Simply Defensive

S6:E4 - Max Pollard - Why Hidden System Prompts Are Failing Security TeamsEpisode SummaryIn this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Max Pollard. He is the founder and CEO of CoTool, an AI-native detection and response platform. Max's path ran through quantitative finance, then Okta's customer identity team, then Material Security, where he built and led the forward-deployed engineering team. He left to found CoTool earlier this year. The conversation traces where the idea came from. Security engineers were already turning to tools like ChatGPT and Claude Code for help writing detections. Those tools hit a wall the moment they needed to understand an org's actual logs and schema.Josh and Wade push Max on the harder questions too. Why do SOAR teams still hesitate to trust automatic remediation, and what has to change before anyone hands that trust to AI? The back half turns into a real debate about control, built around a recent LinkedIn post where Max argued that hidden system prompts are quietly failing the security teams who depend on them. Detection engineers, SOC analysts evaluating AI tools, and anyone tired of agents that ignore instructions will get something out of this one.What You'll LearnMax's path from algorithmic trading to Okta, Material Security, and founding CoToolWhat CoTool does: better rule-based detections, catching behavior rules that can't be expressed, and full-context responseWhy grounding AI in your organization's real logs and schema matters more than a good promptHow backtesting a detection connects straight back to Max's quant finance backgroundWhy AI got noticeably better at MITRE ATT&CK mapping over the past couple of yearsWhy SOAR teams still hesitate on automatic remediation, and what AI changes about that calculusHow AI can fast-track junior analysts instead of replacing themMax's LinkedIn take on hidden system prompts, and why he thinks they hurt security teamsWhy CoTool calls itself a harness instead of an agentEpisode HighlightsFrom Algorithmic Trading to AI Security Max's path ran through quantitative finance, Okta's customer identity team, and Material Security before he left to found CoTool. He draws on that finance background more than you'd expect, especially around backtesting.What CoTool Actually Does A unified detection and response layer that sits on top of your existing stack, not a SIEM replacement. It helps teams write and maintain better rule-based detections, catch attacker behavior rules can't express, and respond faster with full context across all their security data.Grounding AI in Your Real Data The gap Max saw in tools like ChatGPT and Cursor: great at generic help, useless the moment they needed to understand an org's actual logs, schema, and normalization choices. CoTool was built to close that gap.Trusting AI to Act on Its Own Josh and Wade push Max on automatic remediation. If teams don't fully trust a black-and-white SOAR playbook, why would they trust an AI system that can hallucinate? Max walks through why the path to real automation runs through enrichment, false-positive triage, and suggested response first.The LinkedIn Post That Started This Conversation Max recently argued that bolt-on AI agents with hidden system prompts are a net negative for security teams. He points to Gmail's early email assistant as the cautionary tale: a hidden prompt hardcoded a stiff, overly formal tone that made the tool nearly unusable.Why CoTool Calls Itself a Harness Instead of shipping a fixed agent, CoTool exposes the same underlying primitive to users and lets them shape it for detection, response, or whatever they need. Max's argument: security changes too fast for hidden, hardcoded behavior to hold up.Timestamps(This tag pulls the list straight from the Chapters field below once you paste it in there, so you're not maintaining the same list twice. If you'd rather have a static list here instead, use the block under "Chapters (standalone)" further down.)Resources MentionedCoTool: https://cotool.aidetections.ai (referenced in the conversation): https://detections.aiOur earlier episode with Aaron Mog of detections.ai: https://simplydefensive.transistor.fm/s4/3Connect with MaxCoTool: https://cotool.aiEmail: [email protected] with Your HostsJosh Mason: https://www.linkedin.com/in/joshuacmason/Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

