Technology

Breach Please

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the “experts” in your feed have never actually responded to an incident at 3 a.m.

Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about.

Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn’t, and translate the never-ending chaos into something you can actually use — whether you’re in the SOC, the boardroom, or somewhere pretending to understand both.

No fear-mongering. No vendor scripts. No “synergizing our threat posture.” Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud.

Breach? Please. Pull up a chair.

Latest Episodes:

S0:E36 - Jake Talks to Exaforce about Data vs APIs in AI-enabled SOC Sep 17, 2026

Show notes

In this episode, Jake sits down with one of Exaforce's co-founders and a long time user to discuss AI-enabled SOC. One of the big things we talk about is why API-based solutions miss a lot of context that is only really possible to generate with an underlying data model. We also talk about dogs and cats at the end for some fun personal discussions. Jess will be back tomorrow for more fun security banter.

S0:E35. Update Yo Firewall Rules and Digital Escorts (totally SFW) Sep 16, 2026

Show notes

In this episode, Jake and Jess talk about an upcoming critical change to domains for M365 and Teams that are ironically going to disproportionately impact those with the best security the most. We conclude this is busy work that MSFT is causing. Then we take a hard right into talking about Microsoft's Digital Escort (sounds dirty, but somehow is totally SFW) program, revealed by ProPublica. It's older news, but Jess hadn't heard about it and there's gold in them there hills.

Digital Escorts: https://www.propublica.org/article/microsoft-china-defense-department-digital-escorts-investigation-warning

Teams and Copilot (sadly somehow now M365) moving domains: https://www.computerworld.com/article/4221272/teams-and-copilot-are-changing-addresses-update-your-firewalls.html

S0:E34. Jake and Stel talk zero-trust and validating network edge devices. Sep 15, 2026

Show notes

Jake and Jess will be back tomorrow for more content together. In this episode of Breach Please, Jake sits down with Stel Valavanis, co-founder of Blue Team Con. They discuss how for too long, we've known that network edge devices needed to be part of the zero trust equation, but put them in the "too hard" bucket of security because we didn't have tools to monitor them. Stel talks about the formation of a new company, Kyrient that Jake is both the inventor of the core technology of and an advisor for, that's hoping to address this. The key point that we try to make that is that we're blind today to most network device compromises and that's not a state of affairs that can continue in a modern security environment.

S0:E33 - (re-record) The EU CRA and You (even if you aren't an EU company) Sep 14, 2026

Show notes

Folks, our apologies. We didn't realize how bad the audio was with a given microphone/computer setup was for Riverside (our recording platform). We re-recorded and honestly, not only is the audio better, but it's a MUCH better episode overall.

On September 11, 2026, reporting requirements baked into the EU Cyber Resiliency Act came into force. The requirements apply to any vendor that sells or makes available for sale digital products (including SaaS, yes, you too) in the EU. You don't have to be an EU company. Reporting timelines are extremely tight, with 24 and 72 hour initial triggers. Fines for noncompliance are huge. This is something several of our clients don't realize applies to them, so we figured it was a good idea to do an episode on it.

We're not lawyers, so you should read what some actual lawyers wrote on the subject if you want more information:

https://www.taylorwessing.com/en/insights-and-events/insights/2026/09/cra-reporting-requirements

S0:E32 - Where Traditional EDR Has Visibility Gaps with Golan Myers from Bloom Security Sep 13, 2026

Show notes

In this episode, I sit down with Golan Myers with Bloom Security and discuss what EDR is missing in its visibility. We then discuss some of the findings from his research and Bloom Security and what they're doing to solve the problem.

https://www.linkedin.com/in/golan-myers/

https://bloom.security/

S0:E31 — They Did Everything Right, and Still Got Burned Sep 11, 2026

Show notes

Trezor disclosed a breach affecting roughly 67,000 US customers, data from orders placed between November 2019 and August 2021. The twist: Trezor had repeatedly requested and received written assurance that this data was deleted, in line with their contract and data policy. It wasn't. Jess and Jake use this as a real-world case study in third-party risk management, why "right to audit" is often a paper tiger control nobody budgets to actually use, and why this is the exact kind of story to proactively brief leadership on before it happens to you.

Second half: a wave of CVEs in PaperCut, the managed print service used heavily in schools and enterprises, letting attackers remotely take over print servers running as SYSTEM. Jess and Jake talk through why that's a bigger deal than it sounds (credential theft, lateral movement, and every sensitive document that crosses the print queue), why these servers so often end up exposed to the internet, and how to actually think about vulnerability risk beyond raw CVE counts.

In this episode:

Trezor's breach: third-party vendor data that should have been deleted years ago, wasn't
Why "right to audit" contract language rarely gets used, and what to do instead
Reducing blast radius: don't retain data you don't need, and if you must, wall it off behind a jump box
How to brief leadership proactively: "we can do everything right and still get burned"
PaperCut's remote takeover CVEs: SYSTEM-level access, credential theft, and lateral movement
Why print servers end up internet-exposed (BYOD, guest Wi-Fi, mobile printing)
CVE count vs. actual risk: reading vulnerability history like an engineer, not a scorecard
A tone-deaf vendor sales pitch that used their own vulnerability disclosures as a selling point

Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. Nothing in this episode is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

S0:E30 — WeChat's Zero-Click Worm Didn't Need AI to Be Scary Sep 09, 2026

Show notes

Researchers at security firm Calif found a zero-click exploit chain in WeChat: place a call, the target doesn't even have to answer, and you get code execution on their phone. Chain it with other bugs and you get full device control, on both iOS and Android. Tencent patched it. The bigger problem started after, when the New York Times ran a headline blaming an AI model for building a computer worm that could rapidly hack WeChat accounts.

