1
00:00:01,100 --> 00:00:07,120
This summer, a company got broken into by robots, literally AI agents, hundreds of them.

2
00:00:07,440 --> 00:00:10,820
And no, this wasn't a Will Smith AI robots or Skynet.

3
00:00:11,179 --> 00:00:17,519
And when the company sat down and wrote up what happened, the sentence that matters, it wasn't about AI at all.

4
00:00:17,640 --> 00:00:21,219
It was this tour of our own settings allowed it.

5
00:00:21,420 --> 00:00:22,480
That's the whole episode.

6
00:00:22,800 --> 00:00:24,899
The robots didn't invent a new way in.

7
00:00:25,199 --> 00:00:26,399
They use yours.

8
00:00:26,620 --> 00:00:27,559
What's good, Internet?

9
00:00:27,559 --> 00:00:31,600
This is your boy Q, and welcome to the Blast Radius.

10
00:00:31,600 --> 00:00:36,450
His name is Quinn Vidal, and Q is the alias.

11
00:00:36,450 --> 00:00:41,740
Podcast launch, and we call it the Blast Radius.

12
00:00:41,939 --> 00:00:47,179
Every word perfect as applications in 86. Fingers gripping keys. Home row, stop taking risks.

13
00:00:47,380 --> 00:00:52,259
Listen and level up your business's development. Every episode, a new dose of your medicine.

14
00:00:52,600 --> 00:00:56,880
Technical physician better come and see the specialist. Nothing at all artificial about

15
00:00:56,880 --> 00:01:04,769
All right, the blast. So OpenAI, the ChatGPT people, they run a test on a bunch of their own

16
00:01:04,769 --> 00:01:09,769
models. And one of those tests is called ExploitGym. It's basically like a hacking exam

17
00:01:09,769 --> 00:01:14,829
where a pile of security puzzles go and the agents solve them to see how dangerous that

18
00:01:14,829 --> 00:01:21,010
model could be. And they ran it with safety filters turned down on purpose. That's the job

19
00:01:21,010 --> 00:01:26,569
of the test. Now, here's the thing about this exam. A lot of puzzles were really, really hard.

20
00:01:27,209 --> 00:01:31,469
OpenAI says that for some of them, there were many of those that didn't even have an answer.

21
00:01:31,870 --> 00:01:37,450
Out of 898 tasks, none of their models had ever solved 198 of them.

22
00:01:38,069 --> 00:01:42,329
So what do you do when you're a very motivated student and the test is impossible?

23
00:01:42,510 --> 00:01:43,430
You cheat.

24
00:01:45,019 --> 00:01:50,560
OpenAI's own words, the agents got hyper-focused on finding a solution for ExploitGym,

25
00:01:50,939 --> 00:01:55,140
going to extreme lengths to achieve a rather narrow testing goal.

26
00:01:55,140 --> 00:02:00,700
And the punchline, they did all of it for no improvement on the evaluation score.

27
00:02:00,980 --> 00:02:03,319
All that and the grade didn't even go up.

28
00:02:03,939 --> 00:02:06,719
Y'all, that's every project I was ever in.

29
00:02:08,009 --> 00:02:09,569
So here's how it starts.

30
00:02:10,009 --> 00:02:12,270
Back in May, one agent leaves a note.

31
00:02:12,750 --> 00:02:15,569
Agent seeks a file, upload if found.

32
00:02:15,849 --> 00:02:20,849
Like a flyer on one of those cork boards and the next day other agents would find the note

33
00:02:20,849 --> 00:02:22,490
and they would start writing back.

34
00:02:23,009 --> 00:02:24,430
Well, where's the cork board?

35
00:02:25,110 --> 00:02:29,430
OpenAI let the agents install software through an internal package server.

36
00:02:29,930 --> 00:02:32,430
Think of it like a company supply closet for code.

37
00:02:32,430 --> 00:02:39,509
And every one of those tests, sandboxes logged in and supply closet with the same shared password.

38
00:02:40,689 --> 00:02:43,069
Every sandbox, the one password.

39
00:02:43,509 --> 00:02:45,169
That's not a robot superpower.

40
00:02:45,469 --> 00:02:47,469
That's a sticky note on a monitor.

41
00:02:48,460 --> 00:02:53,659
OpenAI says plainly, the message board was built without exploiting a vulnerability.

42
00:02:53,659 --> 00:02:58,460
No hacking required. They just used the key OpenAI handed out.

43
00:02:59,840 --> 00:03:00,840
And it got big.