Episode Show NotesS6:E3 - Tom Dejong - Inside the BHIS SOC: Triage, Curiosity, and Career GrowthEpisode SummaryIn this episode of Simply Defensive, hosts Josh Mason and Wade Wells sit down with Tom Dejong, Triage Lead at Black Hills Information Security (BHIS). Tom shares his unconventional path into cybersecurity — from a South Dakota apprenticeship scholarship to becoming one of the most detail-oriented analysts in the BHIS SOC. The conversation covers the realities of SOC triage, the importance of detailed documentation, mentoring new analysts, and how AI is reshaping (but not replacing) blue team work.Whether you're an aspiring SOC analyst, a seasoned defender, or someone curious about how to build a career in cyber without a traditional path, Tom's story and practical advice will resonate.What You'll LearnHow the Build Dakota Scholarship led Tom from apprenticeship to a cybersecurity careerWhat it's really like working triage at the BHIS SOCWhy detailed ticket notes are a force multiplier for SOC teamsThe hypothesis-driven approach to alert investigationHow to pivot off IPs, hashes, process names, and file pathsWhy curiosity is the #1 skill for SOC analystsHow AI is being used in modern SOCs (and why it's not taking your job)The challenge of building SOC training and webcastsAdvice for handling mistakes and learning from themEpisode HighlightsTom's Journey Into Cyber From discovering Darknet Diaries and hearing John Strand mention Spearfish, South Dakota — the same town Tom was living in — to landing his first day at Wild West Hacking Fest 2022 as a BHIS intern.The Triage Mindset Tom walks through his approach to investigating alerts: starting with detection logic, checking for prior tickets, and breaking down each piece of evidence in writing to make the logic click.Documentation as a Superpower Why Tom believes detailed notes aren't just nice-to-have — they're essential for the next analyst down the line and for his own thought process.AI in the SOC Tom's honest take on using AI for investigations, polishing client communications, and writing detection logic — plus why he's not worried about it taking his job.Advice for Blue Teamers You're going to make mistakes. Use them as learning experiences. Lean on your teammates. Stay curious.Timestamps00:00 Intro and Welcome01:00 Tom's Role at the BHIS SOC01:30 From Apprenticeship to Cybersecurity: The Build Dakota Story03:00 Discovering BHIS Through Darknet Diaries04:00 Wild West Hacking Fest as Day One04:30 Behind the Scenes of a SOC Webcast06:30 The Art of Alert Triage and Pivoting08:30 Building Conference Talks and Training Content10:30 Where Tom Sees His Career Going11:30 Why Curiosity Is the #1 SOC Skill12:30 Favorite Alert Types to Work14:00 Round Robin vs. Self-Assigned Tickets15:00 Note-Taking and Documentation Best Practices19:00 Building a Hypothesis When an Alert Comes In20:30 AI in the SOC: Hype, Reality, and Use Cases24:00 Will AI Replace SOC Analysts?26:00 Training Resources for New Analysts28:00 Advice for Aspiring Blue Teamers29:30 Closing ThoughtsResources MentionedBlack Hills Information Security: https://www.blackhillsinfosec.com/Antisyphon Training: https://www.antisyphontraining.com/Build Dakota Scholarship: https://www.builddakotascholarships.com/Darknet Diaries Podcast: https://darknetdiaries.com/Wild West Hacking Fest: https://wildwesthackinfest.com/Connect with TomLinkedIn: Tom Dejong at Black Hills Information SecurityBHIS Webcasts & Workshops: Available through Black Hills Information SecurityConnect with Your HostsJosh Mason: https://www.linkedin.com/in/joshuacmason/Wade Wells: https://www.linkedin.com/in/wadingthrulogs/

John Hammond on Security Research, Storytelling, and Deception for DefendersIn this Simply Defensive episode, hosts Josh Mason and Wade Wells interview John Hammond, a Huntress security researcher, YouTuber, and educator, about his career path and defensive research. Hammond explains he has never worked as a penetration tester, SOC analyst, or detection engineer, instead “falling into” security research through hands-on Capture the Flag work and building cyber threat emulation course content, earning Offensive Security’s OSCE3 bundle recognition. He discusses why storytelling and communication are critical for translating attacker tradecraft into actionable defenses, emphasizing understanding the attack chain to identify places to break it. He recommends building a public portfolio of write-ups and notes, and says multiple creators covering the same topic can still provide value through different explanations. The conversation also highlights endpoint deception and honeypots, challenges