The authentic professional services agency with a raw & gritty podcast for intelligence & security pros

Social engineering has a reputation problem. Most people hear the term and think phishing, scams, and threat actors. AJ Nash and guest Ashley Stryker push back on that framing in this episode of Unspoken Security. The conversation opens by defining social engineering on its own terms: the act of understanding how people work and using that knowledge to get them to take a specific action. The technique itself is neutral. What determines whether it crosses a line is motive and outcome.

From there, the conversation moves into the mechanics. Urgency is one of the most effective social engineering tools threat actors use because time pressure cuts off critical thinking. Stryker argues that the real defense is not training people to recognize a specific type of phish. It is training them to pause before acting on anything that creates pressure around money or security. She also makes a pointed case against security awareness programs that raise awareness without giving employees something concrete to do. Information alone does not change behavior. Action does.

The episode closes with the show's signature "unspoken" segment, where Stryker shares the full story behind why she goes by her last name. It turns out there are several reasons, including a divorce, an ex-husband with the same first name, and a deliberate operational security strategy she has used since entering the cybersecurity field.

In this episode of Unspoken Security, host AJ Nash sits down with Dan O'Day, Senior Consulting Director at Unit 42 by Palo Alto Networks. Dan shares key findings from the 2026 Global Incident Response Report, built from over 750 real-world cyber incidents, covering four major threat trends reshaping the security landscape.

Dan breaks down how AI is compressing attack timelines at a dramatic rate. The fastest incidents now move from access to full impact in just 72 minutes, down from 285 minutes the year prior. Attackers are no longer breaking in. They are logging in, using stolen credentials, tokens, and API keys to move laterally and avoid detection. Identity is now the dominant attack surface, playing a material role in nearly 90% of Unit 42's investigations.

The conversation closes on a note of cautious optimism. Dan argues that over 90% of breaches stem from preventable gaps, meaning security is solvable. He outlines three priorities for defenders: empowering the SOC to act at machine speed, treating identity as the new perimeter, and securing the entire software supply chain from the first line of code to cloud runtime.

Download the Unit 42 Global Incident Response Report 2026 here: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report?utm_source=linkedin&utm_medium=social&utm_campaign=na&utm_content=pa001134

In this episode of Unspoken Security, host A.J. Nash sits down with Cynthia Kaiser, SVP at Halcyon’s Ransomware Research Center. They explore how ransomware grew from a niche crime into a business, and why security teams now face faster attacks, extortion, and a threat landscape that blurs crime and state activity.

Cynthia traces the shift from early encryption schemes to double and triple extortion, then explains how professional crews use access brokers, deepfakes, and AI-assisted phishing to move in hours, not weeks. She also breaks down how Russian-speaking groups, Iranian actors, and state-linked operations use cybercrime for profit, cover, and pressure.

She argues that defenders still need the basics: harden identity, patch fast, assume breach, and build response plans that include PR. Cynthia closes with a blunt point: ransomware and fraud are not side issues. They hit hospitals, businesses, and families every day in ways nation-state threats often do not.

In this episode of Unspoken Security, host A.J. Nash sits down with Erin West, Founder at Operation Shamrock. They explore the “scamdemic” and the scams draining wealth at industrial scale. Erin explains why business email compromise, government impersonation, and romance scams work so well: they use fear, trust, urgency, and loneliness.

She then breaks down pig butchering, a long con that starts with a stray text and grows into a fake relationship and a fake crypto investment. Victims think they are building love and wealth at the same time. Instead, scammers push them to empty savings, tap retirement accounts, and borrow more.

Erin also exposes the system behind the fraud. Many scammers are trafficking victims forced to work inside compounds in Cambodia, Myanmar, and beyond. She argues this is both a financial crime and a human rights crisis, and she calls for stronger reporting, public awareness, and international pressure.