Explore every episode of the podcast Threat Talks - Your Gateway to Cybersecurity Insights
| Title | Pub. Date | Duration | |
|---|---|---|---|
| Lapsus$:Teenagers Hacked Microsoft. | 22 Sep 2026 | 00:19:00 | |
A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end. The uncomfortable part is not how clever the attack was. It is how basic it was. If your help desk resets passwords without proof of identity, if your MFA is a tap-to-approve prompt, if your users carry permissions from two jobs ago, Lapsus$ did not need to be good. They only needed to try. Yuri and Rob also cover what actually stops this: password resets that require physical identification, hardware tokens for sensitive Protect Surfaces, privileged access management with a human in the loop, and why AI is both the fastest way to audit your permissions and the fastest way to recreate the same over-permissioning problem all over again. Timestamps 00:00:00 Hacking the largest companies on earth is super easy Key Topics Covered
| |||
| How a 19-Year-Old Hacked the NEWS Without Breaking In | 15 Sep 2026 | 00:21:17 | |
Your Outlook account recovery will accept an authenticator code on its own. No password, no inbox, no phone number. Koen Kandelaars found one sitting in a PDF on a public help page at the NOS, the largest news organization in the Netherlands. He scanned a QR code out of an onboarding manual and had a real employee's second factor on his phone. Rob Maas, Field CTO at ON2IT, walks the full chain with the attacker himself: eleven vulnerabilities in the first responsible disclosure, a twelfth Koen estimates at 1 to 5 million euros, and the recovery flow nobody tested. Timestamps
Key Topics Covered
Related ON2IT Content & Referenced Resources: Threat Talks: https://threat-talks.com/ | |||
| The End of Reactive Security | 08 Sep 2026 | 00:12:39 | |
You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR.
Key Topics Covered:
Related ON2IT Content & Referenced Resources: Threat Talks website: https://threat-talks.com/ | |||
| NIST CSF 2.0: No CISO, No Excuse | 01 Sep 2026 | 00:23:23 | |
The new NIST Cybersecurity Framework 2.0 is out, and most teams still ask the same question: what do I do tomorrow? Lieuwe Jan Koning sits down with NIST's Amy Mahn and Daniel Elliott to turn the framework into a concrete next step. Governance is now its own function. Profiles tell you where you are and where you need to be. And the Quick Start Guides give a 15-page answer to a problem most people think needs 300 pages. If you run security with limited resources, this episode shows you where to start and why the whole thing is free. Timestamps
Key Topics Covered
Related ON2IT Content & Referenced Resources: NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework | |||
| Your SOC Won't Survive AI Attackers Without This Shift | 25 Aug 2026 | 00:28:15 | |
Running a SOC was always hard. With AI in attackers' hands, hard becomes impossible, unless you change how you work. Rob Maas, Field CTO at ON2IT, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, on why detection and response no longer buys you time. Open-source AI now finds a way into a portal in about 15 minutes, no pentester required. The fix is preemptive cybersecurity: prevention first, automated countermeasures, and a zero trust culture that turns your SOC from analyst-driven to software-driven, with the analyst still in the driver's seat. Timestamps: 00:00:00 When hard becomes impossible | |||
| Shiny Hunters: One Name Behind a Dozen Mega-Breaches | 18 Aug 2026 | 00:14:44 | |
Salesforce, Google, Okta, Louis Vuitton, Allianz, Odido: all breached under the same name. Shiny Hunters may not even be one group. It is a brand that different criminal crews borrow to extort their victims, because the reputation does half the work. The uncomfortable part is how simple it is. No fancy malware, no zero-days. Almost every documented breach started with a phishing call to the help desk, over-permissive credentials, and data copied straight out of a SaaS platform. Host Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Field CTO Rob Maas and ON2IT researcher Yuri Witt to trace how these attacks land, why the attacker's name never matters to your defense, and the basic controls that stop them: multi-factor authentication, IP access control on your SaaS tenants, no over-permissive accounts, and deleting the toxic data you no longer need. If you run SaaS at scale, treat this as a checklist for the controls most teams still have not switched on. Charpters: 00:00:00 One name behind a dozen mega-breaches 00:01:06 Shiny Hunters: a group, or a brand? 00:04:16 The leak site: extortion as a marketplace 00:05:37 How they get in: phishing the help desk 00:07:54 Basic defenses: MFA, no admin rights, block downloads 00:09:36 Pay up or we leak: the Odido case 00:11:24 Lock down SaaS, delete toxic data, and Zero Trust | |||
| HackShield: Raising the Next Generation of Cyber Heroes | 11 Aug 2026 | 00:19:05 | |
The hacker who will attack your organization in five years is in school right now, and nobody is teaching that kid what to do online. HackShield is trying to change that. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Tim Murck, co-founder of HackShield, on why security awareness training for adults keeps failing, and what a game built for seven to twelve year olds can teach every CISO about human risk. If your plan is to train 2,000 people to never click the wrong link, this is the episode that explains why you have already lost, and what to do instead. | |||
| The Hacker Who'll Hit You in 5 Years Is in School | 04 Aug 2026 | 00:22:52 | |
The hacker who will attack your organization in five years is in primary school right now, and nobody is teaching them anything. Tim Murck, Co-founder & Chief Product Officer at HackShield, joins Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain how a game turns kids aged 7 to 12 into junior cyber agents instead of future attackers. The method is not fear. It is teaching kids to ask one question: how are they going to trick me? 🔗 Episode resources, transcript and show notes: https://threat-talks.com Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. #ThreatTalks #ZeroTrust #cybersecurity #hackshield #securityawareness #cybereducation #kidsonlinesafety Charpters: 00:00:00 The hacker who will attack you is in school now 00:00:27 From actor to HackShield: meet Tim Murck 00:02:00 The mission: digital scouting for kids 7 to 12 00:03:53 Junior cyber agents and the Dutch police 00:05:26 Inside the HackShield universe 00:10:02 Adversarial thinking and the grooming theme 00:13:35 Why age 7 to 12, and the school system's blind spot 00:14:53 Ban phones, or teach kids to swim? 00:18:42 The numbers: half a million Dutch kids, 850,000 worldwide | |||
| JADEPUFFER: The AI Malware With No Human in the loop | 28 Jul 2026 | 00:21:35 | |
What if AI stopped being the assistant to cybercriminals and became the attacker itself? That's no longer hypothetical. JADEPUFFER is the first documented case of ransomware run entirely by an AI agent: it broke into a production database, hit a wall mid-attack, then found another way in within 31 seconds, faster than most human penetration testers can react. Rob Maas, Field CTO at ON2IT, sits down with Yuri Wit, SOC DevOps Engineer at ON2IT, to trace how agentic malware evolved out of AI-assisted attacks into a threat that plans, executes, and pivots entirely on its own. 🔗 Episode resources, transcript and show notes: https://threat-talks.com Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. #ThreatTalks #ZeroTrust #firewallsecurity #NetworkSecurity #CyberSecurity #infosec Charpters:
👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Four Firewall Mistakes Still Wrecking Networks in 2026 | 21 Jul 2026 | 00:14:23 | |
Three out of four firewall rule sets ON2IT’s SOC inherits from new customers share the same blind spots, and none of the fixes cost extra licensing. In this episode, Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Jelle Konings, security optimization specialist in ON2IT’s Security Operations Center, to walk through the mistakes his team finds on almost every inherited network: no logging enabled, no identity tied to traffic, no default deny rule at the bottom of the rule base, and port-based rules standing in for real application control. Most environments he inherits sit around 30 to 40 percent application-based policy coverage against a 60 to 80 percent target. You will hear what to check first when you inherit a firewall, how long a realistic clean-up takes (weeks, months, sometimes over a year), and why an encrypted VPN tunnel riding on port 443 can move data out the door without a single alert firing.
Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. #ThreatTalks #ZeroTrust #FirewallSecurity #NetworkSecurity #CyberSecurity #InfoSec Chapters: 00:00 Cold open: the top firewall mistakes of 2025 | |||
| Would Your Boss Read Your Prompts? Private AI, Explained | 14 Jul 2026 | 00:19:34 | |
Would you still use ChatGPT if your boss, or the AI provider, could read every single prompt you typed in? Most of us type something we would never share publicly into an AI tool every day. In this Threat Talks Deep Dive, Field CTO Rob Maas sits down with ON2IT senior developer Derk Bell to unpack the privacy problem hiding inside everyday AI use, and a genuinely clever way to solve it. The problem is bigger than a single prompt. An AI request carries far more context than a Google search: your conversation history, your files, and (with agents and MCP) automatic, autonomous access to your CRM, your email, your calendar and your codebase. A lot of that data is shipped off to a remote provider, often without you realizing it. Today we just trust those providers not to misuse it. As Derk points out, “trust us” is the exact opposite of Zero Trust: never trust, always verify. So how do you verify? Derk walks through Confer, the privacy-first AI service from Signal Protocol co-creator Moxie Marlinspike. Using the analogy of a tamper-proof, locked calculator box for an “anonymous” employee survey, he explains how Confer lets you actually check the wiring: a hardware Trusted Execution Environment that isolates and encrypts the running program, remote attestation that lets you verify the exact open-source code handling your prompt, a Signal-style encrypted channel to talk to it, and hardware-bound keys that are thrown away the moment your session ends, so even the operator can never read your data. We close on who needs this most (developers protecting trade secrets, executives working on M&A or strategy, and anyone bound by GDPR) and whether the big AI labs will adopt this the way the whole industry adopted Signal. The takeaway: privacy and powerful AI do not have to be a trade-off. “Trust us” was never a security strategy. 🔗 Episode resources, transcript and show notes: https://threat-talks.com Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. Chapters: | |||
| Framework Fatigue: Why NIST Rebuilt the Cybersecurity Framework | 07 Jul 2026 | 00:28:02 | |
Ten years after its first release, the NIST Cybersecurity Framework got a full rebuild. Not because it failed, but because everyone started using it, and it was never built for everyone. In this episode, host Lieuwe Jan Koning talks with Amy Mahn, IT Standards Advisor at NIST, and Daniel Eliot, Lead for Small Business Engagement at NIST’s Applied Cybersecurity Division, about what CSF 2.0 actually changes and why it took a multi-year public process to get there. The original framework was written with critical infrastructure operators in mind. A decade later, hospitals, school districts, and small businesses were all using it too, often without the staff or budget the framework quietly assumed they had. NIST collected more than 4,000 comments from organizations across over 100 countries to find out what was missing. The result includes a new Govern function that puts cybersecurity risk decisions in front of leadership and the board, a deliberately technology agnostic and vendor agnostic design that keeps the framework useful no matter which tools an organization runs, a Quick Start Guide aimed at organizations without a dedicated security team, and a sharper focus on supply chain risk. Amy and Daniel also explain why “vendor agnostic” is a feature, not a gap: it’s what lets an organization decide for itself who or what is best suited to close a given risk, instead of a framework quietly picking winners. Part 2, “CSF 2.0: Beyond the Framework,” continues the conversation and covers implementation in practice. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. New episode every Tuesday. Follow Threat Talks to stay up to date on the topic of cybersecurity. Chapters: | |||
| Why Do You Trust Your AI Agent? | 30 Jun 2026 | 00:24:23 | |
Agentic AI is powerful, and someone recently found that out the hard way when an AI tool, given free rein with a user’s own permissions, deleted her entire mailbox. That cautionary tale opens this Threat Talks Deep Dive, where host Lieuwe Jan Koning talks with Rob Maas, Field CTO of ON2IT, about what Zero Trust looks like when the thing you’re securing is an AI agent. Drawing on Rob’s recent blog post (and the Zero Trust pillars shared by CISA and Forrester’s Zero Trust eXtended framework), they work through each pillar in turn. The recurring theme is “just-in-case” privileges: the broad access we hand humans on the assumption they’ll use judgment. Agents have no such judgment. Give one an intent and it will use everything it has to reach the goal, and it can spin up parallel instances to get there faster. Across Identity, Devices, Network, Applications & Workloads, and Data, Rob makes the case for:
He’s candid about the gaps, too: there’s no generic “AI firewall” yet, prompt injection has no guaranteed fix, and the hardest control points now live in the details of how individual developers configure their tools. The optimistic note: because agent-to-model and agent-to-agent calls can be logged, you can actually see what an agent is doing, an advantage over the opacity of the human mind. The episode closes on what’s still missing and a clear first step for any organization: get an overview of every agent and MCP server in use, and the access each one has. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. New episode every Tuesday. Follow Threat Talks to stay up to date on the topic of cybersecurity. | |||
| Mythos is not the AI Apocalypse | 23 Jun 2026 | 00:22:05 | |
Mythos found a 23-year-old vulnerability in FreeBSD that no human team had caught. Your 30-day patch cycle assumes years before it gets weaponized. Today that window is one day. Next year it will be one hour. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Rob Maas, Field CTO at ON2IT, to break down what Anthropic's Mythos actually found, why the public release (Fable) still frustrates security professionals, and whether the FABLE framework gives defenders a realistic path forward. Rob's verdict: there is truth in what Anthropic claims. It is not as catastrophic as the marketing suggests. But if your fundamentals are not in place, the time to fix that is now. 00:00:00 Introduction Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| What about Iran? One Word Document, Three Backdoors | 16 Jun 2026 | 00:22:14 | |
Every big nation state has a cyber army: China, Russia, the US, Europe. But what about Iran? Meet Boggy Serpens, a group tied to Iran’s civilian intelligence service whose entire business is breaking in and staying in, then handing the keys to whoever strikes next.