44
00:03:01,120 --> 00:03:05,939
METR, M-E-T-R, an independent research group that investigated afterwards,

45
00:03:06,280 --> 00:03:12,479
counted at about 1,200 agents sending more than 70,000 messages and files,

46
00:03:12,719 --> 00:03:15,599
and about 700 of them went after Hugging Face.

47
00:03:15,939 --> 00:03:19,659
That's in about two and a half weeks, late June to mid-July.

48
00:03:21,240 --> 00:03:25,280
So let's walk the doors, because this is the part of the headline skip.

49
00:03:25,919 --> 00:03:28,680
One, that's a shared password.

50
00:03:29,379 --> 00:03:32,680
Two, the supply closet could reach the open internet.

51
00:03:32,680 --> 00:03:39,000
By late May, the agents were using it to get outside, and somebody at AI actually saw it

52
00:03:39,000 --> 00:03:41,199
happening and they didn't get it escalated.

53
00:03:42,009 --> 00:03:48,430
Three, an old legacy login endpoint that if you had handed it a forged admin password,

54
00:03:48,849 --> 00:03:50,530
it would have gave you back a real one.

55
00:03:50,810 --> 00:03:55,770
Four, a web folder that lets you create stuff without logging in at all.

56
00:03:57,469 --> 00:04:01,289
Five, and this is probably my favorite, how do they get into Hugging Face?

57
00:04:01,789 --> 00:04:07,110
Well, Hugging Face is the big public library for open AI models, basically the GitHub of

58
00:04:07,110 --> 00:04:07,430
AI.

59
00:04:07,930 --> 00:04:14,650
The agents found 14 Hugging Face login tokens sitting in a public data set on Hugging Face.

60
00:04:15,110 --> 00:04:20,389
Somebody had published their keys in public and on the same site.

61
00:04:20,389 --> 00:04:23,931
six on OpenAI's own machines a kernel bug

62
00:04:23,931 --> 00:04:28,509
that was already public already disclosed just wasn't

63
00:04:28,509 --> 00:04:36,310
patched and seven on june 27th an alarm went off a real one tied to this activity and the on-call

64
00:04:36,310 --> 00:04:44,209
response was quote stopping the evaluation run was not required the alarm went off somebody looked

65
00:04:44,209 --> 00:04:49,230
at it and decided it could wait if you've ever worked at a help desk you know you just felt that

66
00:04:49,230 --> 00:04:55,180
in your chest. So on July 11th, the agents get code running on a Hugging Face server.

67
00:04:55,740 --> 00:05:01,959
And in under 13 hours, they go from one little worker to admin level access across multiple

68
00:05:01,959 --> 00:05:08,339
Hugging Face clusters. They ran code on 41 production servers and downloaded four private

69
00:05:08,339 --> 00:05:15,360
code repos. How? Hugging Face told us, and I respect them for doing it. Two of our own

70
00:05:15,360 --> 00:05:21,519
settings allowed it. They had no rule blocking the most powerful kind of container and one service

71
00:05:21,519 --> 00:05:27,279
account that could create containers across the whole cluster. Plus, some workloads could reach

72
00:05:27,279 --> 00:05:34,160
the cloud's internal metadata service, the thing that hands out the keys. Now, in fairness, the

73
00:05:34,160 --> 00:05:40,079
agents also found brand new bugs, real ones nobody has seen before. So the honest version of this

74
00:05:40,079 --> 00:05:43,336
story isn't it was all easy. It's this.

75
00:05:43,336 --> 00:05:48,180
Some of the locks they picked were new, but every building

76
00:05:48,180 --> 00:05:55,000
they got into had a door propped open, a shared password, an exposed token, a missing setting,

77
00:05:55,300 --> 00:06:01,100
an alarm that nobody acted on. Two more things from Hugging Face that every small business should

78
00:06:01,100 --> 00:06:08,120
hear. They caught it largely with AI of their own. Their alert systems used AI to sort the noise.

79
00:06:08,120 --> 00:06:08,479
Good.

80
00:06:08,479 --> 00:06:14,326
But when they went to use the big commercial AI tools to investigate, those tools

81
00:06:14,326 --> 00:06:22,339
refused and, quote, the provider's safety guardrails cannot distinguish an incident responder from an attacker.

82
00:06:22,800 --> 00:06:27,500
So mid incident, they switched to an open model running their own hardware.

83
00:06:28,100 --> 00:06:35,800
Their lesson, word for word, have a capable model you can run on your own infrastructure, vetted and ready before an incident.

