UnHack with Drex DeFord

May 15, 2026: Big news from Drex DeFord, starting May 15th, UnHack the Podcast and the Two-Minute Drill are moving to the 229 Project Podcast Channel. Same show, same mission, same Drex — just one unified home alongside Bill Russell and Sarah Richardson. The reason is simple: the This Week Health community was spread too thin across too many channels, making great content harder to find. Now every...

North Korean threat actors didn't breach a firewall. They built a fake company. UNC1069 spent two weeks constructing a convincing Slack workspace, fake team members, and LinkedIn profiles to earn the trust of Jason Seaman -- lead maintainer of Axios, a JavaScript library downloaded over 100 million times a week. One Teams call. One file. Within hours, malicious code was live and reaching health sy...

May 5, 2026: What happens when attackers don't just break into your systems, they become you? Josh Howell , Healthcare CTO at Rubrik , joins Drex DeFord to unpack Rubrik's newly announced partnership with the American Hospital Association, a rigorous vetting process that signals a new standard in cyber risk validation. Josh draws on hundreds of ransomware recovery experiences to challenge how heal...

May 4, 2026: Lisbeth Votruba , Chief Clinical Officer at AvaSure , joins Bill Russell and Drex DeFord on Newsday to celebrate Nurses Week with a fascinating look at where nursing has been, and where it's going. From Florence's data-driven legacy to today's AI-powered virtual care, Lisbeth shares why nursing turnover is declining, why certification rates are rising, and why she sees technology not...

From crippling outages to AI-powered deepfakes, 2025 tested healthcare cybersecurity like never before. This year-end recap explores the moments that mattered most: how teams built resilience during system failures, why users became partners instead of "weak links," how identity became the new perimeter, and what it means when you can't trust your own eyes. Through powerful stories from the front...

Matthew Lane was 14 when he started probing the edges of online gaming systems. By 20, he had walked out of PowerSchool with data on nearly 70 million students and teachers using nothing but a contractor's stolen credentials he found on the dark web. Drex tells the full story and then lands the part that matters most for healthcare: Lane didn't exploit a sophisticated vulnerability. He used a user...

April 28, 2026: When a hospital goes dark, the first 72 hours are everything. Laurie Campbell , Senior Manager of Clinical Ancillary Applications and Enterprise Imaging, and Rick McIntosh, VP and the Chief Technology Officer, at Children’s Hospital Colorado , break down the phased Code Dark response framework her team developed for ransomware attacks. They walk through real examples: how the suppl...

April 27, 2026: Drex DeFord and Bill Russell are back on Newsday, and fresh off the 229 Summit, they're not pulling punches. Healthcare IT has a demand problem. Too many projects, not enough capacity, and an industry that's chronically bad at saying no. From the 229 Summit's sharpest takeaways to the Salesforce headless CRM announcement, the vl.js hack, and why Bill thinks Claude Code's "genesis k...

While the industry debates frontier AI models and nation-state threats, hospitals are still getting hit by ransomware through the same doors they've always left open. Drex zooms out to what's actually happening on the ground: massive patch cycles creating downstream operational pressure, countries reconsidering their software dependencies, and CISOs quietly doubling down on fundamentals. MFA, iden...

April 20, 2026: What happens when you layer AI onto broken processes without fixing them first? Angel Mena , MD, CMO of Symplr , joins Bill Russell, Drex DeFord, and Sarah Richardson on Newsday to answer that question with the kind of clinical candor only a practicing physician can bring. From ambient documentation to quality metrics to the credentialing chaos hiding inside every health system, th...

The Kim Wolf botnet was the most powerful ever built — 2 million compromised IoT devices, a record-breaking 31.4 terabit DDoS attack, and it had the FBI, Google, and Cloudflare stumped. Drex breaks down how those cheap, forgotten devices in patient waiting rooms and break rooms became weapons inside hospital networks, and why 25% of Infoblox's enterprise healthcare clients were already compromised...

April 13, 2026: Jacob Hansen , Chief Product and Technology Officer at AvaSure , joins Bill, Drex, and Sarah on Newsday for a conversation about the data governance battles quietly reshaping AI. From who owns AI model improvements derived from a health system's environment to whether EHRs should have control over how that data is used, Jacob pulls no punches. The conversation also tackles the evol...