Filmed live at the ON2IT SOC, host Lieuwe Jan Koning runs a red team vs blue team session with analysts Yuri Wit, the “proxy Iranian” attacker, and Rob Maas on defense. Watch the full episode to see each move, and the exact control that stops it. 🔗 Episode resources, transcript and show notes: https://threat-talks.com 🎙️ Subscribe to the podcast on Spotify, Apple Podcasts, or your podcast app of choice. Threat Talks is a podcast by ON2IT cybersecurity and AMS-IX. We delve deep into the dynamic world of cybersecurity, one episode at a time. New episode every Tuesday. Chapters (paste into YouTube description) 00:00 Every nation state has a cyber army: what about Iran? | |||
| Europe Is Losing the Sea Cable Race | 09 Jun 2026 | 00:35:10 | |
In 2026, 40 new submarine cables go live. Most won't land in Europe. Europe is losing the sea cable race, and most people haven't noticed yet. In this second part of our sea cables conversation, host Peter Ernst sits down with Ernst Noorman, the Netherlands' Cyber Ambassador-at-Large and a member of the ITU Advisory Body on Submarine Cable Resilience, to move from the “how” of sea cables to the “why it matters.” We compare two places that were once called the two hardest spots in the world to build digital infrastructure, Amsterdam and Singapore, and unpack how Singapore solved its crunch with 32 cable landings, five years of zero cable faults, and a green-energy-first tender process, while the Netherlands risks resting on a 30-year-old head start. Along the way: the difference between sovereignty and autonomy, why “always the cheapest option” no longer works, the EU Cyber Resilience Act and security by design, what NIS2 means for boards and CEOs personally, and why Europe needs to stop being modest about Airbus-sized wins. Chapters 00:00 — 40 new cables, most skip Europe Threat Talks is a podcast by ON2IT and AMS-IX. Subscribe for more on Zero Trust, cyber resilience, and the infrastructure behind the internet. | |||
| Russia Cutting Cables? | 02 Jun 2026 | 00:32:30 | |
The headlines say Russia’s shadow fleet is cutting cables. The experts say most faults come from clumsy ship anchors. Ninety-nine percent of global internet traffic runs across the ocean floor, and the conversation about what threatens it is mostly wrong. In this episode of Threat Talks, Peter van Burgel, CEO of AMS-IX, sits down with Ernst Noorman, Cyber Ambassador at Large for the Netherlands and member of the ITU Advisory Board on Submarine Cable Resilience, to separate geopolitical noise from engineering reality, and explain what actually puts global internet connectivity at risk. Timestamps 00:00:00 Introduction Key Topics Covered • Why most submarine cable faults come from anchors, fishing nets, and natural events, not state actors • How aging repair ships and bureaucratic permitting barriers make restoration slow in most of the world • Why satellite (including Starlink) cannot replace subsea fiber at any meaningful scale • How big tech dominance over new cable investment creates digital sovereignty risks for governments and large organizations • What NIS2 means for CEO accountability on digital infrastructure resilience Related ON2IT Content & Referenced Resources ITU Advisory Board on Submarine Cable Resilience: https://www.itu.int/digital-resilience/submarine-cables/advisory-body/ Threat Talks: https://threat-talks.com/russia-cutting-cables-whos-protecting-it/ Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 ► YOUTUBE: / @threattalks 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack’s Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Hero Culture and a $1 Million Mistake | 26 May 2026 | 00:20:03 | |
A company skips a security check two days before Black Friday and loses $1 million when transactions land in the wrong bank accounts. A machine learning team is told no on production data access, gets it via SharePoint anyway, and a year later the data is on contractor laptops nobody can account for. Two stories, one pattern: when security blocks, the risky work doesn’t stop – it just happens without you. Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Sina Yazdanmehr, Founder and Managing Director of Aplite GmbH, on the prevention paradox, why a “no” from the CISO is an illusion of control, and how a technical security team turns into a business partner instead of a roadblock. Timestamps 00:00:00 Introduction
Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. | |||
| When Compliance Replaces Security | 19 May 2026 | 00:23:27 | |
A SaaS company buys enterprise ChatGPT for 800 staff and strangely only uses 30 seats. A corporate signs annual risk exemptions for five years until the exception list itself is mistaken for a working security process. Same root cause, two symptoms. Compliance is not security. Security culture is company culture. If your employees do not trust their managers, no policy you write will save you. Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Sina Yazdanmehr, Founder and Managing Director of Aplite GmbH, on why security policy depends on trust, why a signed risk acceptance is a legal act, and what a leadership cadence on security communication actually looks like. Timestamps 00:00:00 Introduction Key Topics Covered
Related ON2IT Content & Referenced Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. | |||
| The Agent Problem | 12 May 2026 | 00:21:27 | |
Your AI agents are users now. They have your permissions. They read your email. They send messages. And they act on instructions that anyone with an internet connection can drop into your inbox. In this episode of Threat Talks, Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Jack Cable, CEO and Co-founder of Corridor and former lead of Secure by Design at CISA, to walk through the “lethal triangle” (the three conditions that turn helpful AI into a breach vector) and what CISOs should be doing right now, before the technology runs further ahead of the controls. Timestamps 00:00 – 01:36 Cold Open: The User Inside Your Software Key Topics Covered
| |||
| Your Sales Team is now a Developer | 05 May 2026 | 00:33:10 | |
The biggest security threat in your organization right now? Your sales team. AI coding tools have crossed into every department, and most organizations have no idea what's being built or deployed in their name. In this episode of Threat Talks, Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Jack Cable, CEO and Co-founder of Corridor and former lead of Secure by Design at CISA to talk about why the answer isn’t to block innovation.
