Welcome back to the show! Hacker Valley Studio podcast features Host Ron Eddings, as he explores the world of cybersecurity through the eyes of professionals in the industry. We cover everything from inspirational real-life stories in tech, to highlighting influential cybersecurity companies, and we do so in a fun and enthusiastic way. We’re making cybersecurity accessible, creating a whole new form of entertainment: cybertainment.
Episodes
2 hours ago
2 hours ago
34 min
Your dashboard says your detections are deployed. But are they still detecting? A quiet SOC can mean your defenses are working, or that the data feeding them has disappeared. In this episode, Ron Eddings sits down with Tom Findling, Co-Founder and CEO of Conifers AI, and Robert Pace, VP of Information Security and CISO at Invitation Homes, to confront the blind spots hiding behind green dashboards.
Tom unpacks findings from Conifers AI’s research, The Detection Blind Spot, which examined approximately 15,000 detections and found that 47% needed attention. He describes how telemetry gaps, shifting environments, and detection drift can leave teams believing they are protected when the underlying controls are no longer operational. One striking example: an attacker gradually reduced log-reporting servers from roughly 10,000 to just 10 without stopping logging altogether.
Robert challenges security leaders to move past red-yellow-green reporting and the habit of focusing only on critical and high-severity findings. Together, they explore continuous detection validation, AI-assisted tuning and runbook maintenance, the value of understanding the business, and why humans must remain accountable as agentic SOC tools take on more work. They also look ahead to the rise of the “threat operator,” a security practitioner able to connect intelligence, detection, investigation, and response.
Impactful Moments
00:00 - Introduction
01:53 - The Detection Myth
03:02 - Silence Is Not a Signal
03:24 - Meet Tom & Robert
6:33 - The 47% Blind Spot
08:10 - A CISO Gets Vulnerable
10:13 - The 10,000-to-10 Attack
13:06 - AI for Continuous Checking
16:09 - Cutting 70% of SOC Alerts
17:28 - Learning the Business
21:36 - CISO-Vendor Relationships
23:21 - Four Criteria for New Tech
25:46 - The "Sorry" Moment
27:24 - The Future: Threat Operator
29:03 - Who Gets the Raise
30:47 - What's Watching the AI?
31:28 - Homework Assignment for Viewers
Links
Connect with our guest, Tom Findling, on LinkedIn: https://www.linkedin.com/in/tomfindling/
Learn more about Conifers AI: https://conifers.ai
Connect with our guest, Robert Pace, on LinkedIn: https://www.linkedin.com/in/robert-pace097/
-----
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
7 days ago
7 days ago
25 min
What would make a government switch off its own websites on purpose? And how does a flaw in the software behind most of the web stay hidden for 14 years? In this solo episode, Ron opens the case file on Black October, the month PHP2Shell pushed governments, hospitals, and banks offline around the world.
Ron starts with a rewind to Heartbleed in 2014 and the “change your password” scramble that followed. Then he explains what PHP2Shell is, why AI was the key to finding it, and how three separate teams found the same secret within seven weeks. He also walks through the timeline that doesn’t add up, including someone exploiting the flaw four days before anyone was warned.
Then he zooms out to the rest of the month, from supermarket freezers in France turning into ovens to a $6 billion crypto heist that may have started with one engineer’s laptop. Ron closes with three habits that protect you even if you’ve never written a line of code: one password per site, multi-factor authentication, and keeping your devices updated.
Impactful Moments
00:00 - Introduction
01:23 - Rewinding to Heartbleed in 2014
04:11 - Chapter 1: The Day The Lights Went Out
05:43 - Why going dark was the smart move
06:44 - Chapter 2: What Scared Them
07:55 - How AI chained the exploit together
08:24 - A 14-year-old door hiding in plain sight
08:36 - Chapter 3: The Four-Day Mystery
09:59 - Three teams, one secret, seven weeks
12:02 - Ron’s hot take on who knocked first
13:59 - Chapter 4: Black October
14:25 - Freezers turned ovens and a $6B heist
17:44 - Chapter 5: What This Means For You
19:25 - Three habits that actually protect you
22:24 - From years to weeks to days
Links
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
Oct 26, 2026
Oct 26, 2026
45 min
If someone wiped your cloud environment tomorrow, how long until you’re back in business? Not what the plan says. What would actually happen? Ron sits down with Jake Bernardes, CISO at Gambit Security, who got his first CISO job by sneaking into a company’s office and sitting in the CEO’s chair. He has since run security for tech companies and early-stage security vendors, and he hosts the Random Access Memories podcast.
