Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ransomware recovery for healthcare IT depends on isolated recovery environments (IRE) and the ability to find clean data for patient safety. Jeremy Cathey shares insights on building cyber resilience by moving away from traditional disaster recovery toward a model that handles systemic cyberattacks. He details the three essential zones of an IRE: the clean room for forensics, the staging zone for validation, and the standby production environment where clinicians resume work.

Standard incident response is failing to keep pace with long-term threat campaigns. Adam Karcher from the FBI explains why the most effective security teams run their operations as an inverted offensive strategy, leveraging continuous adversary emulation to stop intrusions before they begin. Watch the full video on our channel.

MSP Unscripted Episode 1, featuring Alvaro Gonzalez (Assured Data Protection), discusses how MSPs can build repeatable, scalable cyber resilience services through productization, clean recovery, and operational best practices.

True infrastructure protection requires balancing public configuration diversity with active vulnerabilities found in the CISA KEV catalog. Watch the full video on our channel.

Investigators have turned the tables on one of the world’s most elusive regimes. After a security firm hired a man calling himself "Joseph," a team of private investigators did what no one had done before: they infiltrated a North Korean remote worker cell from the inside. Head to our YouTube channel and watch the full episode of To Catch a Thief, Season 2.

In the decade after Sony, North Korea learned something fundamental: Destructive cyberattacks make headlines. Financial cyberattacks make money. One year after Sony, North Korea pulled off one of the most audacious bank heists in history and reshaped cybercrime in the process. Today, the regime has expanded those same tactics into billion dollar cryptocurrency heists and sprawling money laundering schemes designed to evade sanctions and bankroll the state – and its nuclear weapons program.

Selena Larson, Staff Threat Researcher and Lead, Intelligence Analysis and Strategy at Proofpoint and Host of the DISCARDED podcast, joins host Caleb Tolin to detail the specific mechanics of device code phishing campaigns, revealing how adversaries exploit legitimate communication structures to capture administrative and enterprise access. The discussion centers on the rapid commercialization of cybercrime, highlighting the leak of specialized kits in late 2025 that catalyzed the democratization of sophisticated technical exploits.

It’s been nearly 12 years since North Korea launched its crippling attack on Sony Pictures Entertainment over a Seth Rogen film. Most Americans remember the celebrity leaks, the embarrassing emails, the Hollywood spectacle of it all. What they missed was the playbook: Why simply hack an organization when you can bleed reputations dry? Turn stolen data into psychological warfare. It was a model that would soon echo everywhere from Russian intelligence operations to modern ransomware gangs.

All North Korean IT worker schemes hinge on one thing: a willing participant in America. We found one, and knocked on her door. Experts have dubbed some of these Americans “laptop farmers.” The North Koreans call them “facilitators” – people willing to host multiple laptops in their home and happy to not ask too many questions. But identifying these people can be hard: unless you have access to a private Discord channel where North Korean IT workers talk freely among themselves.

Restoring data is only half the battle. You must validate every privileged account and device relationship before going back to production.