Timestamps 00:00 – Introduction
Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| The Hidden Risk of Your Infrastructure | 28 Apr 2026 | 00:26:42 | |
Volt Typhoon spent years pre-positioning inside US critical infrastructure. Salt Typhoon pulled off one of the largest espionage campaigns in history. They didn't break in. They were already there. So what do you actually do about it? Caitlin Clarke, Senior Director of Cybersecurity Services at Venable and former Special Assistant to the President for Cybersecurity and Emerging Technology, joins Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, to work through the practical steps security leaders should be taking right now, before the regulatory guidance catches up with the threat.
What's in this episode for you:
A framing that goes beyond the technical. Insider risk. IP theft. Economic espionage. Nation state actors target people and research, not just networks — and that's the gap most organizations leave wide open.
00:00 – Introduction: Critical Infrastructure and the Nation State Threat 01:45 – Volt Typhoon, Salt Typhoon and Why CISOs Need to Think Differently 03:21 – What Is Actually in Your Stack: Critical Infrastructure Cybersecurity Beyond Hardware 09:32 – Mapping Your Supply Chain Including Your Supplier's Suppliers 16:34 – Software, Open Source and AI: The Layers of Risk Most Organizations Have Not Mapped 21:59 – Insider Risk, IP Theft and Economic Security + Wrap Up
Key Topics Covered
Resources
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| America Just Changed the Rules of Cyber War | 21 Apr 2026 | 00:26:42 | |
If you're waiting for the executive orders to act, you're already behind.
The U.S. has just released a new national cyber strategy. The core message is clear: stop waiting to be hit, and start making it costly to try.
In this episode of Threat Talks, Caitlin Clarke, Senior Director of Cybersecurity Services at Venable and former Special Assistant to the President for Cybersecurity & Emerging Technology, join Lieuwe Jan Koning, Co-founder & CTO at ON2IT Cybersecurity to break down what the strategy actually says, and what it means for your organization.
The direction is clear. The details are still coming. But the clock is already running.
This episode helps you stay ahead with three clear pillars of the strategy:
Spoiler alert: if you haven't started your Zero Trust and post-quantum cryptography roadmaps yet, the new strategy has a message for you too.
Timestamps 00:00 – America's New Cyber Strategy: First Impressions 01:28 – What the US National Cyber Strategy Is Really Saying 02:52 – Pillar 1: Shaping Adversary Behavior and Cyber Deterrence 10:28 – Pillar 4: Securing Critical Infrastructure and Adversary Technology 18:07 – Pillar 2: Harmonizing Cyber Incident Reporting Requirements 22:17 – What CISOs Should Do Now: Supply Chain, Zero Trust and Post-Quantum Cryptography 27:11 – Wrap up
Key Topics Covered
Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| The EU is forcing the conversation | 14 Apr 2026 | 00:33:44 | |
We always worried about lock-in. But the real risk is getting locked out – of your cloud. Your data may sit in Europe. Your systems may run on trusted platforms. But if access is restricted tomorrow – by a provider, a government, or a legal decision - what actually happens?
In this episode of Threat Talks, Lieuwe Jan Koning (co-founder and CTO at ON2IT Cybersecurity) speaks with Lokke Moerel (Professor of Global ICT Law at Tilburg University and leading expert in EU cybersecurity regulation) to break down what data sovereignty really means- beyond the illusion of control. Because sovereignty doesn’t fail where you think it does. It breaks in four places:
Most organizations only solve the first - and that’s where the real risk starts: dependency on providers you don’t control. As cloud and AI deepen that dependency, the question isn’t where your data sits, but who decides what happens to it tomorrow. From sovereign cloud initiatives to European AI models like GPT-NL, this episode explores how regions are trying to regain control, and why relying entirely on big tech may not be sustainable.
Key Topics Covered
Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Europe vs China vs US: Who Controls Your Tech? | 07 Apr 2026 | 00:33:02 | |
You don’t control the technology your business runs on. That’s an uncomfortable reality.
But the truth is: your infrastructure runs on foreign technology. And if they fail – you feel it.
Because this is not just about audits.
From Chinese components embedded in infrastructure to US-controlled cloud services, organizations are relying on suppliers that sit outside their control. And that creates a different kind of risk. Not just technical – but strategic.
This changes how supply chain security works. For CISOs and security leaders, the message is clear:
Timestamps 00:00 – Your Vendor Passed the Audit—Why You’re Still Exposed
Key Topics Covered
Resources
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Breached OT Kills. Zero Trust 2.0 Doesn’t | 31 Mar 2026 | 00:16:51 | |
Not long ago, OT environments were isolated islands. Control systems ran independently, accessible only through dedicated workstations requiring physical presence. The factory floor and the IT department might as well have been on different planets.
That world is gone.
Today’s OT environments are connected. Remote access from IT workspaces to control systems is routine.
And this is just the start. And it changes everything about how to secure them. In this episode of Threat Talks, Lieuwe Jan Koning and Rob Maas break down what happens when OT vs IT security models collide – and why IT/OT convergence is forcing organizations to rethink how they protect industrial environments. Patching is difficult, availability is critical, and legacy models like the Purdue model leave gaps attackers can move through. So, what does work?
