Decipher Security Podcast

John Hammond of Huntress joins Dennis Fisher to dive into the ClickFix attack episdemic, how these attacks work, what the payloads are, and what individuals and organizations can do to protect themselves against them.

This week we talk about all the news from THREATCON1, including why the idea of just patching faster doesn't work, how analysts handle threat actor communications in ransomware incidents, and what the NSA thinks of AI threats.

Today we have for you a buffet of zero days being exploited in edge security products, including Citrix and Fortinet, then we discuss the importance of communications from vendors when bad things happen, and finally we preview VulnCheck's THREATCON1, which takes place next week.

Ben Harris of watchTowr joins Dennis Fisher to walk through the Citrix NetScaler zero days that emerged over the weekend, from first detection of exploitation to reporting to finally some patches and why vendor communication is so vital in these cases.

Ryan Fetterman from Cisco Talos sits down with Decipher’s Lindsey O’Donnell-Welch to talk about ClosedQuorum, the first reported malware binary with an autonomous command-and-control. They talk about the wide range of ways threat actors are using AI, and useful detection strategies for AI-assisted attacks.

Links

Talos analysis: https://blog.talosintelligence.com/th...

The security and reliability of the code in AI models is a huge question mark, because the models are black boxes that aren't accessible to outsiders. Matt Fredrikson, professor at Carnegie Mellon University and founder of Gray Swan AI, joins Dennis to talk about the challenge of assessing these models and how a community of red teamers is trying to meet it.

Dennis joins from the last LabsCon conference, which featured amazing keynotes from Prof. James Mickens on AI reality and myths, Katie Moussouris on why humans are more vital than ever in security, and Dino Dai Zovi on using hardware to break attack chains,

You've heard all of the hysteria around the vulnpocalypse caused by AI-assisted bug hunting and the shrinking time to exploit window. Now Jeremiah Grossman dispels those myths and shows exactly what the data reveals about how many bugs are actually exploited and how long it takes for attackers to target them.

Christine Gadsby of BlackBerry, a longtime security executive, joins Dennis to talk about her extensive experience in cybersecurity, the evolution of security practices, the challenges of securing mobile communications, and the impact of AI on the security industry.

Ken Bagnall, founder and CEO of Silent Push, talks about the August National Security Presidential Memorandum (NSPM) on transnational cyber-enabled crime, how organizations can make “real impact” with cybercriminal disruption, and the challenges of measuring success in disrupting the cybercriminal ecosystem.

This week we discuss the two arrests in Australia of alleged members of the TeamPCP cybercrime group that has targeted the open source ecosystem, the US government's disclosure of intrusion activity by the Chinese QTFY threat actor, and finally the long report from OpenAI on the Hugging Face incident.

Nicole Ozer, who took the helm this year as the new executive director at the Electronic Frontier Foundation (EFF), talks to Lindsey O’Donnell-Welch about the fine line between AI empowering us and undermining our rights and privacy – and where the tipping point is.

This week we discuss the new White House memo on using private sector operators in offensive cyber operations, Lindsey's deep dive into the origins of the ExploitGym AI benchmark, and the rash of attacks on water utilities in the U.S.LinksInside ExploitGym: https://decipher.sc/2026/08/20/inside...White House memo: https://www.whitehouse.gov/presidenti...OpenAI post: https://openai.com/index/the-defender...

Adam Meyers of CrowdStrike joins Dennis to dive into the rapidly changing nature of both attacker and defender behavior in the AI age and how organizations need to shift their priorities to combat agentic threats. Then we talk about the new White House policy loosening the restrictions on private sector operators doing offensive cyper ops.

AI security pioneer and machine learning expert Gary McGraw helps Dennis separate the facts from fiction about the recent OpenAI, Meta, and Anthropic model escapes, what the real risks to enterprises are from agentic AI, and what he sees as the true threats on the horizon.