Jake shares the social engineering tricks that got him past security guards. He also explains why voice phishing now takes almost no effort. Then he walks through Gambit’s research on an AI-run attack that cost about $25 per target and needed fewer than ten non-technical prompts. Along the way, he takes on phishing simulations, AI guardrails and cyber insurance.
Then comes recovery, the part of security Jake says is still broken. His take: tabletop exercises are “Dungeons & Dragons for executives.” Instead, figure out your minimum viable business, the systems you can’t live without, and prove you can bring them back. Ron closes by tying it to the grocery chain outage that hit his family’s workplace.
Impactful Moments
00:00 - Introduction
03:20 - Busting the myth: the cloud has your back
05:45 - Seven minutes of agentic ransomware
10:35 - Breaking into a CEO’s office for a CISO job
12:15 - Paying strangers to get past security guards
15:25 - People don’t hack in, they log in
18:55 - The ASOS incident and the short-stock theory
20:00 - Too much exposed to the public internet
23:05 - Anatomy of a $25 AI attack
27:10 - Translating the attacker’s Chinese prompt
29:40 - Can CISOs rely on AI guardrails?
32:25 - Why cyber insurance is a tick box
35:30 - Minimum viable business for 2027
38:25 - Ron digs into the Giant Food outage
Links
Connect with Jake Bernardes on LinkedIn: https://www.linkedin.com/in/jakeleobernardes/
–
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
Oct 14, 2026
Oct 14, 2026
22 min
What would you do if your phone rang and the caller ID showed your own company? Would you pick up? Would you help the person on the other end?
This Cybersecurity Awareness Month, Ron goes solo to break down a breach that started with that exact call. Attackers spoofed Astrana Health’s main corporate phone number, posed as coworkers, and talked their way into systems connected to roughly 1.5 million patients. Ron starts with a rewind from phone books to data brokers, including a live search on a people-search site that turned up his own family. From there he walks through the SEC filing, sends a swarm of AI research agents after the public record, and lines up the suspects behind the attack.
The uncomfortable part is that we spent a decade training people to spot a bad email while attackers moved to the phone. Voice phishing is now the second most common way attackers get in, and resetting credentials doesn’t fix the instinct to help when a familiar number calls. Ron closes with three practical ways to stop making it easy for them, starting with one simple habit: hang up and call back.
Impactful Moments
00:00 - Introduction
02:25 - The rewind: from phone books to data brokers
03:15 - What a people-search site found on Ron’s family
05:30 - A breach that started with a phone call
06:15 - Inside Astrana Health’s SEC filing
07:55 - Why spoofing the main number changes everything
09:05 - How the attack likely played out
11:35 - Technical fixes for a human attack
12:50 - The time Ron got got
13:35 - Why attackers want healthcare data
15:15 - 1.5 million patients’ worth of exposure
17:15 - Voice phishing climbs to #2 in M-Trends
19:35 - Three ways not to make it easy for them
21:05 - How to run a phone drill
Links
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
Oct 7, 2026
Oct 7, 2026
36 min
What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them.
Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt.
The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.
Impactful Moments
00:00 - Introduction
02:15 - Busting the vibe coding myth
04:40 - Inside Orca's State of AI report
05:55 - The unpatched AI SDK problem
07:40 - What is AppGen?
10:20 - Who builds the backend?
12:25 - Inside Orca's AppGen hackathon
14:10 - Thinking like a citizen developer
15:15 - Who's really building these apps
19:25 - One misconfigured app, every integration exposed
20:45 - Why Supabase is the holy grail
23:00 - Checking your own exposure
24:30 - Why the SDLC is breaking down
26:55 - Prompting for a secure app
28:15 - Don't hand the agent every decision
31:20 - Staying sharp by never stopping learning
33:35 - From protecting environments to protecting apps
Links
Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/
Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/
Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part
Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party
–
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/