Timestamps 00:00 – OT vs IT Security Introduction and Key Differences 00:57 – IT OT Convergence Is Changing OT Security 04:49 – What OT vs IT Security Looks Like in Practice 10:13 – Why IT and OT Teams Struggle to Communicate 12:18 – How Zero Trust Applies to OT Environments 14:21 – How to Secure OT with Zero Trust and IT OT Convergence
Key Topics Covered
Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com | |||
| React2Shell Explained | 24 Mar 2026 | 00:14:48 | |
Log4j caught everyone off guard. React2Shell might be doing the same right now. Across thousands of React apps, exposure is already baked in - accelerated by vibe coding and shipped without scrutiny. In some cases, one request is all it takes.
In this episode of Threat Talks, host Rob Maas and SOC analyst Yuri Wit break down how React2Shell works, why it’s more serious than it looks, and what makes it so easy to exploit. The risk is significant, and what makes it worse is how little attention it’s getting. As developers increasingly rely on AI-generated code, applications are being shipped faster - but not always with full visibility into how components behave. That creates blind spots attackers can take advantage of, especially when serialization and deserialization flaws are involved. We cover how React2Shell works, how attackers exploit serialization and deserialization flaws, and what actions you need to take now to reduce risk. If your organization runs React or Next.js applications, assume exposure until proven otherwise - especially if this hasn’t been on your radar yet. React2Shell isn’t making Log4j headlines. That doesn’t mean the risk is smaller. Timestamps 00:00 – React2Shell Introduction and Log4j Comparison 00:28 – What Is React and How Vibe Coding Introduces Security Risks 02:48 – How the React2Shell Vulnerability Enables Remote Code Execution 05:49 – How Attackers Exploit React2Shell with a Single POST Request 07:28 – Impact of React2Shell RCE on Server Privileges and Access 08:18 – How to Mitigate React2Shell and the Next.js Vulnerability 11:18 – Incident Response for React2Shell Exploitation 13:25 – Ongoing React2Shell Risk and Why Many Apps Remain Vulnerable
Key Topics Covered
Resources
Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques.
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Zero Trust in the AI Era | 17 Mar 2026 | 00:22:54 | |
AI can fake your voice. Security teams are entering an era where nothing can be trusted at face value.
How do you verify identity when voices and faces can be faked? They discuss real-world examples including deepfake fraud, “cyber-kidnapping” scams, prompt injection attacks, and the growing role of AI policy engines in defending modern systems. One key takeaway: AI is accelerating a global trust crisis. And this is what makes Zero Trust matters more than ever. Simple Zero Trust principles like verification, passphrases, strict payment procedures, and continuous validation become essential safeguards for every organization. Because in an environment where anything can be simulated, trust must always be verified. Missed part one? Timestamps 00:00 - Introduction: AI Security Threats and the Future of Zero Trust
Key Topics Covered
Resources
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Zero Trust: From Revolution to Reality | 10 Mar 2026 | 00:20:21 | |
Zero Trust is easy to say. Hard to execute. Most organizations try to build it themselves. Most underestimate the complexity.
Zero Trust isn’t a product. It’s not a checkbox. It’s a decision about what you protect first – and how seriously you take execution. If your job is to protect critical data without drowning in complexity, this episode will recalibrate your approach.
Timestamps 00:00 – Introduction to Zero Trust Data Protection 00:50 – How Zero Trust Started at Forrester 03:19 – The ZTX Framework and Structuring Zero Trust 05:05 – Data at the Core of Zero Trust Data Protection 08:22 – Success Factors for Effective Zero Trust Data Protection 13:06 – Why Most Organizations Should Not DIY Zero Trust 15:36 – Breaches, Misconfiguration, and Market Reality 18:07 – How COVID Accelerated Zero Trust Adoption 19:25 – Closing Thoughts on Zero Trust Fundamentals
Key Topics Covered
Resources
| |||
| China is Already Inside your infrastructure | 03 Mar 2026 | 00:29:45 | |
China is Already Inside your infrastructure. And the EU is done ignoring it. In this exclusive first discussion of the upcoming EU Cybersecurity Act revision, Bart Groothuis, MEP, joins Lieuwe-Jan Koning, CTO and Co-Founder, to explain why vendor dependency is now a board-level security risk. Groothuis breaks down how the revised EU Cybersecurity Act will shift Europe from soft guidance to hard enforcement - introducing formal “high-risk vendor” treatment inside critical infrastructure. This isn’t about secret backdoors. It’s about who controls the next update. The revision brings non-technical risk - state influence, intelligence laws, geopolitical leverage - directly into cyber certification decisions. That means supply chain risk is no longer theoretical. It’s regulatory.
