Risky Business Features

In this podcast James Wilson chats with Brad Arkin about how enterprises can better deal with attackers logging in with valid credentials. Stolen identities, weak special-use credentials, and over-scoped API keys are the new zero-day and they’re abundantly available to attackers. Sadly, the solution here isn’t as simple as deploying phishing resistant MFA. Fixing this takes an enterprise identity...

Join James Wilson in this solo podcast as he takes a (ridiculously) deep dive into the Coruna exploit kit. James was a software engineer and senior manager at Apple for many years, so he has an intimate knowledge of iOS internals. He even worked alongside the people who wrote the software that the Coruna kit exploits! This long-form solo podcast follows the chain of exploits from watering-hole web...

In this edition of Risky Business Features James Wilson chats with cohost Brad Arkin about what it’s like being a CISO for a global company when a war starts. How do you deal with a branch office full of important key material being abandoned? What about cloud infrastructure that’s in a data centre that falls into enemy hands? And if your staff are okay, are any of your key suppliers going to face...

In this podcast James Wilson chats with Brad Arkin about North Korea’s sprawling fake IT worker ecosystem. From fake interviews, to stolen identities, basement laptop farms and IP-KVM tricks, the North Koreans are operating a whole employment fraud industry. Brad and James discuss how the scheme works in practice and the technical detection challenges defenders now face, like dealing with stolen o...

In this debut feature conversation in the Risky Business Features feed James Wilson sits down with Brad Arkin, the former CSO of Adobe, Cisco, and Salesforce, to talk all about AI pentesting. Finding and fixing bugs is great, but does it materially improve the overall security of a product? What’s the point of a pentest if the tester can’t walk you through their findings when it’s over? Is “bugs p...

AI agents are being deployed with the same trust-by-default architecture the early internet had. Same mistakes, MUCH faster timeline. OpenClaw has hit 180K+ GitHub stars. But in the past week: 341 malicious skills on ClawHub were distributing Atomic Stealer ZeroPath disclosed a Browser Relay vuln enabling cross-tab cookie theft CrowdStrike, Cisco, and Bitdefender all published enterprise advisorie...