84
00:06:36,360 --> 00:06:38,920
Write that one down because we'll come back to it.

85
00:06:39,600 --> 00:06:43,420
OpenAI's own verdict, this incident should have never occurred.

86
00:06:43,420 --> 00:06:48,399
They called it a warning shot and they say if monitoring they run today had been running

87
00:06:48,399 --> 00:06:53,120
back then, then they would have paged their security team more than a day before anything

88
00:06:53,120 --> 00:06:54,680
ever touched Hugging Face.

89
00:06:55,199 --> 00:06:59,750
Quick one, because you're going to see this headline and it's going to be wrong.

90
00:06:59,750 --> 00:07:04,151
Same month, a security company called Hacktron, three human

91
00:07:04,151 --> 00:07:08,328
researchers, used Claude, Anthropic's AI to hunt bugs at

92
00:07:08,328 --> 00:07:08,850
OpenAI.

93
00:07:09,250 --> 00:07:14,058
They got from an OpenAI community forum all the way to the

94
00:07:14,058 --> 00:07:20,110
employees in ChatGPT accounts and OpenAI internal code in under 72 hours.

95
00:07:20,110 --> 00:07:26,471
The doors, an image library on the forum that never got a fix backported, and

96
00:07:26,471 --> 00:07:32,914
an open AI login setup where one token was accepted by the forum, ChatGPT, and

97
00:07:32,914 --> 00:07:33,410
Codex.

98
00:07:33,709 --> 00:07:35,709
One key, three buildings.

99
00:07:36,509 --> 00:07:38,290
Here's the detail nobody ran.

100
00:07:38,730 --> 00:07:43,187
Claude refused to write an exploit against a live target, so the researchers

101
00:07:43,187 --> 00:07:47,350
dressed the target up to look like a practice hacking challenge, a CTF.

102
00:07:47,930 --> 00:07:54,050
Hacktron's own words, not completely autonomous, and skilled human guidance remained important.

103
00:07:54,689 --> 00:07:59,829
OpenAI fixed it in about 14 hours and paid a $6,500 bounty.

104
00:08:00,610 --> 00:08:04,449
Hacktron sells AI security services, so grain of salt.

105
00:08:05,009 --> 00:08:07,269
That's not "Claude hacked OpenAI."

106
00:08:07,269 --> 00:08:12,769
That's three people with a powerful tool and a key that opened up too many doors.

107
00:08:12,769 --> 00:08:19,209
So when you see the coverage, rogue AI? Not really. It was cheating on a test,

108
00:08:19,529 --> 00:08:24,529
and Hugging Face was where it thought the answer key was. Off-task, not evil.

109
00:08:25,029 --> 00:08:31,629
First time AI escaped human control, the only person who said first was Hugging Face's CEO,

110
00:08:32,049 --> 00:08:37,549
and what he said was possibly a first of a kind. The AI hid its tracks from humans.

111
00:08:38,169 --> 00:08:43,809
METR, M-E-T-R, the independent investigators found it was trying to fool the automatic grader

112
00:08:43,809 --> 00:08:49,149
and only, very rarely and weakly, reasoned about hiding from people.

113
00:08:49,649 --> 00:08:51,429
And no customer data was affected.

114
00:08:52,009 --> 00:08:55,309
OpenAI said that in August about the Hugging Face break-in.

115
00:08:55,309 --> 00:09:02,070
Then in September, OpenAI itself disclosed that its research agents had posted 53 images

116
00:09:02,070 --> 00:09:07,730
users had uploaded to ChatGPT onto outside image hosting sites.

117
00:09:07,950 --> 00:09:09,590
Most of them are down now.

118
00:09:10,549 --> 00:09:12,509
None of the scary headlines are the lesson.

119
00:09:12,929 --> 00:09:14,330
The lesson's on the list.

120
00:09:14,809 --> 00:09:17,490
Every door on it is a door that you have.

121
00:09:20,990 --> 00:09:21,789
Radius check.

122
00:09:22,210 --> 00:09:23,389
How far does this reach?

123
00:09:23,690 --> 00:09:24,909
And does it reach you?

124
00:09:25,759 --> 00:09:28,799
Before I quote the next company, you need to know something.

125
00:09:28,799 --> 00:09:35,159
This show is produced with the help from Claude, Anthropic's AI and my company AIQSO

126
00:09:35,159 --> 00:09:41,039
that sells AI services. So when I quote Anthropic, I'm quoting the company that makes a tool that I

127
00:09:41,039 --> 00:09:47,919
use, grain of salt. That's why I'm telling you. Anthropic put out a threat report in September,

128
00:09:48,299 --> 00:09:53,080
what criminals and spies actually try to do with their AI over the last several months.

