I'm Ana, and this is a podcast about cybersecurity, AI, leadership, and whatever else I find interesting. :) In each episode, I take one decision that looks completely indefensible from the outside and try to convince you that the person who made it was being perfectly sensible.
Which is worse news than incompetence, because you can fire incompetence.
You don't need to work in security to follow it. Though if you run a security team, you'll recognize more of it than you'd like.
Nobody in your organization is stupid. That's the problem.
Every week, in teaching hospitals, a doctor stands up in front of colleagues and presents a case where her patient died or was seriously harmed. His case. What he did, when he did it, and what happened next.
Security has incident reports. Which is a different thing, because a report is mostly about what an attacker did, and that meeting is about what a person decided.
The surgeon who came up with it was thrown out of the hospital where he trained for suggesting that anyone's results should be reviewed. Four years later, he published a book documenting 337 of his own patients, including 123 of his own errors, with his name on them. It still took until 1983 for anyone to be required to hold the meeting.
Software engineering built its own version in 2012 and gave it away. Security borrowed the word and left the thing behind.
Sources
Ernest Amory Codman, the end-result system and the first morbidity and mortality conferences, Massachusetts General Hospital.
Accreditation Council for Graduate Medical Education, review of complications and deaths required from 1983.
John Allspaw, Blameless PostMortems and a Just Culture, Etsy, May 2012.
Sidney Dekker on just culture and human error.
About
Unpatched is a podcast about cybersecurity, AI and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
14 Sept 2026
Nothing was stolen: the harm with no name
A medical device manufacturer loses two weeks of manufacturing and shipping, worldwide. Investigators find no evidence that anybody got in. And the company tells the SEC it will probably miss its guidance for the quarter and the year.
Nothing was taken. It may still cost them the year.
Then there's the other one. In March, a second manufacturer put two sentences on its own customer page four days apart. All products across the global portfolio remain safe to use. And some patient-specific cases scheduled for the week of March 16 have been rescheduled due to shipping delays.
Both of those are true at once. Nothing unsafe, nothing taken, and somebody's procedure moved to another week because a manufacturer couldn't ship.
We name these events after what the attacker got. Data breach. Records exposed. The count is always the number of things that left the building, and when that happens, there's a letter you have to send, a regulator who wants to know, and a category an insurer recognizes.
There's no letter for "the boxes didn't arrive."
The line that started this episode sits on a corporate status page, between order fulfillment and distribution. That one's in the episode.
Sources
Boston Scientific, cybersecurity incident updates, August and September 2026.
Boston Scientific, Form 8-K, September 8, 2026.
Stryker, customer updates, March 2026.
KrebsOnSecurity, March 12, 2026.
About
Unpatched is a podcast about cybersecurity, AI and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
14 Sept 2026
The chair nobody is sitting in: why CISOs can't get hired
There's a cybersecurity talent shortage, and experienced security executives can't get hired. Same market, same year.
The famous number never counted jobs. It measured whether companies felt they could use more people, and ISC2 stopped publishing it last year. Nobody sent a memo. People still put it on slides.
But that only explains half of it. The rest is about what happens to a role whose value is things that didn't happen. You can buy the outputs now: the policy set, the dashboard, the questionnaire answers. What you can't buy is somebody who looks at forty problems, picks six, and carries it if they're wrong.
Nobody in the history of business has been handed a bonus for a quiet year.
Sources
ISC2 Cybersecurity Workforce Study, 2024 and 2025.
Ira Winkler, open letter to the ISC2 board, October 2024.
United States v. Sullivan, Ninth Circuit, 13 March 2025.
SEC Litigation Release 26423, 20 November 2025.
About
Unpatched is a podcast about cybersecurity, AI and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
14 Sept 2026
Nobody decides to stop checking: what replaced alert fatigue
Daniel Stenberg has looked after curl since the nineties. In February he shut down its bug bounty, because the reports had stopped being worth reading. In March he opened it again, because they got good. In July he closed the whole thing for a month, because there were too many of them.
Something everybody named got fixed quickly, and by somebody else entirely. Something nobody named is still there.
This one's a reflection rather than a report, and it ends somewhere uncomfortable, which is what I've stopped checking, and roughly when I stopped. I'd guess you have an answer to that too.
Sources
Daniel Stenberg, curl summer of bliss, June 2026.
Lisanne Bainbridge, Ironies of Automation, Automatica, 1983.
About
Unpatched is a podcast about cybersecurity, AI, and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
11 Sept 2026
Machine speed isn't the problem: AI, automation and the SOC queue
Attackers now move from a first foothold to a second machine in 29 minutes on average. Last year it was 48. The fastest case on record is 27 seconds.
Almost every briefing published this year draws the same conclusion from those numbers. The window has closed, so you have no choice but to answer at machine speed.
I think the numbers are right and the conclusion is wrong.
Defense got the same eighteen months and the same tools. Whatever remains asymmetric between attack and defense isn't speed, and this episode is about what it actually is.
It's also about a figure I went looking for and couldn't use, and how to tell a number that was observed from one that was paid for.
Sources
CrowdStrike 2026 Global Threat Report, February 2026.
Tariq et al., Alert Fatigue in Security Operations Centers, ACM Computing Surveys, Vol. 57 No. 9, April 2025.
About
Unpatched is a podcast about cybersecurity, AI, and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
11 Sept 2026
Nobody was incompetent: inside CISA's Tale of Two SOCs
CISA broke into two critical infrastructure organizations on purpose, with permission, and published what happened. In one of them, the alert fired, somebody looked at it, and it made no difference. Both organizations lost the lot.
The obvious explanation is that somebody wasn't paying attention. I don't think that's what happened, and this episode is about what did.
It comes down to which kinds of security work you can show a board and which you can't, and what a few years of that does to a budget.
Source
CISA advisory AA26-237A, A Tale of Two SOCs, 25 August 2026.
About
Unpatched is a podcast about cybersecurity, AI, and leadership. Each episode, I take one decision that looks completely indefensible and try to convince you that the person who made it was being perfectly sensible.
Contact Unpatched
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Unpatched?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
