The Cyber Resilience Brief: A SafeBreach Podcast

Ep. 31 - From Exercise to Efficacy: Resilience as a Measurement

In this final episode of our November Critical Infrastructure series, The Cyber Resilience Brief host Tova Dvorin and SafeBreach offensive engineer Adrian Culley explore what it truly means to measure resilience — not just talk about it.They break down how the CISA resilience framework (“Know, Assess, Plan, and Continuously Improve”) connects directly to modern validation tools like Breach and Attack Simulation (BAS), Adversary Exposure Validation (AEV), and Continuous Red Teaming (CART).
Discover how organizations can move from tabletop exercises to quantifiable, data-driven resilience metrics, bridging the gap between security plans and operational reality. Learn how continuous validation transforms cyber defense from a cost center into a measurable return on security investment (ROSI) — and why resilience should be treated as a living capability that evolves alongside adversaries.

Ep. 30 - Bridging IT and OT - A Unified Red Team View

As IT and OT environments converge, critical infrastructure faces an evolving threat landscape where cyberattacks can have real-world, physical consequences. In this episode of The Cyber Resilience Brief, host Tova Dvorin and Adrian Culley, Offensive Cybersecurity Engineer at SafeBreach, explore how Continuous Automated Red Teaming (CART) delivers a unified approach to testing and securing IT/OT boundaries. Learn how continuous validation, segmentation assurance, and evidence-based remediation help organizations protect industrial control systems (ICS) and SCADA environments—without disrupting operations. Discover how to align with CISA’s resilience principles, reduce mean time to remediation (MTTR), and strengthen cyber-physical resilience through continuous, safe validation.

Ep. 29 - The Domino Effect: Validating Supply Chain and Dependencies

In this episode of The Cyber Resilience Brief, hosts Tova Dvorin and Adrian Culley explore the domino effect of supply chain vulnerabilities within critical infrastructure. Using real-world examples like SolarWinds, MOVEit, and Log4j, they unpack how a single compromised vendor can ripple across entire sectors—and how Adversary Exposure Validation (AEV) can help break that chain.
Adrian explains how AEV models third-party attack paths and validates resilience across shared dependencies, while Tova highlights the widening IT/OT gap and why Continuous Automated Red Teaming (CART) is essential to maintaining ongoing protection.
Tune in to learn how to move beyond “point-in-time” testing and keep your organization’s defenses resilient in a constantly evolving ecosystem.
 

Ep. 28: Critical Infrastructure’s Unique Validation Challenge

In this episode of The Cyber Resilience Brief, host Tova Dvorin and SafeBreach offensive security engineer Adrian Culley explore the high-stakes world of critical infrastructure cybersecurity. November marks Critical Infrastructure Security and Resilience Month, and the discussion dives deep into why continuous validation — not periodic testing — is essential for protecting energy, water, finance, and healthcare systems from nation-state threats.
Learn how Breach and Attack Simulation (BAS) can safely test IT/OT boundaries, validate segmentation controls, and transform compliance efforts from “check-the-box” to “prove-the-box.” Discover how SafeBreach empowers critical infrastructure organizations to achieve resilient, safe, and measurable security efficacy without disrupting operations.

Ep. 27 - The Evolution of ShinyHunters: From Data Theft to Weaponized Trust

The ShinyHunters threat group has transformed from a dark-web data broker into one of the most dangerous alliances in modern cybercrime. In this episode of The Cyber Resilience Brief, host Tova Dvorin and Adrian Culley, Offensive Security Engineer at SafeBreach, break down how the group’s merger with Scattered Spider marks a new era of as-a-service cybercrime — one built on social engineering, AI-powered vishing, and the exploitation of trust in SaaS ecosystems like Salesforce and Snowflake.
Discover:
How AI-enhanced vishing is bypassing even multi-factor authentication (MFA).
Why identity and OAuth tokens are now the new security perimeter.
How supply-chain exploitation is redefining enterprise risk.
What organizations can do using Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Adversarial Exposure Validation (AEV) to stay resilient.
This is more than a cybercrime story — it’s a blueprint for defending against the next generation of trust-based attacks.