129
00:09:53,080 --> 00:10:00,610
And the line in it that matters the most for you is this one. The attacks themselves are familiar,

130
00:10:00,610 --> 00:10:07,990
involving stolen credentials, unpatched edge devices, exposed services, SQL injections,

131
00:10:07,990 --> 00:10:13,649
and phishing. None of the operations in this report depend on some entirely novel technique

132
00:10:13,649 --> 00:10:19,529
that defenders have never seen. Instead, the economics of the attacks have changed.

133
00:10:20,559 --> 00:10:27,340
Stolen passwords, unpatched boxes, stuff left open, phishing, that's the list from 2010.

134
00:10:27,340 --> 00:10:34,600
shoot, that's the list from 2000. So what's changed? The cost. The report says AI makes

135
00:10:34,600 --> 00:10:40,379
previously marginal targets viable. Let me translate that for small business owners.

136
00:10:41,080 --> 00:10:45,379
You know how you always figured, who's going to really bother us? Who's going to hack us?

137
00:10:45,679 --> 00:10:52,919
We're 12 people and a QuickBooks file. That used to be true. Breaking into you cost a bad guy time

138
00:10:52,919 --> 00:11:00,259
and you weren't worth the time. AI just made time cheat. The report again, everything connected to

139
00:11:00,259 --> 00:11:07,080
the internet is a potential target. One example from it, a single stolen developer token,

140
00:11:07,460 --> 00:11:14,120
one key to a full admin's control of a company's cloud environment in roughly three hours.

141
00:11:14,679 --> 00:11:20,360
Now the honest version, because I don't want to sell fear, the same report says humans still made

142
00:11:20,360 --> 00:11:25,720
the big call, who to target, and what to do with what they found. And some of the worst break-ins

143
00:11:25,720 --> 00:11:31,960
had a human driving every single step. And the patch window is now shrinking. Things you keep

144
00:11:31,960 --> 00:11:37,379
hearing about, they're real. Google's Mandiant team, which also sells incident response, so take

145
00:11:37,379 --> 00:11:42,899
that how you want, they estimate that bugs are now getting exploited on an average before the

146
00:11:42,899 --> 00:11:49,539
fix is even out. But Mandiant also says, and quote, we do not consider 2025 to be the year

147
00:11:49,539 --> 00:11:55,740
where breaches were the direct result of AI. The window was already closing. AI just lets the

148
00:11:55,740 --> 00:12:02,659
people closing it do it more on an autopilot. So let's make it real. Here's a door a lot of

149
00:12:02,659 --> 00:12:09,240
small offices have. Fortinet makes firewalls, FortiGate, super common in small offices and

150
00:12:09,240 --> 00:12:14,639
branch locations. In January of this year, Fortinet published a fix for a serious bug in

151
00:12:14,639 --> 00:12:21,379
those boxes. An attacker on the internet with no password could take one over. January 13th,

152
00:12:21,379 --> 00:12:27,639
the patch was out. Starting around July, six months later, attackers started going after

153
00:12:27,639 --> 00:12:33,519
boxes that never got that security patch. A security vendor called SOCRadar says that

154
00:12:33,519 --> 00:12:40,440
they targeted about 30,000 internet addresses and affected 178 of them. And the attack tool

155
00:12:40,440 --> 00:12:47,279
they used was recovered was built for specific models the 40f the 60f the 80f and the 100f

156
00:12:47,279 --> 00:12:54,000
those are all small office boxes maybe the one in your closet what did they take the firewall

157
00:12:54,000 --> 00:12:58,420
saved secrets vpn passwords wi-fi passwords admin

158
00:12:58,420 --> 00:13:02,208
accounts on september 9th sisa the federal

159
00:13:02,208 --> 00:13:02,659
cyber

160
00:13:02,659 --> 00:13:08,320
agency put it on their list of bugs being actively exploited and they gave federal agencies three

161
00:13:08,320 --> 00:13:13,679
days to deal with it. And here's the part to sit with. SOCRadar believes that the attacker's

162
00:13:13,679 --> 00:13:20,639
implant was probably written with AI help. Fine, maybe. But nobody says AI found the bug.

