Podcast Archives - Truth In Cyber

Your AI Pen Test Might Just Be an If-Then Statement

Every FRSecure client and prospect is getting the same pitch: an AI pen test that beats a human tester, for half the price. On Episode 6 of the Truth in Cyber podcast, Oscar Minks and Michael Kennedy asked Seth Bowling, R&D manager at FRSecure, to check that claim.

Seth’s team has spent most of this year testing about a dozen automated and “AI-enabled” pen testing tools. They ranged from free open source tools to expensive commercial products, and the team compared every one against real pen tests done by people. The tools came up well short.

Where’s the AI?

The biggest surprise: most of these tools barely use AI to run the test. Under the hood, it’s old-school automation, basically a long chain of if-then rules. The AI gets added at the end to write up the findings. That’s backwards, because judging what a finding means for your business is the one thing people still do better than AI.

AI is great at reading code and spotting flaws. It’s much weaker at the moment-to-moment judgment calls a real attack takes. The cutting-edge AI models that can do more are far too expensive to run for the $3,000 to $4,000 these vendors charge for a pen test.

“If you’re doing one pen test a year, your only pen test for the year should not be through an automated or AI product, period.”
Seth Bowling, FRSecure

Spend smarter

On a tight budget? Seth’s advice is to buy a good vulnerability scanner before an automated pen test. Many of these tools rely on free open source scanners that can’t match the established commercial ones.

Automated tools still have a place. Run them weekly to keep checking your defenses, then bring in human testers a couple of times a year.

Ask before you buy

Shopping anyway? Have the vendor run a demo on your own systems, and compare the results to your last pen test. Then ask two questions: what is the AI actually doing, and where does your data go during and after the test?

Seth expects truly AI-driven testing to improve fast. For now, it’s a supplement, not a replacement.

Catch the full episode to hear the rest.

Your CISO Is Running on Sleep Debt

Cyber Security, Podcast

The security industry has a burnout problem, and most companies are doing next to nothing about it. Steve Shelton, founder of Green Shoe Consulting, has the data. His research found that 41% of CISOs are operating at severe burnout levels.

On the latest episode of the Truth in Cyber podcast, Oscar Minks and Mel Kolinski sat down with Steve to dig into what’s really going on. Spoiler: that 41% is probably low.

CISOs are trained to keep quiet about stress, so they lowball it. One Fortune 100 CISO rated himself a 6 out of 10. Then he mentioned sleeping three hours a night, working from 3:30 a.m. to 11 p.m., and being on his third marriage. Steve’s verdict? More like a 15.

“We talk a lot in cybersecurity about technical debt. At Green Shoe, we talk about sleep debt.”
Steve Shelton, Green Shoe Consulting

That debt compounds. Run on empty long enough and your decisions, patience, and communication all take the hit. Those are the exact skills a security leader needs when things go sideways.

Burnout lives in the system

Being tired doesn’t automatically mean you’re burned out. The research defines it as three things stacked together: exhaustion, cynicism, and the sense that your work doesn’t matter. Thirty years of studies point to the same culprit, too. How an organization is built, from workload to resources to whether people feel safe speaking up, drives burnout far more than any individual weakness. A yoga app won’t fix a broken org chart.

Steal this move

Steve’s favorite check-in takes ten seconds. Ask your team, “On a scale of 1 to 5, where’s your energy right now?” If someone says 3, ask what’s draining them. Then ask what you can do to get them to a 4. The catch: if you ask and don’t follow through, you’ve opened a wound and walked away.

Oscar backs this up at FRSecure. He forces people to take PTO, spends most of his one-on-ones on how people are actually doing, and runs a monthly mental health bingo card with a gift card as the prize.

AI won’t save you

Think AI will lighten the load? Steve isn’t buying it. Any time AI frees up gets filled with more work, and it piles on a new stressor: the fear of becoming irrelevant.

Burnout is an industry problem with real fixes. Leaders just have to go first.

Catch the full episode to hear the rest.

Your Security Culture Might Be Made Up

Cyber Security, Podcast

Every company swears it has a security culture. Every exec says security is everyone’s job. Then something breaks, and suddenly nobody owns it.

On Episode 4 of the Truth in Cyber podcast, Michael Kennedy (Ostra Security) and Oscar Minks (FRSecure) welcomed Matt Lee from Pax8 to pick apart one of the most overused phrases in the industry. Matt didn’t ease into it.

“Security culture is a way for us to define something we haven’t solved, and we say we can just culturally solve this.”
Matt Lee, Pax8

His example: a concrete company that has to hit a job site every 30 minutes doesn’t talk about “truck culture.” It buys spare trucks, runs a repair shop, and keeps backup crews on call. The company decided what matters and paid for it. Security deserves the same treatment: real budget, a real owner, and systems that make the right move the easy one.

Quit dunking on your users

Users take the blame for everything. Matt’s take is that they get it right almost all the time, and when they slip, somebody usually handed them a flimsy setup. If 92% of your people didn’t click the phish, maybe lead with that.

Oscar shared a story about a company that gave a candy bar to anyone who reported something sketchy, mistakes included. At FRSecure, the top phishing reporter each quarter is usually a salesperson. That’s the number worth watching. Report rates tell you way more than click rates ever will.

Leaders go first

If the people at the top don’t care, nobody else will either. Matt pointed to the Govern function recently added to NIST CSF 2.0 and the CIS Controls, which he boils down to “the will of a company enacted.” Pick a framework and actually live it. Checking boxes for an auditor doesn’t count.

Nobody on the panel claimed to have it all figured out. They did agree the industry needs to stop admiring the problem and start owning it.

Catch the full episode for the rest, including the day Oscar was convinced his bulldog hacked him.