Ep. 26: The Cyber Resilience Playbook

In the finale of our Cybersecurity Awareness Month series, SafeBreach’s Cyber Resilience Brief delivers its most powerful episode yet — The Cyber Resilience Playbook.
Join hosts Tova Dvorin and Adrian Culley as they connect the dots between Breach and Attack Simulation (BAS), Adversarial Exposure Validation (AEV), and Continuous Automated Red Teaming (CART) — revealing how these validation layers work together to create a unified framework for cyber resilience.
Discover how organizations can:
Continuously validate their security controls against real-world threats
Prioritize remediation with threat-driven exposure validation
Operationalize resilience with automated red teaming
Transform cyber awareness into measurable resilience all year long
This episode goes beyond compliance and awareness training — it’s a blueprint for security teams to prove and improve their defenses, optimize spend, and keep their organizations resilient against evolving threats.

Ep. 25: Beyond the Drill: The Power of Continuous Automated Red Teaming (CART)

How can security teams stay truly proactive in a world where adversaries never stop?In this episode of The Cyber Resilience Brief, hosts Tova Dvorin and Adrian Culley explore Continuous Automated Red Teaming (CART) — the next evolution in proactive security validation.
They break down how CART extends beyond traditional red teaming and breach simulation, combining automation and intelligence to deliver 24/7, real-time attack validation. Learn how CART helps organizations:
Continuously test and optimize their security controls
Detect misconfigurations and vulnerabilities before adversaries do
Strengthen overall cyber resilience and operational readiness
Whether you’re a CISO, SOC leader, or security engineer, this conversation offers practical insights into how CART and AEV can work together to create a truly continuous defense strategy.Read more about CART on our blog. 

Ep. 24 - BrickStorm: From LoTL to "Living Off the Blind Spot"

In this episode of The Cyber Resilience Brief, host Tova Dvorin and SafeBreach offensive security expert Adrian Culley unpack BrickStorm — a highly sophisticated espionage operation attributed to China-nexus group UNC5221. With an average dwell time of 393 days, this campaign redefines stealth and persistence in cyber warfare.
Discover how attackers are “living off the blind spot” by exploiting critical infrastructure gaps in VPNs, VMware vCenter servers, and ESXi hosts — areas traditional security tools can’t see. Adrian breaks down their use of Go-based malware, delayed activation, and a genius offline credential theft technique that clones virtual machines to exfiltrate data undetected.
The episode also explores the strategic implications of this new evolution in supply chain attacks, where adversaries steal today to weaponize tomorrow, and how organizations can defend themselves through proactive security testing, Breach and Attack Simulation (BAS), and Continuous Automated Red Teaming (CART).
Key topics:
UNC5221’s long-term espionage and data exfiltration tactics
How attackers evade EDR and traditional defenses
Why BrickStorm represents the “next level” in nation-state cyber operations
How BAS and CART expose and close blind spots before attackers do

Ep. 23 - Zeroing In on Adversary Exposure Validation (AEV): Moving Beyond Vulnerability Management

In episode 2 of our special 4-part Cybersecurity Awareness Month series, The Cyber Resilience Brief hosts Tova Dvorin and Adrian Culley dive deep into Adversary Exposure Validation (AEV) — the next evolution of Breach and Attack Simulation (BAS) and Continuous Threat Exposure Management (CTEM).
Learn how AEV helps organizations move beyond endless vulnerability lists to validate exposures that real adversaries exploit, prioritize based on active threat intelligence, and shift from reactive defense to continuous cyber readiness.
Featuring insights on SafeBreach’s attack library, MITRE ATT&CK mapping, and why “patch and proceed is dead,” this episode reveals how AEV empowers security teams to focus on risk-driven validation that truly strengthens cyber resilience.

Ep. 22 - Scattered Spider's Declaration of War: Deconstructing the Threat

In this urgent episode of The Cyber Resilience Brief, host Tova Dvorin and Adrian Culley, Offensive Security Engineer at SafeBreach, break down the shocking manifesto released by Scattered Spider — also known as Lapsus$ and ShinyHunters — the same threat group now linked to the Jaguar Land Rover cyberattack that’s suspected to have Russian ties.
As geopolitical tensions rise and Russia’s hybrid cyber warfare intensifies, Scattered Spider’s public “declaration of war” marks a chilling shift: from quiet ransomware operations to open intimidation of Western governments and Fortune 500 companies.
Tova and Adrian unpack how this group combines social engineering, identity theft, and psychological warfare to paralyze organizations — and how companies can fight back using Breach and Attack Simulation (BAS) and Continuous Automated Red Teaming (CART). Don't forget to check out our earlier episodes as well on Scattered Spider (Ep. 15) and on Adventures in the Dark Web (Ep. 17) for more context for this red-hot topic. 
We also published blogs on Scattered Spider and on what it's like to talk to hackers on the Dark Web.