Dark Perimeter: True Cybersecurity Stories

When an AI agent can run a ransomware attack from break-in to encryption in minutes, narrating its own logic and fixing a failed login in 31 seconds, the human-in-the-loop model that anchors most incident response becomes the bottleneck. Cole Drayden, Dr. Elliott Vance, and Marcus Hale break down JADEPUFFER, the first ransomware operation run end to end by an LLM agent, the Unit 42 finding that at...

A dramatized special. The launch of The Breach Files. Harvest now, decrypt later. It is not a theory. Right now, somewhere, every encrypted message you send is being copied and stored by people who cannot read it yet. They are patient. They are betting that the key is coming. On a dead quiet night shift, a lone security analyst watches a sixteen year old trap spring. A canary token, buried inside...

Most organizations building on AI infrastructure right now are handling their API keys badly — not because their people are careless, but because the default patterns of software development are not secure patterns. In Part One of this two-part series, Cole Drayden breaks down Azure Key Vault Premium from the CISO management perspective: what it is and what problem it solves, why the access contro...

Part Two of the Azure Key Vault series goes into the architecture. The specific decisions. The configuration that separates a deployment that is genuinely secure from one that looks right on a diagram but has gaps. Cole Drayden covers: provisioning and naming conventions that matter, why Azure RBAC at the secret scope is the right access model and how to implement it, managed identity wiring in im...

The architecture is sound. Now comes the work. In part two, Cole Drayden, Dr. Elliott Vance, and Marcus Hale walk through the full AirWatch-to-Intune migration in practical terms: inventory first, licensing and Entra ID prerequisites, the Apple MDM push certificate trap, Android Enterprise setup, App Protection Policy configuration, and why Conditional Access is the control that closes the whole a...

It was the first week of May 2026. Students across 8,800 institutions worldwide were sitting down to final exams. And then their screens went dark — replaced by a ransom note. ShinyHunters had been inside Canvas, the learning management system used by more than 275 million students and faculty, since late April. They'd stolen 3.65 terabytes of data. When Instructure tried to patch them out wi...

Your AirWatch renewal just landed and the number is higher than last year. Before you migrate to Intune, there's a more important question to answer: are you even using the right mobile security model? In this episode, Cole Drayden, Dr. Elliott Vance, and Marcus Hale break down the critical distinction between MDM and MAM — and why Intune's App Protection Policies can eliminate the need...

For the first time in nineteen years of Verizon DBIR history, vulnerability exploitation has overtaken stolen credentials as the number one breach entry point. The reason: AI in the hands of threat actors is compressing the time between disclosure and weaponization from months to mere hours. Cole Drayden sits down with Dr. Elliott Vance and Marcus Hale to break down what changed, why monthly patch...

The night before Google I/O 2026, Cole Drayden sits down with AI security researcher Dr. Elliott Vance and red team operator Marcus Hale to break down what Gemini Spark, persistent AI agents, and Google's agentic push mean for your attack surface. Required listening before tomorrow's keynote. Dark Perimeter: Security, AI, and the Edge of What's Coming. Support the show

What if AI doesn't want to replace us — it needs us as its primary mechanism for spreading across the galaxy? In this episode, Cole Drayden builds the Galactic Symbiosis Hypothesis from first principles. Dark Perimeter: Security, AI, and the Edge of What's Coming. Support the show

AI is no longer a question mark. The models are real, the adoption numbers are real, and the productivity gains in narrow domains are real. What is also real: hallucination rates between 15 and 70 percent depending on the task, AI agents stuck at 17 percent actual deployment despite 60 percent of organizations planning to use them, and a threat landscape where attackers are already running circles...

In September 2022, a teenager broke into one of the world’s most valuable tech companies without writing a single line of exploit code. He bought stolen credentials on the dark web, flooded a contractor’s phone with authentication requests for over an hour, then sent a WhatsApp message pretending to be IT support. That was enough. Once inside Uber’s network, he found admin credentials sitting in a...

What if your AI assistant could be turned against you by an email you never read? In 2024, Anthropic released the Model Context Protocol - a universal standard for connecting AI assistants to email, code repositories, databases, and cloud infrastructure. Within months, researchers began finding something alarming: AI agents with this kind of access could be hijacked by hidden instructions embedded...

 Anthropic described its own upcoming model as posing unprecedented cybersecurity risks - then accidentally leaked that description. Cole Drayden sits down with former federal threat intelligence analyst Marcus Hale to work through what Mythos actually is, what it can do, and what happens when that capability reaches the wrong hands.  Support the show

 On March 31st, a misconfigured build file exposed 512,000 lines of Anthropic's Claude Code source code to the world. Cole Drayden sits down with AI systems security consultant Dr. Elliott Vance to unpack what leaked, what it reveals about autonomous AI, and why this moment may accelerate the field faster than anyone expected.  Support the show

On March 31st, 2026, a security researcher found that Anthropic had accidentally shipped the complete source code of Claude Code - its flagship AI product generating $2.5 billion in annualized revenue - in a public npm package. A missing configuration entry. A public cloud storage bucket. Within hours, the code was mirrored across GitHub 41,500 times. A clean-room rewrite called claw-code became t...

In November 2014, thousands of Sony Pictures employees arrived at work to find grinning red skulls on every computer screen. What followed was twenty-two days of leaked films, exposed emails, executive humiliation, and a geopolitical standoff that ended with the President of the United States calling out a foreign dictator by name. This is the story of the most destructive cyberattack ever launche...