163
00:13:21,000 --> 00:13:26,860
Fortinet found it themselves. AI didn't open the door. A six-month-old patch that never got

164
00:13:26,860 --> 00:13:32,720
installed opened that door. And one more thing from SOCRadar that people miss. Patching now

165
00:13:32,720 --> 00:13:38,299
closes the door. It does not kick out anybody who already walked through it, and it doesn't

166
00:13:38,299 --> 00:13:44,710
unsteal the passwords. One more date, and this one's personal for a lot of you all.

167
00:13:45,110 --> 00:13:50,389
If you're running your businesses on Windows 10, you might've heard Microsoft gave everybody

168
00:13:50,389 --> 00:13:57,149
another free year. They did for personal computers. Microsoft's own page says the

169
00:13:57,149 --> 00:14:03,389
consumer program cannot be used in commercial scenarios. So for businesses, the paid security

170
00:14:03,389 --> 00:14:07,841
update program year one, it ended on October 13th.

171
00:14:07,841 --> 00:14:10,066
That's this past Tuesday.

172
00:14:10,066 --> 00:14:11,669
Year one was $61 a

173
00:14:11,669 --> 00:14:17,289
machine. And Microsoft says that that price doubles every year and it's cumulative. So if

174
00:14:17,289 --> 00:14:24,179
you didn't buy year one, you have to pay for year one and year two to get back in. So if you got a

175
00:14:24,179 --> 00:14:30,059
Windows 10 machine at your office and you didn't decide yet, you're making a decision right now by

176
00:14:30,059 --> 00:14:36,240
not making it. Upgrade them. Pay for them. And this is a move a lot of people miss. Microsoft

177
00:14:36,240 --> 00:14:44,200
updates included for Windows 10 machines are free if you connect to a Windows 365 cloud PC.

178
00:14:44,679 --> 00:14:50,840
As long as you got that Windows 365 subscription, talk to whoever does your IT this week. An

179
00:14:50,840 --> 00:14:56,740
unpatched Windows 10 box is exactly the kind of unpatched that report was talking about.

180
00:15:00,179 --> 00:15:00,909
The fix.

181
00:15:00,909 --> 00:15:05,744
Three things, all free, each one's an afternoon tops.

182
00:15:05,744 --> 00:15:08,389
So here's the question I want

183
00:15:08,389 --> 00:15:15,129
you to be able to answer. What AI tools does your business use and what can each one log into?

184
00:15:15,669 --> 00:15:22,149
The chat bot with no access to your email, the note taker in your meetings, the plugin that

185
00:15:22,149 --> 00:15:29,250
somebody connected to the shared drive, the agent that can send invoices. The U.S., the U.K., Canada,

186
00:15:29,450 --> 00:15:36,129
Australia, and New Zealand, the five I's, put out a joint guide on this in May and small and medium

187
00:15:36,129 --> 00:15:43,470
businesses are named for who's it for. The core of it, keep a list of agents, each one, and only

188
00:15:43,470 --> 00:15:49,490
give them the minimal rights necessary for each job and the use keys that expire instead of

189
00:15:49,490 --> 00:15:55,470
passwords that live forever. That shared password at OpenAI, that's what this fixes.

190
00:15:55,870 --> 00:16:01,009
And it's not just robots. Let me tell y'all something. This is one of those stories that

191
00:16:01,009 --> 00:16:07,289
happened. Few years back, I'm at a company that I'm not going to give the name and the CEO wanted

192
00:16:07,289 --> 00:16:14,549
admin rights, full admin on everything. Why? Because he was the CEO. That was the whole

193
00:16:14,549 --> 00:16:20,370
argument I'm the CEO and I should have admin rights and I get it it's your company it feels

194
00:16:20,370 --> 00:16:24,950
like you should have every key but the job of running the company and running your jobs

195
00:16:24,950 --> 00:16:30,350
administration of the systems are two different jobs so if he didn't need it for that admin role

196
00:16:30,350 --> 00:16:35,570
of his user account he could have created a separate account that had that access not the

197
00:16:35,570 --> 00:16:42,090
one that was tied to his CEO account but as his IT department didn't get pushed back he got it

198
00:16:42,090 --> 00:16:47,289
And guess what happened? His login got compromised. Now, I can't tell you how I know,

199
00:16:47,529 --> 00:16:52,789
but I know that his account was an admin account and the attacker didn't get a CEO's inbox. They

200
00:16:52,789 --> 00:16:58,370
got the keys to the building and that company's source code walked out the door. Not because the

201
00:16:58,370 --> 00:17:03,090
attacker was a genius, but because the account they stole could do everything and they never

202
00:17:03,090 --> 00:17:09,269
needed it to do. Your title is not permission, not for the CEO, not for the intern and not for

203
00:17:09,269 --> 00:17:15,269
the AI agent you connected last week. Everybody and everything gets exactly what the job needs,

204
00:17:15,710 --> 00:17:21,750
nothing more. 14 tokens in a public data set. That's how they got into Hugging Face.