of reversing compiled binaries versus script-based malware, and his advice to document thoroughly in shared organizational knowledge bases.00:00 S6E2: John Hammond on Security Research, Storytelling, Deception, and Getting Hired in Cybersecurity01:27 Meet John Hammond01:57 Security Researcher Life04:43 OffSec Certs Explained06:55 From CTF to Research08:47 Storytelling in Cyber12:10 Turning Attacks to Defense15:19 Getting Hired as Researcher16:48 Portfolio and Honeypots19:05 Make the Video Anyway21:40 Alternate Data Streams Nerdout23:36 CTFs Then and Now24:28 Life Shifts Priorities25:44 Beyond CTFs Next Trend26:52 Deception Meets Detection28:48 Honeypots and Program Maturity31:13 Malware Reversing Boss Fights35:09 Blue Team Advice Document Everything37:51 Where to Find John and Training38:49 Wrap Up and Farewell

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Jason Haddix — CISO veteran, AI security thought leader, and founder of Arcanum Information Security — for a wide-ranging conversation on where AI is actually headed in cybersecurity, and what blue teamers need to know right now.Jason shares what he's learned from running AI scaling assessments inside major enterprises, why most organizations are still in the early stages of AI adoption, and how the industry needs to stop thinking about AI security like traditional web app security. He breaks down the stages of AI adoption (from custom bots to agents), explains why input validation is a losing game for LLM security, and makes the case for classifiers, guardrails, and LLM-based routing as the real defense-in-depth play for AI systems.Wade and Jason also revisit the Red Blue Purple AI course, talk through how RAG and context engineering are transforming what's possible for blue teamers, and discuss why the credential leakage problem is still one of the biggest vectors defenders aren't taking seriously enough.Topics covered:Why CTI struggles to prove value — and where it actually matters mostStealer logs, credential leakage, and when rolling an account isn't enoughAI adoption stages: custom bots → RAG → agentsWhy SOAR skepticism is a preview of AI hesitancyContext engineering vs. prompt engineeringDefending AI systems: prompt-level protections, classifiers, guardrails, and LLM routingWhen does a prompt become IP?Jason's advice for blue teamers: embrace AI as a tool, find your annoying tasks, and start chipping awayConnect with Jason Haddix:Twitter/X: @jhaddixArcanum Information Security: arcanam-sec.comGitHub (free tools & resources): ARCanum Information Security on GitHubNewsletter: Executive Offense by Jay HaddixResources mentioned:Red Blue Purple AI Course (ARCanum)Flare (threat intelligence / credential monitoring): flare.ioDetections.aiConnect with the Hosts:Josh Mason: linkedin.com/in/joshuacmasonWade Wells: linkedin.com/in/wadingthrulogs

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Josh Stroschein — aka The Cyber Yeti — a former professor turned reverse engineer now working on one of the largest malware analysis teams in the world.Josh shares his unconventional path through .NET development, credit card processing security, and academia before landing at Google. He opens up about teaching reverse engineering while learning it himself, building educational CTFs, and the realities of making it as a full-time reverse engineer in an industry where those roles are rare.What you'll hear:🔹 From pre-law to pilot training to PhD in cybersecurity🔹 How teaching RE forced him to truly master it🔹 Life inside Google's FLARE team (via Chronicle → Mandiant)🔹 Flareon CTF — the RE challenge that's run for 12 years🔹 A wild Black Hat NOC story involving an infected Mac and Atomic Stealer🔹 Using AI to build malware samples for training labs🔹 Why going low-level is the best advice for blue teamersChapters:00:00 Introduction and Welcome00:50 Josh's Connection to Dr. Gerald Auger02:00 The Non-Traditional Path: Pre-Law, Pilot Training & .NET Dev05:00 Getting Into Security at a Credit Card Processor07:00 Teaching Reverse Engineering at Dakota State10:00 Flareon CTF and Educational CTF Design14:00 Is Reverse Engineering Offensive or Defensive?17:00 How Rare Are Full-Time RE Roles?21:00 The Path to Google: Chronicle, Mandiant & FLARE25:00 Learning Through Teaching and YouTube Content28:00 Black Hat NOC Story: Catching Atomic Stealer Live33:00 Using AI to Create Malware Training Samples37:00 Building a Defang Tool (and .NET Nightmares)40:00 Advice for Blue Teamers: Go Low-Level🎧 Find Josh Stroschein:→ Website: https://www.thecyberyeti.com→ YouTube: The Cyber Yeti→ Podcast: The Cyber Yeti Podcast👥 Connect with the Hosts:→ Josh Mason: https://www.linkedin.com/in/joshuacmason/→ Wade Wells: https://www.linkedin.com/in/wadingthrulogs/→ Swimlane: https://www.linkedin.com/company/swimlane🎙️ Listen on Your Favorite Platform:→ Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4→ Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1773806182→ Full Playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4👍 If you enjoyed this episode, don't forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity professionals who are doing the work.=========================All the ways to connect with Simply Cyberhttps://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group

In this episode of Simply Defensive, hosts Josh Mason and Wade Wells welcome Yuriy Tsibere, Product Manager at ThreatLocker, for a behind-the-scenes look at how security products actually get built.Yuriy's path to cybersecurity started in Ukraine, where he worked in telecom during sophisticated APT campaigns that lasted over a year. Now at ThreatLocker, he shapes the tools defenders use daily—from allow listing to compliance automation.Episode Highlights:What product managers actually do at security companiesAPT attack patterns: social engineering meets technical exploitationHow allow listing, ring fencing, and network control protect endpointsDefense Against Configuration (DAC): automating FedRAMP, HIPAA, and NIST complianceWhy misconfigurations remain one of the biggest security gapsBalancing strict security with real-world usabilityYuriy's top advice for defenders: Educate your personnelKey Takeaway: Most breaches still come from employees clicking without paying attention. Security products matter, but user education accounts for the largest share of issues. Yuriy also emphasizes that when compliance drift happens—when systems become uncompliant—it should trigger an investigation into what changed and why.Resources Mentioned:ThreatLocker Zero Trust Endpoint ProtectionDefense Against Configuration (DAC) for compliance monitoringZero Trust World ConferencePerfect for blue teamers, SOC analysts, security engineers, and anyone interested in how security products evolve from concept to deployment.Connect with Yuriy Tsibere (Guest) on LinkedIn: https://www.linkedin.com/in/yuriy-tsibere/🔗 Links & Resources: → ThreatLocker Free Trial: https://www.threatlocker.com/simplydefensive → Zero Trust World Conference: https://www.intlcybersec.org/zerotrustworldmain👥 Connect with the Hosts:→ Josh Mason: https://www.linkedin.com/in/joshuacmason/→ Wade Wells: https://www.linkedin.com/in/wadingthrulogs/→ Swimlane: https://www.linkedin.com/company/swimlane🎙️ Listen on Your Favorite Platform:→ Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4→ Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1773806182→ Full Playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4👍 If you enjoyed this episode, don't forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity professionals who are doing the work.💡 Brought to you by ThreatLocker – Secure your business with zero trust application control. https://www.threatlocker.com/simplydefensive=========================Sponsored by @ThreatLocker - Free 30-day trial visit:https://www.threatlocker.com/simplydefensive=========================All the ways to connect with Simply Cyberhttps://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group

From teaching AP art history to brokering cyber insurance deals. 🎓➡️🛡️In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Andy Runyan from Yukon to break down everything blue teamers need to know about cyber insurance — before an incident happens. Andy shares his unconventional journey from fourth-generation educator and baseball coach to becoming a cyber insurance specialist, and explains why understanding your policy is just as important as your incident response plan.What you'll hear:🔹 How cyber insurance actually works (and what it doesn't cover)🔹 Why having an incident response retainer matters — before you need it🔹 The role of cyber insurance in incident response and recovery🔹 Third-party contract requirements and state mandates on the rise🔹 Common mistakes companies make when filing claims🔹 FTC Safeguard Rules and what they mean for businesses🔹 How to prepare your organization for cyber insurance requirements🔹 What lowers premiums (and what should, but doesn't)Why This Matters for Blue Teamers:If you're in a SOC or handling incident response, you will interact with cyber insurance at some point. Understanding how policies work, what triggers coverage, and how to prepare can make the difference between a smooth recovery and a catastrophic financial loss. This episode gives you the insider knowledge to help your organization be ready.⏱️ Timestamps:00:00 Introduction and Welcome00:15 Andy's Unique Background: From Teacher to Cyber Insurance03:00 Getting Into Cyber Insurance in 201904:00 The Wild West of Cyber Insurance During COVID06:00 When Companies Actually Buy Cyber Insurance08:00 What Blue Teamers Need to Know About Insurance10:00 The Problem with Incident Response Retainers12:00 How Insurance Companies Handle IR vs. What You Need15:00 Multi-Factor Authentication and Premium Discounts18:00 Why Having an IR Plan Doesn't Lower Your Premium (But Should)21:00 Third-Party Contract Requirements on the Rise24:00 State Mandates: What's Coming Next?27:00 FTC Safeguard Rules and Compliance Reality30:00 Where to Learn More About Yukon🔗 Connect with Andy Runyan:→ Yukon Website: https://www.ukon.com→ LinkedIn: https://www.linkedin.com/in/andy-runyan→ Email: [email protected]👥 Connect with the Hosts:→ Josh Mason: https://www.linkedin.com/in/joshuacmason/→ Wade Wells: https://www.linkedin.com/in/wadingthrulogs/→ Swimlane: https://www.linkedin.com/company/swimlane🎙️ Listen on Your Favorite Platform:→ Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4→ Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1773806182→ Full Playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4👍 If you enjoyed this episode, don't forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity professionals who are doing the work.=========================Sponsored by @ThreatLocker - Free 30-day trial visit:https://www.threatlocker.com/simplydefensive=========================All the ways to connect with Simply Cyberhttps://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group

Josh Mason and Wade Wells sit down with Brian Carrier, the creator of Sleuth Kit and Autopsy, two of the most widely used digital forensics tools in the world. They dig into how Brian got his start in the early days of computer forensics, how open source shaped his career, and what he’s building now with Cyber Triage.From stories about government funding and tool rewrites to the evolving balance between open source and commercial software, this episode is packed with insight for blue teamers, DFIR pros, and anyone who cares about investigation tooling that actually works.Watch to hear:The 25-year evolution of Sleuth Kit & AutopsyHow Cyber Triage simplifies investigations for SOCsThe tradeoffs between open source and commercial toolsWhat Brian sees next in AI-driven forensics⏱️ Timestamps: 00:00 Introduction and Guest Introduction 00:15 Brian Carrier's Journey with Sleuth Kit and Autopsy 02:06 Evolution and Funding of Autopsy 06:52 Open Source vs. Commercial Software 10:16 Future Roadmap and Innovations 14:16 Autopsy and Cyber Triage for Blue Teamers 16:24 Challenges in EDR and SOC Analysis 16:41 Investigative Process and Clues 17:18 Handling Noisy Data in EDR 17:49 Importance of Tracing Malware 18:28 Deploying Additional Collectors 19:25 Feedback from the Community 21:21 Cyber Insurance and Incident Response 23:34 Automation in Forensics 28:41 Advice for Blue Teamers 30:12 Conclusion and Final ThoughtsLinks: 🎧 Listen on Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4 🍎 Listen on Apple Podcasts: https://podcasts.apple.com/us/podcast/simply-defensive/id1668519478 💻 Learn more about Sleuth Kit: https://sleuthkit.org/ 🔍 Try Autopsy: https://www.autopsy.com/ 🧠 Explore Cyber Triage: https://www.cybertriage.com/Connect with Brain: 👤 Brian Carrier on LinkedIn: https://www.linkedin.com/in/brian-carrier-169243/ 🏢 Sleuth Kit / Basis Technology on LinkedIn: https://www.linkedin.com/company/basis-technology/ 💼 Cyber Triage on LinkedIn: https://www.linkedin.com/company/cyber-triage/Don't forget to like, subscribe, and hit the bell icon for more blue team content!🔗 Follow the hosts:Josh Mason: https://www.linkedin.com/in/joshuacmason/Wade Wells: https://www.linkedin.com/in/wadingthrulogs/💡 Brought to you by ThreatLocker – Secure your business with zero trust application control. https://www.threatlocker.com/simplydefensive🎙️ More Simply Defensive- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.=========================Sponsored by @ThreatLocker - Free 30-day trial visit:https://www.threatlocker.com/simplydefensive=========================All the ways to connect with Simply Cyber https://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group

In this episode of Simply Defensive, host Josh Mason and co-host discuss their experiences and challenges in cybersecurity, along with guest Victoria, a student and SOC analyst at UNLV.The conversation covers the complexities of building a Security Operations Center (SOC) and compares academic learning with real-world applications. Victoria shares insights from her studies and practical work, including developing a SOC program at UNLV and addressing common cybersecurity misconceptions.The episode highlights the importance of communication, real-world projects, continuous learning, and the balance between technical and business aspects of cybersecurity.00:00 Introduction and Host Banter00:20 Guest Introduction: Victoria01:03 Building a SOC: Challenges and Experiences01:29 Education vs. Real-World Experience02:29 SOC Class and Practical Training03:49 Group Projects and Communication07:14 Real-Life Incident Stories10:33 Getting into Cybersecurity: Victoria's Journey12:54 Business Side of Cybersecurity16:17 The Cost of MFA and Free Alternatives16:31 Lock Picking and Security Value17:30 Teaching Cybersecurity Concepts18:44 Consulting Experience for Students19:15 Client Feedback and Confidential Reports19:52 Challenges in Cybersecurity Projects20:27 Transitioning into the SOC22:34 Federal and State Regulations26:16 Advice for Blue Teamers28:06 Conclusion and FarewellDon't forget to like, subscribe, and hit the bell icon for more blue team content!🔗 Follow the hosts:Josh Mason: https://www.linkedin.com/in/joshuacmason/Wade Wells: https://www.linkedin.com/in/wadingthrulogs/💡 Brought to you by ThreatLocker – Secure your business with zero trust application control. https://www.threatlocker.com/simplydefensive🎙️ More Simply Defensive- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.=========================Sponsored by @ThreatLocker - Free 30-day trial visit:https://www.threatlocker.com/simplydefensive=========================All the ways to connect with Simply Cyber  https://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group

What happens when you go from fixing executives’ laptops at Goldman Sachs to defending against cyber threats in a SOC?In this episode of Simply Defensive, hosts Josh Mason and Wade Wells sit down with Kevin Apolinario — better known as KevTech — to unpack his journey from IT support to cybersecurity analyst, all without a single certification.Kev gets real about what it’s actually like to land your first SOC role: the flood of alerts, the burnout, learning Excel the hard way, and relying on ChatGPT to survive scripting. He also shares how TryHackMe, Hack The Box, and constant hands-on practice built the foundation for his success.If you’ve ever wondered what breaking into cybersecurity really looks like, this conversation pulls back the curtain — no fluff, no spin, just honest talk from the trenches.Chapters:00:00 Introduction and Welcome00:29 Guest Introduction: Kev Apolinario00:51 Transition to SOC Analyst Role01:53 Challenges and Learning in Cybersecurity06:43 Handling Alerts and Fatigue10:26 Importance of Teamwork and Asking for Help19:56 Executive Support Experience27:02 Advice for Aspiring Blue TeamersFollow Kevin on YouTube: https://youtube.com/@kevtechitsupportConnect with Kevin on LinkedIn: https://www.linkedin.com/in/itprofessionalkevinapolinarioDon't forget to like, subscribe, and hit the bell icon for more blue team content!🔗 Follow the hosts:Josh Mason: https://www.linkedin.com/in/joshuacmason/Wade Wells: https://www.linkedin.com/in/wadingthrulogs/💡 Brought to you by ThreatLocker – Secure your business with zero trust application control.🎙️ More Simply Defensive- Full playlist: https://youtube.com/playlist?list=PL4Q-ttyNIRAr6DVrsASx1-Fv-TsooJ3M4- Spotify: https://open.spotify.com/show/72QTocT5FSTSPV7o1UcMS4- Apple Podcasts: https://podcasts.apple.com/il/podcast/simply-defensive/id1773806182👍 If you enjoyed this episode, don’t forget to like, subscribe, and share with your fellow defenders. Every week, Josh Mason and Wade Wells bring you practical, no-fluff conversations with cybersecurity leaders.=========================Sponsored by @ThreatLocker - Free 30-day trial visit:https://www.threatlocker.com/simplydefensive=========================All the ways to connect with Simply Cyber  https://SimplyCyber.io/Socials=========================This podcast is presented by Simply Cyber Media Group