If your infrastructure depends on a vendor tied to a high-risk state, this conversation matters. Timestamps 17:17 Energy, inverters, and real-world dependency risks - blackouts Key Topics Covered Related ON2IT content & explicitly referenced resources Subscribe and turn on notifications to stay ahead of emerging cyber policy, supply chain risk, and critical infrastructure security across IT and OT. | |||
| OpenClaw and The Dark Side of Agentic AI | 24 Feb 2026 | 00:19:56 | |
Your biggest threat this year isn’t malware. It’s your own AI assistant. OpenClaw connects an LLM directly to your terminal, browser, email, and chat. Days after launch, researchers found a One-Click RCE. Cisco called it a security nightmare. Gartner called it an unacceptable risk. OpenClaw (formerly known as Clawdbot and Moltbot) represents a new phase of agentic AI: autonomous assistants operating inside your environment with almost no guardrails. The headlines around OpenClaw have been clear: it’s a serious threat. But how should we handle agentic AIs like OpenClaw moving forward? In this Threat Talks episode, Field CTO Rob Maas and SOC analyst Yuri Wit break down what OpenClaw actually does, where AI agent security breaks, and whether or not you should deploy OpenClaw. OpenClaw is powerful. It’s useful. It’s also proof that many of us are not ready for AI agents with this level of autonomy. Before you let an AI agent into your systems, understand what happens when it runs unchecked. Timestamps Key Topics Covered · How OpenClaw works and why agentic AI changes the security model · The One-Click RCE and what it reveals about AI agent security · Malicious skills, default allow design, and autonomous privilege abuse · Realistic mitigation strategies including sandboxing and controlled environments Resources · Threat Talks: https://threat-talks.com/ · ON2IT (Zero Trust as a Service): https://on2it.net/ · AMS-IX: https://www.ams-ix.net/ams
🔔 Follow and Support our channel! 🔔 ===
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Inside the MongoBleed Memory Leak | 17 Feb 2026 | 00:13:57 | |
Imagine your memory just became the attack surface. Just normal protocol behavior, repeated at scale. Each request leaks a little more MongoDB memory until something valuable shows up, even in environments that already follow network segmentation best practices. Rob Maas (Field CTO, ON2IT) hosts Luca Cipriano (CTI & Red Team Program Lead) to dissect MongoBleed, an unauthenticated memory leak vulnerability in MongoDB, in this episode of Threat Talks. They break down how MongoBleed exploits MongoDB’s wire protocol before authentication and why repetition matters more than a single request. MongoDB is everywhere: cloud platforms, scalable applications, and data-heavy environments where availability matters more than friction. If MongoDB is part of your environment, or you want to understand how this vulnerability is exploited in practice, the full breakdown is worth your time. Timestamps
Key Topics Covered · How malformed compressed messages manipulate MongoDB memory allocation · Why BSON string parsing can expose unintended data · How repeated burst requests turn small leaks into valuable information · Why MongoDB deployments are attractive targets in the cloud Resources · Threat Talks: https://threat-talks.com/ · ON2IT (Zero Trust as a Service): https://on2it.net/ · AMS-IX: https://www.ams-ix.net/ams · Threat Talks episode on Citrix Bleed: https://youtu.be/YwDpRPBfAzs
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com
🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| How to pass any cybersecurity certification | 10 Feb 2026 | 00:21:59 | |
Certifications play a central role in cybersecurity career development. The problem isn’t a lack of knowledge or skills. It’s the disconnect between real-world security work, and certifications built around memorization, UI trivia, and version-specific details that will be obsolete in two months. In this episode of Threat Talks, Rob Maas (Field CTO, ON2IT) and Nicholai Piagentini(Technical Enablement Engineer, ON2IT) break down why this happens, how certification exams are designed, and how to pass any cybersecurity certification without memorization or falling for trick questions. They explore how well-written exams validate real job tasks, while poorly designed ones drift into reading comprehension, UI trivia, and version-specific details that lose value the moment the product changes. From blueprint-driven preparation to smart elimination tactics and knowing when not to overthink an answer, this is a grounded look at how to pass any certification for meaningful cybersecurity qualifications. Timestamps Key Topics Covered · Why many certification exams fail at measuring real-world cybersecurity skills · How to pass cybersecurity certification exams by focusing on concepts, not memorization · What makes a good vs bad exam (and how vendors design them) · Practical tactics for exam day, preparation strategies, and dealing with nerves
Resources · Threat Talks: https://threat-talks.com/ · ON2IT (Zero Trust as a Service): https://on2it.net/ · AMS-IX: https://www.ams-ix.net/ams
🔔 Follow and Support our channel! 🔔
► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...
👕 Receive your Threat Talks T-shirt https://threat-talks.com/
🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com | |||
| The End of Reactive Security | 03 Feb 2026 | 00:47:12 | |
You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR. Timestamps Key Topics Covered - Preemptive cybersecurity as the Gartner-flagged direction, and why MDR has to move past detect-and-respond Related ON2IT Content & Referenced Resources: Threat Talks website: https://threat-talks.com/ 🔔 Follow and Support our channel! 🔔 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| From IPs to people | 27 Jan 2026 | 00:18:12 | |
Detection fails without identity. In this Threat Talks Deep Dive, Rob Maas (Field CTO, ON2IT) and Nicholai Piagentini (Technical Enablement Engineer, ON2IT) show how identity-based firewalling fixes that-by enforcing policy based on who the user is, not where they connect from.The result: stronger network access control, cleaner zero trust firewall enforcement, and better enterprise security decisions.
Key Topics Covered • Why anomaly detection breaks without identity correlation in firewall logs • How identity-based policy improves network access control and reduces lateral movement • Common failure points: terminal servers, NAT, service accounts, AD timeouts • A low-risk rollout: enable for visibility first, then enforce zero trust rules Related ON2IT content & explicitly referenced resources Threat Talks connects cyber threats to operational reality-so CISOs and architects can make decisions faster. Subscribe, follow, and turn on notifications to stay ahead of what changes enterprise security next. Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Beyond NIS2 Compliance | 21 Jan 2026 | 00:47:38 | |
Most organizations ask one question:
Speakers Lieuwe Jan Koning - Security Operations Center, ON2IT Jasper Nagtegaal - Director of Digital Resilience, Dutch Authority for Digital Infrastructure (RDI) | |||
| Maritime Cybersecurity: Predictable = Hackable | 13 Jan 2026 | 00:37:32 | |
You’re Port Control. A vessel requests entry. In maritime cybersecurity, the risk isn’t that the ship is autonomous. Lieuwe Jan Koning (Co-Founder & CTO, ON2IT) joins Stephen McCombie (Professor of Maritime IT Security, NHL Stenden) and Hans Quivooij (CISO, Damen Shipyards) to expose the illusion of control in autonomous shipping - where technology moves fast, responsibility blurs, and regulation lags behind.
Key Topics Covered • Why maritime cybersecurity now decides physical safety, not just data protection • How predictability in autonomous vessels creates exploitable maritime cyber risk • Where responsibility breaks down when humans leave the bridge • What cyber attacks on critical infrastructure look like once they reach the sea • What to do next to protect against cyber attacks at sea Related ON2IT content & explicitly referenced resources Threat Talks connects cyber threats to operational reality - every week. Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Before the Mayday: Cyber Attacks at Sea | 06 Jan 2026 | 00:38:25 | |
Could Stuxnet happen again - this time at sea? In this Threat Talks episode, host Lieuwe Jan Koning sits down with Professor Stephen McCombie, global expert in maritime cybersecurity, to unpack real-world cyber attacks on critical infrastructure and why the maritime sector is dangerously exposed. From GPS spoofing and insider threats to aging ship systems and state-sponsored attacks, this conversation reveals how maritime cyber risk is no longer theoretical - it’s already disrupting global trade, safety, and geopolitics. If your organization depends on shipping, ports, or industrial OT environments, this is an episode you really shouldn’t ignore.