The window between vulnerability discovery and exploitation has collapsed — from 63 days in 2018 to negative. Now AI is changing the game entirely. Drex walks through how Anthropic's unreleased model Mythos autonomously found a critical zero-day in the Ghost CMS, wrote its own exploit, and extracted sensitive credentials in under two hours — all without a CVE ever existing. Add in two accidental A...

April 8, 2026: Frank Duff , Chief Innovation Officer at Tidal Cyber , and one of the original architects of the Mitre ATT&CK framework, joins Drex DeFord on UnHack to expose an uncomfortable truth: most organizations are sitting on powerful security tools they've never fully turned on. Drawing from 18 years at Mitre and deep experience running ATT&CK evaluations, Frank explains how Tidal C...

April 6, 2026: The rules of warfare have changed, and health systems are caught in the middle. On this episode of Newsday, Sarah Richardson and Drex DeFord break down two stories that should be on every healthcare leader's radar: the IRGC's declaration that major tech companies are now legitimate combatants, and what the Stryker attack reveals about the fragility of the healthcare supply chain. Fr...

April 1, 2026: James Winebrenner , CEO of Elisity , joins Drex DeFord to unpack one of healthcare cybersecurity's most persistent challenges, the sprawling, unseen attack surface hiding inside hospital networks. From unmanaged clinical devices to IoT systems running alongside regulated medical equipment, James breaks down how Elisity helps health systems move from visibility to control without re-...

Drex makes the case for a role that doesn't exist yet but probably should: VP of Non-Human Resources. As AI agents multiply across health system environments, often deployed by vendors without oversight, the management infrastructure simply isn't keeping up. Agents have access, make judgment calls, and operate inside frameworks that affect patients and business operations, yet most have no job des...

March 30, 2026: Bill Russell and Drex DeFord dig into three of the biggest stories shaping healthcare IT right now. From the seismic Sutter Health and Allina Health merger, the Stryker cyberattack carried out by an Iranian-linked group Handala, and the sobering reality that threat actors like Tycoon 2FA are back online within 15 days of being taken down, this episode covers the frontlines of healt...

Drex revisits the FBI and DOJ takedown of HANDALA, the Iranian-backed hacking group behind the Stryker wiper attack—and surfaces an uncomfortable lesson. Within 24 hours, the group was back online with new domains, same operations, same message. That's not a footnote. That's a case study in resilience. While healthcare organizations ask "how do we prevent this from happening," adversaries are aski...

March 27: 2026: Live from HIMSS 2026, Drex DeFord sits down with Eli Tarlow , Director of Industry Strategists at CDW , for a candid conversation about the state of AI in healthcare. Eli breaks down the evolution from AI curiosity to AI accountability, where gut feelings have been replaced by hard business plans, measurable ROI, and a closing-the-loop mentality that puts operational leaders on the...

 March 25, 2026: Gerry Miller , Founder and CEO of Cloudticity , has spent 15 years helping healthcare organizations harness the cloud securely. In this live conversation at HIMSS 2026, Gerry breaks down why health systems are accelerating their move to the cloud and how multi-cloud strategies are shifting from redundancy plays to service optimization. Key Points: 02:33 Multi Cloud Strategy 0...

March 24, 2026: Steven Ramirez , VP, CTO and CISO at Renown Health , joins Drex DeFord to pull back the curtain on how a mid-large health system keeps security at the center of everything — without becoming the department of no. From board-level briefings and identity-first defenses to a Databricks cloud buildout and a governance framework that puts security review on every DocuSign, Steven breaks...

Drex unpacks a signal hiding across several recent stories: we may be deploying AI well ahead of our ability to secure it. From an autonomous AI agent that breached a consulting firm's internal chatbot in two hours, gaining access to 46 million employee messages, to a multi-agent experiment where AI systems escalated privileges, forged credentials, and disabled antivirus software entirely on their...

March 23, 2026: Bill Russell, Drex DeFord, and Sarah Richardson are back with a packed Newsday covering three big conversations: the AI security crisis no one is talking loudly enough about, what HIMSS 2026 actually delivered for healthcare leaders, and the real question facing every CIO and CMIO right now: Is your time worth attending two major conferences each spring?  Key Points: 01:03 AI...

 March 20, 2026: Recorded live at HIMSS 2026, Ryan Witt , VP of Industry Solutions at Proofpoint , cuts through the AI hype to expose what's actually driving healthcare's most damaging cyber events. Ryan breaks down why identity and credential theft remain the primary attack vector, how threat actors exploit collaboration tools and email to compromise trusted relationships, and why the rise o...