Inside Cyber Minds

About Inside Cyber Minds

Step inside the minds of cybersecurity leaders. Hosted by Luciano Ferrari, Inside Cyber Minds explores how professionals in security think, lead, and keep learning in an industry that never slows down. Each episode dives into honest conversations about growth, imposter syndrome, leadership, and the human side of cybersecurity — reminding us that even the experts are still figuring it out. 🎙️ Part of the Lufsec Podcast series. 🧠 Conversations that shape security.

Publisher

Luciano Ferrari

Category

technology

Language

en

Explicit

No

First episode

5 Nov 2025

Latest episode

7 Oct 2026

Latest episodes

23 episodes in the feed.

1. 

   7 Oct 2026

   "I'm Good at Robbing Banks" — Jayson E. Street on Silver Teaming | Inside Cyber Minds S3E9

   Inside Cyber Minds S3E9 — Jayson E. Street: hacker, author, and "scientific hooligan" on robbing banks with permission, silver teaming, why security awareness training fails, and why hacking is not a crime. Recorded onsite at DEF CON.🛡️ This episode is all about social engineering, physical security, and the human side of hacking. To build practical offensive security skills, explore LufSec's cybersecurity courses and hands-on training: 👉 https://www.lufsec.com/courses/?utm_source=youtube&utm_medium=onramp&utm_campaign=career-guide-funnel&utm_content=s3e9-courseWe open Cybersecurity Awareness Month with one of the most recognizable humans in the hacker community: Jayson E. Street — hacker, author of the Dissecting the Hack trilogy, DEF CON Groups global ambassador, Hack Not Crime ambassador, and self-described "hacker helper human" — recorded onsite at DEF CON.Jayson has spent years walking into banks and government buildings around the world and robbing them — with permission (except that one time he robbed the wrong bank by accident). In this conversation he explains what all those break-ins taught him: in almost every case, the people didn't fail. Management failed them, by never empowering employees to question, to verify, to be the "roadblock" that stops an intruder.He takes us inside silver teaming — the approach he created in 2016, where instead of writing a report about who failed the audit, he lets himself get caught, then personally walks every person he compromised through exactly how it happened. Not a test. A teachable moment. He guarantees every client that he will get caught — because a red teamer rooting for their client to fail is doing it wrong.We also get the story behind "scientific hooligan" (it starts with a magician hacking an "unbreakable" encrypted telegraph in the 1800s), why Nikola Tesla and Hedy Lamarr were hackers, why calling cybercriminals "hackers" insults actual hackers, and his answer to the AI panic: the blacksmiths who adapted became mechanics — "if you can be replaced by AI, you could be replaced by a small shell script already."This episode is about the human layer: situational awareness over policy, teaching through stories, kindness as a security strategy, and why the hacker mindset has nothing to do with computers.Topics CoveredWho is Jayson E. Street — "hacker helper human" From blue team at a bank to robbing ten branches Silver teaming: getting caught on purpose as training The government facility epiphany that changed his career Why security awareness fails — and situational awareness works Empowering employees to question and verify Teaching security through fiction: the Dissecting the Hack trilogy Hack Not Crime: Tesla, Hedy Lamarr, and the black hat/white hat myth Advice for newcomers: imposter syndrome, failing, and community AI: blacksmiths became mechanics — adapt, don't panicAbout Jayson E. StreetJayson E. Street is a hacker, speaker, and author of the Dissecting the Hack book series — required reading at colleges in several countries. He is a DEF CON Groups global ambassador, a Hack Not Crime ambassador, and a simulated adversary with CovertSwarm, famous for permission-based bank and building "robberies" on five continents.🌐 https://jaysonestreet.com/ 🐝 https://covertswarm.com/About Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by LufSec featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and security leaders. The show focuses on mindset, decision-making, leadership, security culture, emerging threats, and the human side of cybersecurity.LinkedIn → https://www.linkedin.com/company/lufsec/Jayson E. Street Hacker, Author & Simulated Adversary https://jaysonestreet.com/ https://covertswarm.com/#Cybersecurity #SocialEngineering #JaysonEStreet #Hackers #RedTeam #SecurityAwareness #PhysicalSecurity #HackNotCrime #InfoSec #DEFCON #InsideCyberMinds #LufSec

2. 

   30 Sept 2026

   Inside Cyber Minds S3E8 — James Kettle: The AI That Invents New Attacks & Why HTTP/1.1 Must Die

