to joining ransom negotiations.The three reasons the Dutch police advise never to pay a ransom.Why informing breach victims late exposes them to scams, and what to decide in your breach playbook in advance.How jurisdiction works for multinational breaches, and how private citizens should report sophisticated phishing.5. Related ON2IT Content & Referenced ResourcesThreat Talks – Previous episode with Stan Duijf on the NIS and high-tech crime: https://youtu.be/KL39OfLoDcYON2IT (Zero Trust as a Service): https://on2it.net/Threat Talks website: https://threat-talks.com/6. Subscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- Oct 6, 202633 min
Will The Police Ever Catch Your Attacker?
You report a breach. Does anyone ever get arrested?Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still happen, often the moment a suspect travels.You leave knowing why arrests are the wrong metric, what threat intel the police want from your security team, and how AI is speeding up both sides of the fight.Timestamps - Who is really on the other side of a breach - Why one cybercrime case spans 5 to 20 countries - Inside Operation Endgame: the recurring takedown campaign - The Dutch specialty: technical skill and the broad intervention strategy - Takedowns, seized servers, and 35 million euros in crypto - AI is making cybercrime faster, and investigations too - What companies can do: sharing threat intel and joint takedowns Key Topics CoveredWhy a single cybercrime investigation spans 5 to 20 countries, and what that does to response timeOperation Endgame: a recurring, campaign-level takedown strategy against info stealers and botnetsThe broad intervention strategy: prevention, disruption, and repression, with arrests as one tool among manyHow crypto seizures work and why they matter more than the arrest countWhat threat intel the police want, and what integrated operations with companies like Microsoft, Palo Alto Networks, and Google look likeRelated ON2IT Content & Referenced ResourcesThreat Talks: https://threat-talks.com/ ON2IT Zero Trust MDR Prevent: https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams Operation Endgame: https://www.operation-endgame.com/ Hack_Shield / Hack_Ride, Dutch police youth offender-prevention programs: https://www.politie.nl/nieuws/2026/maart/4/11-politie-en-hackshield-werken-aan-digitale-weerbaarheid-van-kinderen.htmlSubscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- Sep 29, 202616 min
MDR Has To Stop Mopping The Floor
A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR.The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached.So what did the M in MDR actually buy him?Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay Area security scene, to separate what MDR vendors pitch from what MDR delivers.Buyers think MDR is one product. It is five jobs: collect the logs, enrich them, put an experienced human in the loop, remediate, and keep it all retrievable. Most vendors do two of them well, and only inside their own stack. Three questions tell you which two. All three are in the episode, and in the description below.Timestamps - The MDR reality check: expectation versus practice - What buyers think they are buying - Single pane of glass, and why nobody has one - Why no vendor is paid to support a competitor's logs - Log retention: when everything becomes hot storage - Three questions to ask every MDR provider - Data sovereignty: who operationally controls your logs - The future of MDR, and why detection alone is cleanup - The CISO who saw everything and still got breached The three questionsIn practice, what does your platform do with a log it did not create? Ask for the demo on a competitor's telemetry, not your own.Is there tiered storage, or does every log stay hot for the life of the contract?When I escalate, who picks up: someone who knows my environment, or someone reading an LLM's answer back to me?Key topics coveredWhat "managed" means to different MDR vendors, and why a human in the loop is rarely part of the dealWhy EDR, NDR, XDR and DDR all get reskinned as MDR, and what that does to scopeThe economics of vendor data lakes: every log priced as hot storage, with no tiering to warm or coldCommercial incentives that keep cross-vendor log support shallow, and how to test for it before you buyData sovereignty and jurisdiction as a procurement requirement, not a European footnoteRelated ON2IT Content & Referenced Resources:Threat Talks: https://threat-talks.com/ ON2IT Zero Trust as a Service: https://on2it.net/ AMS-IX: https://www.ams-ix.net/amsSubscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX
- Sep 22, 202619 min
Lapsus$:Teenagers Hacked Microsoft.