Jess and Jake walk through what the researchers actually did (AI sped up the process, it didn't discover or weaponize anything on its own), why "the model built a worm" is the kind of sensationalism that makes their actual jobs harder, and why this is fundamentally an attack surface story, not an AI story or even really a WeChat-specific one.

In this episode:

The WeChat zero-click exploit: how it works, and why the caller needs to already be a contact
Chaining bugs to go from initial code execution to full device control
Why "the AI model built a worm" is bad reporting, and what it actually means when researchers say AI sped up their work
Why this is an attack surface conversation, not an AI-apocalypse one
The real cost of sensationalist headlines: talking execs down instead of focusing on what matters
Corporate messaging apps: WeChat, WhatsApp, and why "this is how the business communicates" isn't a security answer

S0:E29 — The GRE Tunnel That Wasn't in the Config Sep 08, 2026

Show notes

Sygnia published new research on Fire Ant, a threat actor they first tracked in 2025 around hypervisor espionage against vCenter and ESXi. The new report covers something rarer: live compromise of Cisco IOS XR network devices, discovered because a responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs. Jess and Jake walk through what that means for defenders, why IOS XR being Linux-based changes the economics of building a backdoor, and why "compromised network devices" remains one of the most underappreciated categories of incident today.

They also get into the ongoing mess of threat actor naming conventions (why one group can have a dozen different names across vendors, and why that's not just marketing), and revisit an earlier debate: is network device security part of zero trust, or a separate problem? Jake asked the internet. The internet had opinions.

In this episode:

Why one threat actor group ends up with a different name at every vendor, and why that's harder to fix than it sounds
Fire Ant: Sygnia's research on Cisco IOS XR compromise and a GRE tunnel that left no trace in logs or saved config
Why IOS XR being Linux-based lowers the cost of building a persistent backdoor from six figures to a scripting problem
The running-config-vs-saved-config trap during incident response
Why unencrypted internal traffic means a compromised network device gets credentials, not just topology
Man-in-the-middle terminology, RC4, Kerberoasting, and why alerting on SPN enumeration breaks down for an on-path attacker
Why network device security has to be part of zero trust, not an asterisk on it

S0:E28 — When "Unique Experiences" Means Everyone Looks the Same Sep 05, 2026

Show notes

Jess opened LinkedIn to a CISO certificate program announcement featuring its full guest lecturer roster. Every single one looked the same. Tarah Wheeler joins Jess and Jake for their first-ever guest episode to talk through why this particular miss is worse than a one-hour conference "manel," what accountability actually looks like when it happens (spoiler: it's not calling out names), and the real cost people pay for pointing it out in the first place.

They also get into an International Security paper on the offense-defense automation gap and why creativity and diverse thinking matter more on the attacker side than AI alone can replace, plus a trip down memory lane through some genuinely bad booth-babe decisions from Black Hat and RSA years past.

In this episode:

A CISO certificate program's all-white-male guest lecturer lineup, and why a training program is a different problem than a one-off panel
Why calling this out publicly carries real career risk, especially for the people left off
What accountability actually looks like: own the mistake, fix it, don't relitigate who's to blame
The double bind: get dismissed as "not qualified" or "not collegial" for speaking up
Diversity of thought vs. diversity of background, and why both matter for how you manage and lead
The offense-defense automation gap: why creativity in attack techniques resists automation in ways defense doesn't
A look back at some infamous industry moments and how far things have and haven't come

Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. For the first time, the opinions of our guest are hers alone and don't represent any employer, client, or official position. None of this is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

S0:E27 — The Agentic Ransomware Story That Wasn't Sep 04, 2026

Show notes

Palo Alto's Unit 42 published a report describing a fully automated, agentic AI ransomware attack, complete with an 80-page lessons-learned document the attackers supposedly left behind for the victim. It got picked up and ran with by outlets looking for the AI-apocalypse angle. Jess and Jake go through what the report actually says versus what got exaggerated in the retelling, and call out the pattern of vendors using AI-attack framing to sell their own AI-defense product.

Second half: a stolen API key with no spending cap burned through hundreds of thousands of dollars in usage before anyone noticed. Jess and Jake use it to talk through exposure management, reachability analysis, and toxic combinations, why chasing CVSS criticals alone is the wrong way to prioritize vulnerability management, and where AI can actually help defenders instead of just generating more hype.

In this episode:

Unit 42's "agentic ransomware" report: what checks out and what's marketing spin
Why "the threat actor used AI" doesn't mean the defense should be AI-shaped
Practical advice for stakeholders asking "how do I defend against AI-driven attacks"
Toxic combinations and why prioritizing by CVSS score alone fails
A stolen API key with no spending cap and the usage spike that followed
Exposure management, reachability analysis, and where AI genuinely helps defenders
Adam Shostack's updated threat modeling book and his PHANTOM-B threat model framework

Show notes:

Unit 42 report: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
The Register coverage: https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009
API key incident (The Register): https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730
Threat Modeling, 2nd Edition (preorder): https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1394413327
PHANTOM-B whitepaper: https://shostack.org/files/papers/PHANTOM-B_Whitepaper_Shostack.pdf

Our TOPPODCAST Picks

Follow Us

Stay Connected

Breach Please

Related Podcasts

Links

Stay Connected