August 21, 2026 • 3 mins
In this episode, Alex and Jen discuss Paubox's new PDF import feature for HIPAA compliant forms, unified scoped API keys, and the latest IBM data on healthcare breach costs, which remain the highest of any industry at $6.6 million on average. They also cover an emerging credential theft scam targeting professionals on X and share insights from a recent Paubox Table dinner in New York, emphasizing that most security vulnerabilities stem from fixable configuration issues rather than sophisticated attacks.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:00):
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:02):
And I'm Jen, your friendly neighborhood
cybersecurity person who's seentoo many phishing emails this
week.
SPEAKER_00 (00:08):
I'm Alex, healthcare IT guy.
And Jen, it's been a week.
Let's get into it.
SPEAKER_01 (00:13):
Alright, let's start with something that doesn't
involve a breach for once.
Powbox dropped PDF import forforms.
SPEAKER_00 (00:20):
Yeah, this is actually really useful.
You upload a fillable PDF, thoseacroforms everyone's been using
for years, and it converts itinto a HIPAA compliant online
form.
Fields and all.
SPEAKER_01 (00:32):
AI handles the field mapping, which, look, I'm
usually skeptical when someonesays AI handles it, but this
actually makes sense.
Detecting form fields isn'texactly rocket science for a
model.
SPEAKER_00 (00:43):
And here's the part I love.
You can do this through ClaudeChatNow.
Same functionality through theSDKs, the CLI, the MCP server.
SPEAKER_01 (00:52):
So basically, if you have a PAL box API key, you can
spin up compliant forms withouttouching a dashboard.
SPEAKER_00 (00:58):
For the developers in the audience, that's huge.
One key to rule them all.
SPEAKER_01 (01:03):
Speaking of which, scoped API keys.
Finally.
SPEAKER_00 (01:07):
Right.
If you're building on more thanone PAL box product, you used to
juggle multiple keys.
Now there's one unified settingspage.
Create, edit, revoke.
All in one place.
SPEAKER_01 (01:19):
And each key has explicit scopes.
So you know exactly what it'sauthenticated to do.
SPEAKER_00 (01:24):
It's the kind of thing that sounds boring until
you're the one doing an accessaudit at 2 a.m.
Been there.
SPEAKER_01 (01:30):
Okay, let's talk about the fun stuff.
By which I mean healthcarebreach costs.
SPEAKER_00 (01:36):
13th year in a row.
Highest of any industry.
SPEAKER_01 (01:39):
$6.6 million average.
And here's the kicker.
One in four malicious breachesthis year were AI enabled.
SPEAKER_00 (01:47):
Deep fake impersonation, AI-generated
malware, it's not theoreticalanymore.
SPEAKER_01 (01:52):
No, but, and this is important, organizations using
AI for defense saw breach costsdrop by nearly 2 million on
average.
SPEAKER_00 (02:01):
So the tool cuts both ways.
SPEAKER_01 (02:03):
It does.
The question is whether you'reusing it or just getting hit by
it.
SPEAKER_00 (02:08):
And speaking of getting hit, there's a
credential theft scam making therounds on X.
SPEAKER_01 (02:13):
Oh, this one's elegant, and I hate it.
You get a DM that looks like areporter from a major outlet
wanting to interview you.
You respond, they send ascheduling link.
And that scheduling page asksyou to log in with Google.
That's where they grab yourcredentials.
SPEAKER_00 (02:27):
It's Social Engineering 101, but wrapped in
a very believable package.
SPEAKER_01 (02:32):
The pattern matches what we've seen before.
Urgency, legitimacy, a loginprompt that feels normal.
If you're in communications orleadership, especially
healthcare, be paranoid aboutthese.
Verify through a second channel.
SPEAKER_00 (02:46):
Always.
SPEAKER_01 (02:47):
Always.
Alright, one more thing.
Palbox hosted a dinner in NewYork this week.
The Palbox table.
SPEAKER_00 (02:53):
Healthcare IT folks, entrepreneurs, business owners,
and apparently some veryquotable conversations.
SPEAKER_01 (03:01):
Someone said infrastructure is the moat.
SPEAKER_00 (03:04):
I love that.
And someone else mentionedlosing$5 million because they
couldn't or didn't log into aportal-based secure email.
SPEAKER_01 (03:13):
$1 million.
Because of a forgotten passwordor a bad UX.
SPEAKER_00 (03:17):
That's the thing.
It's rarely the sophisticatedattack.
It's the missed email, theunscoped key, the PDF that never
got digitized.
SPEAKER_01 (03:26):
Most of this stuff is fixable.
That's the theme.
Bad configurations, blind spots,not bad luck.
SPEAKER_00 (03:33):
So take a look at your API keys.
Audit your forms.
Train your team on socialengineering.