A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset.Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end.The uncomfortable part is not how clever the attack was. It is how basic it was. If your help desk resets passwords without proof of identity, if your MFA is a tap-to-approve prompt, if your users carry permissions from two jobs ago, Lapsus$ did not need to be good. They only needed to try.Yuri and Rob also cover what actually stops this: password resets that require physical identification, hardware tokens for sensitive Protect Surfaces, privileged access management with a human in the loop, and why AI is both the fastest way to audit your permissions and the fastest way to recreate the same over-permissioning problem all over again.Timestamps00:00:00 Hacking the largest companies on earth is super easy 00:01:19 Who Lapsus$ were, and why they are in jail 00:02:25 Step one: bought credentials and a phone call to the service desk 00:03:36 Password resets should be a hurdle, not a link 00:06:16 Not all MFA is equal: push fatigue, SMS and SIM swapping 00:09:03 Why your second factor does not belong in your password manager 00:11:09 Inside the network: privilege escalation, exfiltration, extortion 00:13:29 The fix: least privilege, PAM and a human in the loop 00:16:05 AI as auditor, and the agentic over-permissioning problemKey Topics CoveredHow Lapsus$ obtained initial access without a single novel technique: dark web credentials and social engineering of the help deskWhy MFA type matters more than MFA presence, and where push approval, SMS and TOTP each breakPrivilege escalation as the real bottleneck for attackers, and what least privilege plus PAM changesZero Trust Protect Surface thinking as the way to decide which control is appropriate for which dataThe AI double edge: faster permission audits on one side, over-permissioned agent service accounts on the other
Get Threat Talks - Your Gateway to Cybersecurity Insights summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
Security Now (Video)
A weekly deep dive into cybersecurity news, threats, and defenses with Steve Gibson and Leo Laporte.
Security Now (Audio)
A weekly deep dive into cybersecurity news, hacking trends, and digital defense strategies for professionals and individuals.
The Watchtower
Cybersecurity, data, and AI leaders share candid insights on real-world challenges and innovations beyond the headlines.
The Low Down
A podcast about hacking.
Ahead of the Threat: The FBI Cyber Podcast
FBI officials and experts discuss emerging cyber threats and cybersecurity fundamentals with government and industry guests.
Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure
Expert discussions on cybersecurity, national security, and threats to critical infrastructure like energy and water systems.
Plaintext with Rich
Explains cybersecurity topics in simple terms to help listeners stay safer online.
Hacker And The Fed
A former FBI agent and a reformed hacker analyze cybersecurity threats and cybercrime investigations from opposing but informed viewpoints.
Risky Bulletin
Cybersecurity news updates from the Risky Business team.
Smashing Security
Weekly episodes explore cybercrime, hacking, privacy failures, and tech disasters with insight and humor.
Random Access Memories
Conversations with tech professionals reveal the personal stories behind their careers in cybersecurity, AI, startups, and leadership.
Hacked
Stories of hacking, tech scams, and digital mysteries explored by two hosts diving into how systems are built and broken.
About Threat Talks - Your Gateway to Cybersecurity Insights
Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Threat Talks - Your Gateway to Cybersecurity Insights in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Threat Talks - Your Gateway to Cybersecurity Insights daily summary?
It's a free AI-powered email that summarizes new episodes of Threat Talks - Your Gateway to Cybersecurity Insights as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Threat Talks - Your Gateway to Cybersecurity Insights podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Threat Talks - Your Gateway to Cybersecurity Insights product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Threat Talks.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does Threat Talks - Your Gateway to Cybersecurity Insights release new episodes?
Threat Talks - Your Gateway to Cybersecurity Insights publishes weekly. Our AI generates a summary within hours of each new episode.
What topics does Threat Talks - Your Gateway to Cybersecurity Insights cover?
Threat Talks - Your Gateway to Cybersecurity Insights covers topics including News, Business, Management. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Threat Talks - Your Gateway to Cybersecurity Insights summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.