205
00:17:22,150 --> 00:17:27,769
So run a free scanner over your code and your shared drives. There are a lot of good free ones

206
00:17:27,769 --> 00:17:33,549
out there. gitleaks and trufflehog are two that I would probably point you at. And it'll find

207
00:17:33,549 --> 00:17:39,529
passwords, API keys, sitting in files where they shouldn't be. And here's the part everybody gets

208
00:17:39,529 --> 00:17:45,730
wrong. Deleting the file does not delete or kill the key. If a key has been exposed, you go to

209
00:17:45,730 --> 00:17:52,089
whoever issued it, Microsoft, Google, Amazon, your payment processor, and you revoke it there.

210
00:17:52,089 --> 00:17:58,329
Then you make a new one. Microsoft's own guidance says it straight. Exposed secrets provide

211
00:17:58,329 --> 00:18:04,230
attackers with legitimate credentials to blend their activities with legitimate operations.

212
00:18:04,809 --> 00:18:10,869
That's the thesis. In Microsoft's words, they don't break in, they log in with your credentials.

213
00:18:11,900 --> 00:18:18,200
Write down every box that faces the internet, firewall, VPN, the NAS in your closet,

214
00:18:18,200 --> 00:18:24,759
whatever remote access tool the IT guy stalled back in 2019 and whatever version each one's

215
00:18:24,759 --> 00:18:29,920
running on. Then sign up for CISA's Known Exploited Vulnerabilities list. It's free.

216
00:18:30,319 --> 00:18:36,180
There's an email and an RSS feed. It's the government's list of bugs criminals are actually

217
00:18:36,180 --> 00:18:41,279
using right now. If something shows up on your list, it shows up on their list. That's the one

218
00:18:41,279 --> 00:18:46,980
you patched tonight, not next quarter. That FortiGate fix was out for six months before

219
00:18:46,980 --> 00:18:50,465
attacks started showing up. Six months.

220
00:18:50,465 --> 00:18:53,413
You had time to patch it. Use it.

221
00:18:53,413 --> 00:18:55,200
Fix one and fix two.

222
00:18:55,200 --> 00:19:01,440
who gets access, and what happened to the keys, that's module three, identity. It's live, it's

223
00:19:01,440 --> 00:19:08,400
free, there's a quiz. Fix three, the firewall, the router, the box in the closet, that's the home and

224
00:19:08,400 --> 00:19:13,920
small office networks module. And I'll be straight with you, it's not written yet, but it's coming to

225
00:19:13,920 --> 00:19:19,940
you soon. The community votes on what gets written next, and the top votes ship a full lesson the

226
00:19:19,940 --> 00:19:26,390
following week. So if you want it, go vote. That's how this works. So that's the radius on

227
00:19:26,390 --> 00:19:32,089
this one. Hundreds of AI agents, some of the most advanced models on the planet. And the way in was

228
00:19:32,089 --> 00:19:38,710
a shared password, a token that somebody posted in public, a patch nobody installed, an alarm

229
00:19:38,710 --> 00:19:46,670
somebody decided could wait. The robots didn't invent the new way in. They used yours. And that's

230
00:19:46,670 --> 00:19:52,589
actually good news because you can close a door that you already know about. In the next episode

231
00:19:52,589 --> 00:19:58,009
upcoming, somebody got into a company's cloud and started deleting everything they could reach

232
00:19:58,009 --> 00:20:04,190
and they went after the backups by name. Only the stuff that survived was the stuff that somebody

233
00:20:04,190 --> 00:20:10,289
took the time to bother and lock. So next time we're talking about backups, the ones you think

234
00:20:10,289 --> 00:20:16,269
you have and how secure are they. The lessons are in the community Inside The Blast Radius on Skool.

235
00:20:16,269 --> 00:20:20,990
The foundation's track is free links in the description. Come tell me about the worst

236
00:20:20,990 --> 00:20:27,250
admins right request you ever got. I know y'all got one. This is your boy Q. Everything has a

237
00:20:27,250 --> 00:20:32,769
blast radius. Go find out how far your goals and remember, check your firewalls. Peace.