Attackers only need to get lucky once. More controls mean better security. AI can handle the heavy lifting. We hear these ideas so often that we rarely stop to question them, but do they hold up?
In episodes 13-17 of The Art of Security podcast, co-hosts Tyler Reguly and Josh Davies put these ideas to the test. Two Fortra experts join the conversation along the way, one on calendar-based phishing and one on AI-powered red teaming. If you're behind, here's what you need to know.
Who Really Holds the Cheese? Cat and Mouse, Reconsidered
You know the line: defenders have to be right every time, but attackers only have to get lucky once. Tyler and Josh wonder if that gives attackers too much credit. They explore how layered security, deception, active defense, preparation, and threat intelligence can tip the scales toward defenders, and whether the cat-and-mouse idea works the same for an enterprise as it does for you at home. The takeaway is that security doesn't have to be purely reactive, and you can make attackers work harder.
So, who really holds the cheese?
Are You Making It Too Easy for Cyberattackers?
Be honest: could an attacker get to you without much effort? Exposed credentials, public information, weak MFA, and security shortcuts can leave the door wide open.
For Cybersecurity Awareness Month, Tyler and Josh share how to stop making attacks so easy, from call screening and limiting your public information at home to executive impersonation, AI-assisted phishing, and process weaknesses at work. The big idea is security friction. Application allowlisting, stronger MFA, independent verification, restricted PowerShell access, and web filtering may add a few steps, but they make attacks more costly, difficult, and risky. Small business owners, stay for the closing advice on foundational controls and working with experienced security consultants.
Do Your Security Controls Work or Just Look Impressive?
A dashboard full of green checkmarks sure feels good, but does it mean you're safer?
Tyler and Josh dig into the difference between communicating security well and just performing it. They question whether metrics like alerts triaged, vulnerabilities patched, and detections created show real progress, and how threat hype and named vulnerabilities pull limited time away from higher-priority risk. Checkbox compliance, product marketing, and the pressure to look busy get a turn, too. Their advice is to start with visibility and clearly assigned asset ownership, then prove your controls work without leaning on misleading ROI calculations.
CalPhishing: When Calendar Invites Become the Lure
When was the last time you thought twice about a calendar invite? Attackers are counting on "never."
Fortra security engineer and FIRE team member Daud Jawad joins Tyler and Josh to explain the comeback of CalPhishing. Daud walks through how attackers use legitimate calendar workflows, HTML content, attachments, spoofed organizers, and trusted platforms to slip past defenses, and why a familiar workflow gets people to let their guard down. They also cover what attackers are after, including credentials, session tokens, OAuth consent, and device codes. To fight back, they suggest rethinking how your organization processes calendar invitations, educating users, verifying requests on another channel, and running calendar-based phishing simulations.
AI-Powered Red Teaming: Where Automation Works and Where It Falls Short
AI can speed up red team operations, but how much freedom is too much when production systems and sensitive data are involved?
Josh sits down with Pieter Ceelen, co-founder of Fortra's Outflank, to talk it through. Pieter shares where AI helps most, including reconnaissance, vulnerability research, initial access, reporting, and post-exploitation analysis. He also explains why fully autonomous testing calls for caution and how rules of engagement need to change. They weigh automation against operational risk and reward and wonder how AI will shape the skills of the next generation of penetration testers, vulnerability discovery, and zero-day research. Throughout, they keep coming back to human judgment and accountability.
Ready to Catch Up?
Whether you're rethinking your defenses, tightening up your everyday habits, or checking whether your controls really work, there's something here for you. Pick the episode that matches what's on your plate right now and start there. Then subscribe to The Art of Security on Apple Podcasts, Spotify, or YouTube so you stay ahead of the next batch.