Key Topics Covered • Why maritime cybersecurity failures can cripple global supply chains • Real examples of cyber attacks on critical infrastructure, including GPS spoofing and insider threats • How legacy OT, poor segmentation, and low awareness increase maritime cyber risk • Practical lessons: intelligence-led defense, openness, exercises, and Zero Trust thinking Related ON2IT Content & Referenced Resources Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Looking Back at 2025: Cybersecurity at a Turning Point | 30 Dec 2025 | 00:41:07 | |
2025 was the year detection stopped being enough. OT systems were hit with real-world consequences. AI stopped being just a productivity tool and became an attacker. And SOCs discovered - often painfully - that speed alone still means reacting too late.
Key Topics Covered • How AI-powered attacks and autonomous malware altered attacker economics • Why OT security and critical infrastructure moved to the front line • Where SOC automation helps - and where it creates false confidence • Why preemptive security and Zero Trust shift defense from reaction to control Related ON2IT Content & Referenced Resources Salesloft supply chain attack episode PromptLock malware episode MCP security episode Zero Trust episodes playlist Zero Trust infographic (PDF) Threat Talks is built for CISOs and security leaders navigating real trade-offs—not vendor promises. Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| BGP Vortex: Internet Kill Switch? | 23 Dec 2025 | 00:22:02 | |
Could a single BGP trick really break the internet? A new “BGP Vortex” claim says yes - by abusing route oscillation and BGP communities to trigger endless update loops and exhaust router CPU. So we check what actually holds up in the real world. No, it’s not a “break the whole internet tomorrow” button.
Key topics covered • What BGP is and why the internet depends on it • How route oscillation and update amplification can overload routers • Why the attack relies on upstream policy choices (communities aren’t “magic”) • Why the “break the internet” claim is mostly theoretical • Practical mitigations: filtering/inspecting communities, monitoring, session shutdown Resources Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| WSUS RCE: Update Weaponized | 16 Dec 2025 | 00:22:57 | |
Attackers are abusing a WSUS flaw - Microsoft’s Windows Server Update Services - to detonate PowerCat, spawn reverse shells, and plant ShadowPad. All from the update server your entire Windows estate trusts by default. One weak crypto key and a broken deserialization function let attackers hit your WSUS server with unauthenticated SYSTEM-level code execution. Chinese APT groups are already exploiting it to drop malware in memory, blend into legitimate WSUS traffic, and pivot deeper into the network. Yes WSUS patch exists, but even if you patch it today, the real problem remains: Watch host Lieuwe Jan Koning - with Blue Team expert Rob Maas and Red Team lead Luca Cipriano - break down how the exploit works, how attackers chain it into real-world intrusions, and the Zero Trust fixes that actually matter.
Key Topics Covered • How one WSUS flaw enables unauthenticated RCE as SYSTEM • The attack chain: crafted payload → deserialization → PowerCat → ShadowPad • Why update servers are high-value pivot points for APT groups • How Chinese APTs weaponized this vulnerability in real-world intrusions • Zero Trust protections: segmentation, egress control, EDR/XDR detection • How to secure Microsoft Windows Server Update Services (WSUS patching best practices) Episodes Mentioned Guest & Host Links Additional Resources Subscribe to Threat Talks and turn on notifications for deep dives into the world’s most active cyber threats and hands-on exploitation techniques. Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Bad Successor: The Service Account Flaw to Watch | 09 Dec 2025 | 00:17:15 | |
It was built to secure service accounts. They called it Bad Successor (A.K.A. CVE-2025-53779). A new “secure by design” feature in Windows Server 2025 -DMSA -was supposed to fix service account hygiene. Instead, it introduced a loophole where attackers could claim successor status, skip password requirements, and silently inherit elevated rights from any target account. Including domain admin. Even after Microsoft patched the issue, the deeper risk remains: This isn’t a niche AD misconfiguration. It’s a privilege-escalation design flaw hiding inside a security feature, and a warning shot for every environment leaning on default trust in the identity layer. Watch host Rob Maas, Field CTO at ON2IT, and Luca Cipriano, CTI & Red Team Lead at ON2IT break down how Bad Successor works, how attackers exploited it, and what a Zero Trust AD strategy actually looks like in 2025.
Key Topics Covered • How a security upgrade became a privilege-escalation vector. • Why service account security failures create invisible attack paths. • The real DMSA abuse chain: child objects → successor claim → domain admin. • Zero Trust defenses for AD: permissions, logging, rotation, least privilege. Got your attention? Guest and Host Links: Additional Resources Click here to view the episode transcript. 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| From Hacker to Hero | 03 Dec 2025 | 00:45:18 | |
What if your next great cyber defender is a teenager gaming in their bedroom right now? In this Threat Talks episode, Lieuwe Jan Koning and former FBI Supervisory Special Agent William McKean (founder of The Redirect Project) explore how young digital natives go From Hacker to Hero. They chart the journey from gaming and online communities to risky first hacks and real-world intrusions. Then they show how to redirect that curiosity away from cybercrime and into ethical hacking, cyber defense, and a Zero Trust mindset at home and at work. You’ll get practical questions to ask kids, simple “safe word” tactics, and concrete steps security leaders can use to grow defenders instead of future attackers. Key Topics Covered Psychology of recruitment: Why belonging, status and rewards override an undeveloped moral compass, and how grooming patterns mirror terrorism and gang recruitment. Parent & educator playbook: Practical ways to talk about online life, spot early warning signs, use “safe words,” and apply a Zero Trust mindset at home. Diversion, not destruction: How programs like The re_direct Project, HackShield, re_B00TCMP, Hack_Right, and The Hacking Games turn justice-involved kids into defenders instead of life-long offenders.