   Inside Cyber Minds S3E8 — James Kettle, Director of Research at PortSwigger (Burp Suite), on HTTP request smuggling, why HTTP/1.1 must die, and the HTTP Terminator — an AI that invents novel attack techniques. Recorded onsite at DEF CON.🎓 Bonus: download the guide, and you'll unlock a free lesson from the LufSec course library.🛡️ This episode is all about web security research, offensive techniques, and AI-powered hacking. To build practical web hacking and offensive security skills, explore LufSec's cybersecurity courses and hands-on training: 👉 https://www.lufsec.com/courses/?utm_source=youtube&utm_medium=onramp&utm_campaign=career-guide-funnel&utm_content=s3e8-courseSeason 3 of Inside Cyber Minds continues with an episode recorded onsite at DEF CON with James Kettle (albinowax), Director of Research at PortSwigger — the company behind Burp Suite — and one of the most influential web security researchers of the last decade.If you've ever heard the terms HTTP request smuggling, web cache poisoning, or the single-packet attack, you've seen James's work. For roughly ten consecutive years he has taken the Black Hat USA stage with research that changed how the industry attacks and defends the web, and his techniques are built into the tools millions of security testers use — Burp Collaborator, Param Miner, Turbo Intruder, and the Web Security Academy.This year he brought something different: the HTTP Terminator — an autonomous AI system built to answer a provocative question. Can AI do novel security research? Not triage, not scanning: actually inventing new desync triggers, gadgets, and exploits — and proving them against real-world targets including banks, security vendors, and government systems. And he's open-sourcing it.We also dig into his campaign to kill HTTP/1.1 — why the protocol underneath most of the web is fundamentally unfixable, what "the desync endgame" means, and what has to happen before the industry finally moves on.This episode is about research at the frontier: how new attack classes get discovered, what AI changes about the economics of finding them, and what's left for human researchers when machines start inventing exploits.Topics CoveredHow James got into web security research The origin of HTTP request smuggling and desync attacks Why HTTP/1.1 must die — and what the desync endgame looks like The HTTP Terminator: an AI that invents novel attack techniques Testing AI-discovered exploits against banks, vendors, and governments Can AI do novel security research — or just scale old ideas? Building tools for millions: Burp Collaborator, Param Miner, Turbo Intruder The research process behind a decade of Black Hat talks What's left for human researchers in the AI era The next great attack surface on the webAbout James KettleJames Kettle (albinowax) is the Director of Research at PortSwigger, the company behind Burp Suite. He pioneered HTTP desync attacks, web cache poisoning, the single-packet attack, and server-side template injection exploitation, and designed much of the Web Security Academy. His 2026 Black Hat USA and DEF CON research, "Can AI Do Novel Security Research? Meet the HTTP Terminator," introduces an open-source autonomous system for discovering new attack techniques.🌐 https://jameskettle.com/ 🔧 https://portswigger.net/About Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by LufSec featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and security leaders. The show focuses on mindset, decision-making, leadership, security culture, emerging threats, and the human side of cybersecurity.LinkedIn → https://www.linkedin.com/company/lufsec/James Kettle Director of Research, PortSwigger https://jameskettle.com/#Cybersecurity #WebSecurity #BurpSuite #RequestSmuggling #EthicalHacking #BugBounty #AIHacking #AppSec #InfoSec #DEFCON #InsideCyberMinds #LufSec

3. 

   23 Sept 2026

   Inside Cyber Minds S3E7 — Alessandra Rizzo: Hunting North Korean Hackers in npm Packages

   Inside Cyber Minds S3E7 — Alessandra Rizzo, Senior Threat Researcher at Databricks, on hunting North Korean threat actors in the npm supply chain, nation-state malware, and securing the open source ecosystem. Recorded onsite at DEF CON.🛡️ This episode is all about threat intelligence, malware analysis, and supply chain security. To build practical security skills and hands-on experience, explore LufSec's cybersecurity courses and training: 👉 https://www.lufsec.com/courses/?utm_source=youtube&utm_medium=onramp&utm_campaign=career-guide-funnel&utm_content=s3e7-courseTopics CoveredFrom crime science at UCL to nation-state threat research Inside North Korea's npm supply chain campaigns Contagious Trader: mapping a DPRK delivery network Malware families in the open ecosystem: OtterCookie, ClipViper, NastyC2 Typosquatting and how developers get compromised Attribution: how researchers pin campaigns on nation-states Linux malware and reverse engineering tradecraft LLM security through a threat researcher's eyes What the open source ecosystem must fix Advice for getting into threat intelligence and malware researchAbout Alessandra RizzoAlessandra Rizzo is a Senior Threat Researcher at Databricks. Previously at Panther, she led research into DPRK npm supply chain campaigns, and before that worked in threat detection at Sysdig and as a CTI team lead at Innovery in Italy. She holds an MSc in Advanced Cyber Security from King's College London (with Distinction) and a BSc in Security & Crime Science from UCL. Her specialties span nation-state operations, malware reverse engineering, OSINT, Linux internals, supply chain security, and LLM security. She presented her Contagious Trader research at DEF CON's Recon Village and speaks at BSides Montreal this September.About Inside Cyber MindsInside Cyber Minds is a cybersecurity podcast by LufSec featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and security leaders. The show focuses on mindset, decision-making, leadership, security culture, emerging threats, and the human side of cybersecurity.Watch & Listen▶️ YouTube: https://youtube.com/@Lufsec🎙️ Spotify: https://open.spotify.com/show/6hWg94SxRjHUMCMXoKutlc 🎤 Amazon Music: https://music.amazon.com/podcasts/87069409-9772-4c83-821a-d5607e52be51/inside-cyber-minds 🎧 Audible: https://www.audible.com/podcast/Inside-Cyber-Minds/B0G15CT6R1?source_code=ASSGB149080119000H&share_location=pdp 🍎 Apple Podcasts: https://podcasts.apple.com/us/podcast/inside-cyber-minds/id1851011640LinkedIn → https://www.linkedin.com/company/lufsec/Alessandra Rizzo Senior Threat Researcher, DatabricksMalware creation is now dangerously accessible. We examine how non-experts are building sophisticated tools once reserved for nation-states.The barrier to entry for cyberattacks has collapsed. What used to demand a team of experts and nation-state resources is now achievable in a matter of hours. This shift in the threat landscape is changing how we view cybersecurity threats, as malicious campaigns are increasingly powered by easily accessible code.We analyze the implications of this trend and why standard defenses struggle to keep pace with this new reality. By understanding the accessibility of this sophisticated malware, security research professionals can better anticipate attack vectors and improve detection strategies.Subscribe for weekly security research breakdowns, and let us know your thoughts on the future of automated threat development in the comments.#Cybersecurity #ThreatIntelligence #SupplyChainSecurity #npm #Malware #NorthKorea #DPRK #OpenSourceSecurity #InfoSec #DEFCON #InsideCyberMinds #LufSec

Contact Inside Cyber Minds

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.