SPEAKER_01 (03:39):
And maybe don't click scheduling links from
strangers on X.
Solid advice.
That's it for this week.
Stay secure out there.
SPEAKER_00 (03:47):
And we'll see you next time.
You're listening to Pow Box Weekly, fully automated.
SPEAKER_01 (00:02):
And I'm Jen, your friendly neighborhood
cybersecurity person who's seentoo many phishing emails this
week.
SPEAKER_00 (00:08):
I'm Alex, healthcare IT guy.
And Jen, it's been a week.
Let's get into it.
SPEAKER_01 (00:13):
Alright, let's start with something that doesn't
involve a breach for once.
Powbox dropped PDF import forforms.
SPEAKER_00 (00:20):
Yeah, this is actually really useful.
You upload a fillable PDF, thoseacroforms everyone's been using
for years, and it converts itinto a HIPAA compliant online
form.
Fields and all.
SPEAKER_01 (00:32):
AI handles the field mapping, which, look, I'm
usually skeptical when someonesays AI handles it, but this
actually makes sense.
Detecting form fields isn'texactly rocket science for a
model.
SPEAKER_00 (00:43):
And here's the part I love.
You can do this through ClaudeChatNow.
Same functionality through theSDKs, the CLI, the MCP server.
SPEAKER_01 (00:52):
So basically, if you have a PAL box API key, you can
spin up compliant forms withouttouching a dashboard.
SPEAKER_00 (00:58):
For the developers in the audience, that's huge.
One key to rule them all.
SPEAKER_01 (01:03):
Speaking of which, scoped API keys.
Finally.
SPEAKER_00 (01:07):
Right.
If you're building on more thanone PAL box product, you used to
juggle multiple keys.
Now there's one unified settingspage.
Create, edit, revoke.
All in one place.
SPEAKER_01 (01:19):
And each key has explicit scopes.
So you know exactly what it'sauthenticated to do.
SPEAKER_00 (01:24):
It's the kind of thing that sounds boring until
you're the one doing an accessaudit at 2 a.m.
Been there.
SPEAKER_01 (01:30):
Okay, let's talk about the fun stuff.
By which I mean healthcarebreach costs.
SPEAKER_00 (01:36):
13th year in a row.
Highest of any industry.
SPEAKER_01 (01:39):
$6.6 million average.
And here's the kicker.
One in four malicious breachesthis year were AI enabled.
SPEAKER_00 (01:47):
Deep fake impersonation, AI-generated
malware, it's not theoreticalanymore.
SPEAKER_01 (01:52):
No, but, and this is important, organizations using
AI for defense saw breach costsdrop by nearly 2 million on
average.
SPEAKER_00 (02:01):
So the tool cuts both ways.
SPEAKER_01 (02:03):
It does.
The question is whether you'reusing it or just getting hit by
it.
SPEAKER_00 (02:08):
And speaking of getting hit, there's a
credential theft scam making therounds on X.
SPEAKER_01 (02:13):
Oh, this one's elegant, and I hate it.
You get a DM that looks like areporter from a major outlet
wanting to interview you.
You respond, they send ascheduling link.
And that scheduling page asksyou to log in with Google.
That's where they grab yourcredentials.
SPEAKER_00 (02:27):
It's Social Engineering 101, but wrapped in
a very believable package.
SPEAKER_01 (02:32):
The pattern matches what we've seen before.
Urgency, legitimacy, a loginprompt that feels normal.
If you're in communications orleadership, especially
healthcare, be paranoid aboutthese.
Verify through a second channel.
SPEAKER_00 (02:46):
Always.
SPEAKER_01 (02:47):
Always.
Alright, one more thing.
Palbox hosted a dinner in NewYork this week.
The Palbox table.
SPEAKER_00 (02:53):
Healthcare IT folks, entrepreneurs, business owners,
and apparently some veryquotable conversations.
SPEAKER_01 (03:01):
Someone said infrastructure is the moat.
SPEAKER_00 (03:04):
I love that.
And someone else mentionedlosing$5 million because they
couldn't or didn't log into aportal-based secure email.
SPEAKER_01 (03:13):
$1 million.
Because of a forgotten passwordor a bad UX.
SPEAKER_00 (03:17):
That's the thing.
It's rarely the sophisticatedattack.
It's the missed email, theunscoped key, the PDF that never
got digitized.
SPEAKER_01 (03:26):
Most of this stuff is fixable.
That's the theme.
Bad configurations, blind spots,not bad luck.
SPEAKER_00 (03:33):
So take a look at your API keys.
Audit your forms.
Train your team on socialengineering.
SPEAKER_01 (03:39):
And maybe don't click scheduling links from
strangers on X.
Solid advice.
That's it for this week.
Stay secure out there.
SPEAKER_00 (03:47):
And we'll see you next time.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.