Additional Resources ON2IT & Threat Talks • ON2IT – Zero Trust Innovators: https://on2it.net/ • Zero Trust as a Service: https://on2it.net/zero-trust/ • Threat Talks podcast hub: https://threat-talks.com/ Episode Guest & Projects Mentioned If this episode helped you rethink your From Hacker to Hero strategy for your family or your workforce, don’t forget to hit Like, subscribe to Threat Talks. Click here to view the episode transcript. | |||
| The Npm Worm Outbreak | 25 Nov 2025 | 00:18:27 | |
The world’s biggest open-source ecosystem - npm - faced its first self-spreading worm.
break down how it started, how it spread, and how to make sure your pipeline isn’t the next one to go viral.
Key Topics Covered
Got your attention? Subscribe to Threat Talks and turn on notifications for more content on the world’s leading cyber threats and trends. Guest and Host Links: Rob Maas (Field CTO, ON2IT): https://www.linkedin.com/in/robmaas83/ Yuri Wit (SOC Analyst, ON2IT): https://www.linkedin.com/in/yuriwit/
Additional Resources | |||
| Inside the SalesLoft Breach | 18 Nov 2025 | 00:21:32 | |
You were promised safe SaaS - but got silent data loss. They trace how vishing calls, trojanized Salesforce tools, and GitHub-to-AWS pivots gave attackers OAuth access and drained CRMs without a single alert. You’ll hear how Drift integrations and bulk SOQL queries quietly moved data out of sight, while audit trails and API metadata disappeared. Turn Zero Trust from slogan to stop - with IP allowlists, app inventories, token telemetry, and shared responsibility that actually blocks abuse at the source.
Key Topics Covered: • How one sign-in token became a master key for your CRM. • The attacker’s route: from code repo → cloud → Salesforce → data exfiltration. • What shared responsibility means in SaaS — and what’s actually on you. • What truly stops it: trusted apps only, IP allowlists, short-lived tokens, and continuous monitoring. Found value and want outcome focused guidance every week? Guest and Host Links: Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| The App Store Nightmare: Why AI MCP Stores Are a Trap | 11 Nov 2025 | 00:35:01 | |
The new AI app store is here - and it’s already making choices for your company. Host Lieuwe Jan Koning with RobMaas (Field CTO, ON2IT) explain the app storenightmare in plain language. A new system (MCP) lets AI tools like ChatGPT, Claude, and Gemini do tasks for you - sometimes too much. When a bad tool or a sneaky document gets in, it can read, send, or delete things without you noticing.
Key topics covered: · The app storenightmare: a new AI app store you don’t control · How a tricked document can make your AI act against you · A simple ZeroTrust plan anyone can start today · How to cut tool sprawl, cost, and risk—without slowing the team
Guest and Host Links: Rob Maas (Field CTO, ON2IT): https://www.linkedin.com/in/robmaas83/ Lieuwe Jan Koning (Founding Partner, ON2IT): https://www.linkedin.com/in/lieuwejan/
If this saved you a breach, subscribe to Threat Talks and follow ON2IT for weekly Zero Trust moves. New episode next week. | |||
| The Secret Diplomats Fighting Cyber Wars | 04 Nov 2025 | 00:49:03 | |
Cyber defense doesn’t just happen in code. It’s shaped in conversation. Behind every cyber norm or sanction, there’s a diplomat working to stop digital wars before they start.
In this episode of Threat Talks, Lieuwe Jan Koning (CTO & co-founder of ON2IT) sits down with Ernst Noorman, Ambassador at Large for Cyber Affairs for the Kingdom of the Netherlands. They reveal how backchannel talks, sanctions, and shared rules define what countries can and can’t do in cyberspace, and what CISOs can learn from a diplomat’s playbook. This isn’t patch management. It’s peacekeeping in real time.
Related ON2IT Content & Referenced Resources
If this episode gave you a new view on global cybersecurity, subscribe to Threat Talks. Share it with your team – because in a connected world, every company plays a role in cyber peace. | |||
| Patch Smarter, Not Harder | 28 Oct 2025 | 00:18:17 | |
Patch smarter, not harder.
Key Topics Covered · Why “patch everything immediately” fails; availability vs. security · Staged deployments and rollback safety for crown-jewel services · Zero Trust segmentation to reduce urgency and shrink attack surface · Priority signals that matter: asset criticality, exposure, KEV, CVSS Related ON2IT content & explicitly referenced resources | |||
| Public Key Infrastructure: The Foundation of Digital Trust | 21 Oct 2025 | 00:34:41 | |
How solid is your digital trust—or are you just hoping your PKI is secure? Additional Resources Guest & Host Links:
👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||
| Why Your Cyber Hygiene Matters? | 14 Oct 2025 | 00:21:53 | |
One unlocked phone can unravel the defenses of a billion-dollar enterprise—because in cybersecurity, small mistakes don’t stay small for long. Attackers can read notes, steal IDs, or impersonate you on WhatsApp. A reused password can launch a remote tool that looks completely legitimate. Rob Maas (Field CTO, ON2IT) and Luca Cipriano (Cyber Threat Intelligence Program Lead, ON2IT) reveal how poor cyber hygiene erodes trust, endangers partners, and weakens enterprise defenses.
What You’ll Learn (From Real-Life Example Discussions) • How a stolen phone quickly turns into identity theft, impersonation, and scams targeting your contacts. • A real SOC case: a contractor’s reused password allowed attackers to hide a remote access tool inside normal IT activity. • How OSINT and dark web data reveal how password reuse spreads risk across accounts. • Why shared tools like Google Docs can quietly multiply breaches when one user slips up. • Simple upgrades—MFA, password vaults, breach alerts, and secure devices—that cut your organization’s exposure fast. Click here to view the episode transcript. Guest and Host Links: If this helped, subscribe to Threat Talks. Share this episode with your partners and contractors—stronger cyber hygiene across your ecosystem protects everyone. 🔔 Follow and Support our channel! 🔔 👕 Receive your Threat Talks T-shirt 🗺️ Explore the Hack's Route in Detail 🗺️ 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX | |||