BM
TechnologyEducation
Bare Metal Cyber
Dr. Jason Edwards
Welcome to Bare Metal Cyber, the podcast that bridges cybersecurity and education in a way that’s engaging, informative, and practical. Hosted by Dr. Jason Edwards, a seasoned cybersecurity expert and educator, this weekly podcast brings to life the insights, tips, and stories from his widely-read LinkedIn articles. Each episode dives into pressing cybersecurity topics, real-world challenges, and actionable advice to empower professionals, educators, and learners alike. Whether navigating the complexities of cyber defense or looking for ways to integrate cybersecurity into education, Bare Metal Cyber delivers valuable perspectives to help you stay ahead in an ever-evolving digital world. Subscribe and join the thousands already benefiting from Jason’s expertise!
- 20 episodes
- Avg 18 min
- English
- BMS2 · E75October 16 · 24 min
Bare Metal Cyber Weekly Roll-Up — October 16, 2026
This week shows how trusted technology can become a direct route to physical damage and enterprise compromise. Attacks on supermarket refrigeration systems spoiled food, caused fires and drove losses into the millions, bringing operational technology risk
- Transcript
- BMS2 · E74October 8 · 24 min
Bare Metal Cyber Weekly Roll-Up — October 9, 2026
This week’s roll-up opens with a cloud ransomware outage that disrupted hundreds of companies and local governments in Japan, showing how one provider incident can spread across many operations. A sweeping FortiGate campaign also shows the danger of stole
- Transcript
- BMS2 · E73September 25 · 24 min
Bare Metal Cyber Weekly Roll-Up — September 25, 2026
This week’s roll-up opens with ransomware crews exploiting TeamCity servers, putting trusted software build pipelines and downstream customers at risk. It then turns to actively exploited edge and security systems that can hand attackers control over netw
- Transcript
- BMS2 · E72July 16 · 20 min
The Last Legacy System
Retiring a legacy system sounds simple until you realize one platform has quietly become the backbone of revenue, reporting, and regulatory history. In “The Last Legacy System: Planning for the Day You Finally Turn It Off,” the narrated version walks leaders through why one or two systems always outlive every modernization wave and why that matters for risk, resilience, and strategy. You will hear how technical entanglements, business lore, and hero culture combine to keep that last legacy system alive long after it should have been a conscious, time-bound decision. From there, the episode follows the structure of the Wednesday “Headline” feature from Bare Metal Cyber Magazine. It explores how to move from migration talk to a true business decision, how to model and rehearse the turn-off so it fails safely instead of catastrophically, and how to handle the humans in the loop whose identities are tied to keeping the system running. It closes by looking forward: what it means to design today’s systems with explicit exit strategies, clearer ownership, and governance that treats decommissioning as a first-class concern, so you do not quietly build the next untouchable relic.
- Transcript
- BMS2 · E71July 16 · 15 min
Real-World Recovery
When a major incident hits, most organizations still cling to the promise of “getting back to normal.” In this narrated Headline, “Real-World Recovery: When ‘Return to Normal’ Is the Wrong Goal,” we look at why that mindset quietly undermines resilience. The episode walks through how complex, cloud-heavy environments never truly return to a previous baseline, and why leaders are better served by thinking in terms of new, intentional steady states instead of rewinds. This audio is developed from my Wednesday “Headline” feature in Bare Metal Cyber Magazine, with a focus on the decisions that shape recovery long after the alerts stop. Across the narration, we explore the myth of “normal operations,” reframing recovery as a large-scale reconfiguration of identity, trust boundaries, and vendor dependencies. We dive into planned degraded modes and deliberate sacrifice decisions, then move into a portfolio view of recovery using named operating states rather than a single DR script. Finally, we turn to the leadership side: how to communicate that “normal has changed,” how to align boards and regulators on new baselines, and how to reward sustainable resilience instead of just fast restores. It is a practical guide for leaders who know incidents are inevitable and want their recovery story to match reality.
- Transcript
- BMS2 · E70July 16 · 18 min
Culture of Disclosure
In this narrated edition of “Culture of Disclosure: From ‘Don’t Tell Anyone’ to ‘Report Early, Fix Faster’”, we walk through what really decides whether your organization hears the truth in time to act. You will hear how informal stories, career incentives, and leadership reactions quietly create a shadow “don’t tell anyone” policy, even when formal reporting channels exist. We connect those patterns to hard security outcomes: time-to-discovery, who finds your issues first, and how much room you have to maneuver when something goes wrong. This is a practical listen for leaders who suspect they are getting a filtered view of reality. The episode then breaks down the architecture of a healthy disclosure culture in plain, leader-ready terms. We look at psychological safety as a security control, the design of simple pipes for early reporting, and the metrics that reward high-signal disclosures instead of only counting fires. Finally, we explore what it looks like to lead when disclosure gets painful, from late-breaking findings before a launch to regulatory and customer communications. The narration is based on my Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed to help you pressure-test your own culture of disclosure.
- Transcript
- BMS2 · E69July 16 · 20 min
Metrics That Move Money
Security budgets rarely shift because of bigger dashboards. They shift when leaders can see, in plain business terms, how specific security gaps shape financial exposure and how targeted investments change that picture. This narrated edition of Metrics That Move Money: Turning Security Data into Budget Decisions walks through how senior teams can move past activity counts and into a shared financial language for cyber risk. Grounded in my Wednesday “Headline” feature from Bare Metal Cyber Magazine, the episode explores why so many familiar metrics fail to influence funding, and how narrative metrics built around coverage, exposure, time at risk, and resilience create a clearer basis for capital allocation. Across the article’s major sections, you’ll hear how to translate technical posture into impact ranges executives can use, how to compare very different security initiatives using a portfolio lens, and how the psychology and politics of budget conversations can either support or undermine your case. The episode also breaks down how to build a repeatable metrics operating system—one that survives tool changes, leadership turnover, and shifting business priorities. Whether you’re a CISO preparing for annual planning or a technology leader aiming to strengthen your financial storytelling, this narrative offers a durable model for making security metrics matter where it counts: in real budget decisions.
- Transcript
- BMS2 · E68July 16 · 17 min
Citizen Developers Enterprise Risk
Citizen developers are no longer the exception in large enterprises; they are quietly building the workflows your business now depends on. In this narrated edition of “Citizen Developers, Enterprise Risk: Low-Code Apps You Didn’t Approve,” we explore why low-code and no-code platforms have become the default escape valve for backlogs and rigid roadmaps, and what that really means for risk. The episode walks through the core concept of citizen development as an inevitable pattern, not a fringe behavior, and reframes “unapproved” apps as a governance and ownership problem rather than a simple policy violation. This narration is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine. From there, the episode unpacks the key sections of the article in practical language for security and technology leaders. You will hear the anatomy of typical low-code failures, the recurring patterns behind outages and data exposure, and a governance model that channels citizen energy into sanctioned platforms with guardrails instead of pushing it underground. We talk through the idea of a two-speed control plane, how to tier controls based on data sensitivity and blast radius, and what it means to measure and own citizen risk alongside your other technology risks. The goal is to give you a clear mental model you can carry into leadership meetings and risk discussions, not a checklist to memorize.
- Transcript
- BMS2 · E67July 16 · 18 min
Post-Quantum Paralysis
In this narrated Headline, “Post-Quantum Paralysis: Preparing for a Crypto Shift Without Freezing Roadmaps,” we unpack what post-quantum cryptography (PQC) really means for long-lived data, trust systems, and roadmaps that stretch over years. Instead of chasing a mythical “Q-day,” this episode focuses on the quieter but more dangerous problem: adversaries harvesting encrypted data now, uneven vendor timelines, and platforms that cannot evolve their crypto assumptions fast enough. You will hear how quantum risk shows up in real planning conversations and why the biggest threat is often organizational paralysis rather than a single breakthrough in a lab. The episode walks through the key sections of the article in plain, leader-focused language. We explore how to identify the “crypto gravity wells” in PKI, identity, embedded, and vendor-heavy systems; how to treat PQC as a portfolio of bets based on data lifetime and refactor cost; and how to design for crypto agility so future algorithm changes feel like platform maintenance, not emergency surgery. Finally, we look at governance, budgets, and board communication, showing how PQC work can be integrated into existing roadmaps instead of competing with them. This narration is based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine.
- Transcript
- BMS2 · E66July 16 · 14 min
Access Broker Auction House
This narrated episode, based on the Wednesday “Headline” feature in Bare Metal Cyber Magazine, takes you inside the underground market where initial access brokers (IABs) quietly auction off entry into corporate networks. Across the episode, we unpack how access gets found, stabilized, and turned into inventory, and why seemingly small design choices in identity, segmentation, and remote access show up as selling points in those listings. The focus stays firmly on leader-level questions: what makes your environment easy to productize, how attackers think about your “street value,” and why this problem will matter over the next several years.
- Transcript
- BMS2 · E65July 16 · 14 min
M&A Malware
Mergers and acquisitions are great for growth, but they can be brutal for your risk profile if you treat cyber as an afterthought. In this audio version of “M&A Malware: Security Debt Hidden Inside Acquisitions,” we walk through how security debt quietly rides along with deal synergies and why traditional due diligence often fails to surface what really matters. You will hear how the deal room blind spot forms, what kinds of technical, identity, data, and governance debt you are actually buying, and why the integration window is such a powerful opportunity for attackers. This narration is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine. From there, the episode moves into what leaders can actually do: redesigning cyber due diligence so it relies on evidence instead of slideware, translating findings into valuation, terms, and go/no-go decisions, and staging integration to avoid turning a new business unit into a lateral movement corridor. We also dig into governance and accountability, including where the CISO fits in the M&A process and what it really means to say no to a bad deal. The goal is not to scare you away from acquisitions, but to help you treat M&A as a strategic security decision you can manage on purpose, instead of a malware vector you only recognize after the fact.
- Transcript
- BMS2 · E64July 16 · 17 min
Timezones Timelines and Truth
In this narrated edition of “Timezones, Timelines, and Truth: Forensics in a Planet-Scale Company,” we dig into why so many major incidents are really arguments about time. You’ll hear how global footprints, multi-region cloud services, and a sprawl of SaaS tools quietly sabotage forensic timelines, even in organizations that think they have “good logging.” We walk through the technical and human realities that make it hard to agree on when an attack truly started, what happened in which order, and how long you were exposed, all based on the clocks and pipelines you’ve already deployed. This episode is based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine. We also step beyond the war room and look at timelines as evidence, not just memory. The episode unpacks where telemetry pipelines distort cause-and-effect, how follow-the-sun operations and chat-driven decisions fragment the human story, and why regulators and customers increasingly treat your timeline as a formal representation of truth. From there, we shift into leadership territory: designing for forensic-grade time, setting expectations with vendors, building log quality and time normalization into your platforms, and modeling “time discipline” in executive communication. If you lead security or technology in a planet-scale company, this is about turning time from a hidden liability into a deliberate part of your incident response architecture.
- Transcript
- BMS2 · E63July 16 · 16 min
Sensitive by Default
This narrated edition of “Sensitive by Default: Designing Systems That Assume Everything Matters” walks through what happens when you stop pretending you can neatly separate “sensitive” from “non-sensitive” data. We explore how modern stacks turn telemetry, feature flags, observability traces, and AI interactions into high-value intelligence, even when no one labeled it confidential. From there, the episode unpacks why traditional data classification schemes create a comforting mirage and how risk actually concentrates in the messy middle of real data flows, logs, and analytics platforms that leaders rarely revisit once they are wired up. You will also hear a leader-focused tour of sensitive-by-default patterns for architecture, platform engineering, and governance. We talk about encrypt-by-default storage and messaging, identity and access management (IAM) that favors time-bound and purpose-bound access, and data minimization and transformation techniques that reduce blast radius without killing developer velocity. The episode closes on the leadership moves: funding golden paths as first-class products, choosing the right metrics, and deciding when and how to consciously relax protections. It is all based on my Wednesday “Headline” feature from Bare Metal Cyber Magazine, translated into an audio walkthrough you can take on a commute, a flight, or a late-night architecture review.
- Transcript
- BMS2 · E62July 16 · 19 min
Shadow AI Projects
Shadow AI Projects: The Models Built in Corners of the Business explores the reality that many of your “AI initiatives” never went through an official roadmap. In this narrated edition of our Wednesday “Headline” feature from Bare Metal Cyber Magazine, we walk through the quiet places where models and automations already live: vendor “AI assist” toggles, abandoned notebooks, low-code flows, and small scripts that shape real business decisions. The episode explains why smart people go rogue in the first place, how incentives and pressure drive experimentation into the shadows, and what that says about your operating model as a leader. From there, the episode breaks the problem down into practical pieces. You will hear a clear way to segment shadow AI risk across data, decisions, intellectual property, and operational fragility, and how to move from witch hunts to a discovery program that teams actually trust. We talk through what “guardrails without gridlock” looks like in practice, how to design tiers of AI usage, and how to build an honest narrative for executives, boards, and regulators. By the end, you will have a way to talk about shadow AI that is candid, structured, and usable in your next leadership conversation.
- Transcript
- BMS2 · E61July 16 · 18 min
Digital Consequences
Hybrid threats are changing what it means to “handle an incident,” and this narrated episode walks through how that plays out when protests, outages, and digital campaigns collide. You’ll hear how physical demonstrations spill into doxxing, harassment, and pressure on online services, and why outages are increasingly used as leverage rather than just unfortunate side effects. We’ll explore how shared infrastructure—payments, cloud, identity, logistics—turns into a pressure point during social unrest, and why it leaves many organizations caught in the middle of political, regulatory, and criminal forces they do not control. From there, the episode turns to leadership and design. It unpacks how fuzzy ownership between cyber, physical security, legal, HR, and communications amplifies chaos, and what it means to architect for graceful degradation instead of brittle heroics. You’ll hear concrete patterns for hybrid resilience, from segmentation choices to decision playbooks, and how to define a coherent posture in a politicized network where every uptime or shutdown decision is read as a signal. This audio is based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine, “Digital Consequences: Protests, Outages, and Hybrid Threats.”
- Transcript
- BMS2 · E60July 16 · 17 min
The Great Unmanaged
When contractors, partners, and “temporary” staff never really leave your environment, their access quietly becomes part of your infrastructure. In this episode, we walk through how non-employee identities accumulate around your core systems, why joiner-mover-leaver processes that stop at the HR boundary are no longer enough, and how “temporary” access turns into permanent risk. You will hear concrete patterns from cloud and SaaS environments, where vendor portals, support logins, and one-off project accounts slowly grow into a shadow perimeter that attackers see more clearly than you do. We then shift into the leadership moves that actually change your risk over time. The conversation covers how to design first-class lifecycles for non-employee identities, including sponsorship, expiry, and re-attestation; how to connect those mechanics to contracts, legal expectations, and third-party risk narratives for the board; and how to build a culture where turning off access is normal, not heroic. This narration is developed from “The Great Unmanaged: Contractors, Partners, and Temporary Access Gone Permanent,” a Wednesday “Headline” feature in Bare Metal Cyber Magazine.
- Transcript
- BMS2 · E59July 16 · 15 min
Zero Signal
This narrated edition of “Zero Signal: When Telemetry Costs More Than the Risk It Mitigates” walks leaders through the uncomfortable reality that security telemetry has become one of the biggest unchecked taxes in modern environments. We look at how logs, traces, and events grew from helpful debugging aids into a sprawling, expensive portfolio that often delivers more noise than signal. You will hear how the economic, operational, and cognitive costs of telemetry accumulate over time and why “log everything” is no longer a defensible default for mature organizations. From there, the episode traces the key moves in the article: reframing telemetry as a risk instrument, exposing failure modes on both over-collection and over-pruning, and outlining what it means to design visibility on purpose instead of inheriting vendor defaults. We talk through tiered telemetry, business-critical journeys, and the governance decisions that keep costs and coverage in balance. Throughout, the narration stays grounded in leadership conversations and trade-offs, all based on the Wednesday “Headline” feature from Bare Metal Cyber Magazine.
- Transcript
- BMS2 · E58July 16 · 10 min
Purple Team Statecraft
Purple team exercises are showing up on more roadmaps, but many organizations still struggle to turn those war games into real movement on risk, architecture, and budget. In this narrated edition of “Purple Team Statecraft: Turning Exercises into Actual Change,” you will hear how to reframe purple teaming from a technical joint exercise into a deliberate tool of statecraft. The episode walks through what it means to design scenarios around real decisions, capture evidence that survives the room, and connect findings directly to the forums where strategy and spending are actually decided. Across the story, the narration explores how to plug purple team outputs into governance, avoid blame theater, and build a cadence that keeps the organization in motion rather than chasing novelty. You will hear concrete examples of decision-centered exercises in areas like identity, cloud, and AI adoption, as well as practical ways to measure whether purple teaming is shaping risk appetite and roadmaps instead of just generating colorful reports. This audio is developed from my Wednesday “Headline” feature in Bare Metal Cyber Magazine, giving you a leader-focused walkthrough you can absorb on the move.
- Transcript
- BMS2 · E57July 16 · 11 min
Making Alerts Great Again
When you look past the wall of dashboards in most security operations centers, a tougher reality appears: leaders can see alert volumes and colorful charts, but they cannot always say which attacker behaviors they truly catch with confidence. In this narrated audio version of “Making Alerts Great Again: Detection Engineering, Not Dashboard Worship,” we walk through why that gap exists and what it means for security and technology leadership. You will hear a clear explanation of how detection engineering reframes the problem, turning raw telemetry from tools like security information and event management platforms and endpoint detection and response systems into deliberate, testable detections aligned with attacker behavior and business risk. The episode also breaks down the system and organizational side of the story in practical terms. We explore what a real detection pipeline looks like, who should own detections inside your team, and how to measure detection quality instead of just counting alerts. Along the way, you will get language to shift board and executive conversations away from screenshot theater and toward evidence-based confidence in specific detection capabilities. This narration is based on the Wednesday “Headline” feature in Bare Metal Cyber Magazine and is designed to help you think more clearly about where to invest your next unit of time, budget, and political capital in security operations.
- Transcript