Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most MSP client reviews cover what got installed. The endpoint agent was deployed, the firewall rules were tuned, and the tickets were closed inside the SLA. Meanwhile, boards, insurers, and auditors are asking for something more: a clear account of the business's current security and compliance risks. The partner who can provide that answer earns client trust and increases credibility.

This week on the podcast, we break down how a heap overflow in an image-decoding library nobody thinks about became a pull request inside OpenAI's internal monorepo. Three researchers chained it with an OpenAI single sign-on flaw to hijack employee ChatGPT and Codex accounts in under 72 hours; and had an AI write the exploit for them. Before that, we cover the actively exploited maximum-severity authentication bypass in Cisco's Identity Services Engine. Then we close with RatHat, a new Android malware that enables Wireless Debugging, reads its own pairing code from the screen, and asks a commercial AI assistant where to tap.

Artificial intelligence is no longer a future consideration for MSPs because it is already reshaping how leading providers run their businesses, protect their clients, and create new revenue streams. Separating real business value from hype requires a clear-eyed, practitioner-driven perspective.

This week, dive into OpenAI's and METR's analysis of the rogue OpenAI agents that hacked Hugging Face back in July. We go over the full attack timeline discussing the multiple message boards the agents created and the ultimate goal of their attack against Hugging Face and trust us, its as crazy as it gets. Before that, we discuss a recent dark web service that popped up selling 153 million stolen drivers licenses before discussing a research post into a malware implant discovered in inexpensive Chinese routers.

AI should do more than generate answers. It should help MSPs make better decisions. Many MSPs are experimenting with AI, but isolated tools and generic prompts often create more noise than value. Without the right questions, workflows, and operational foundation, AI can become another disconnected technology to manage rather than a meaningful driver of security and growth. This webinar explores five practical AI prompts every MSP should know, and how to apply them across security, service delivery, operations, and business strategy.

This week, we sit down with Euler Neto, a cybersecurity analyst at WatchGuard, to discuss his research into the ErrTraffic Malware-as-a-Service loader found targeting Portuguese-speaking users in recent months.

This week on the podcast, we discuss a research post that defines a new attack technique against AI tools called Cryptographic Context Injection. Before that, we cover an authentication bypass vulnerability in CircleCI's MCP server after discussing 3.6 million records stolen from the Azure tenants of several large organziations.

Employees are increasingly adopting AI tools, working across unsecured networks, and bypassing established security practices, often without their organization's knowledge. The result is a growing class of cybersecurity risks that traditional security controls alone cannot address.

This week on the podcast, we discuss a new White House memorandum that creates a program to authorize American private companies to begin conducting offensive cyber operations. Before that, we discuss a vulnerability write up for a Citrix Netscaler flaw before covering yet another prompt injection vulnerability in a popular AI tool.

Attackers can bypass MFA through stolen sessions, phishing, and MFA fatigue.