Legitimate Cybersecurity Podcasts

Getting into cybersecurity takes more than collecting certifications. How should you weigh a degree, hands-on experience, and the skills employers need?Frank Downs and Dr. Dustin Brewer return with more cybersecurity career questions submitted by listeners and students: how to choose a specialty, what credentials actually accomplish, and which skills to build first.Last episode covered getting your foot in the door. This time, we discuss choosing your direction—and making sure your résumé has real understanding behind it. There’s also a brief, apparently unavoidable detour through Castle Grayskull.In this episode:• Choosing a cybersecurity specialty that fits the work you actually enjoy• Exploring paths beyond hacking, including security operations, engineering, and governance, risk, and compliance• Weighing degrees, certifications, and hands-on experience• Looking for cybersecurity programs that include real client work• How hiring managers use relevant certifications when reviewing applications• Vendor certifications versus broader security knowledge• Why understanding computers and networks still matters• Using Wireshark to connect networking theory with what’s actually happeningWe also discuss the NICE Workforce Framework, Oregon State University, UMBC, and why finding work you enjoy can help guide your next certification or career move.The warning: collecting credentials without building the understanding behind them can leave you with an expensive résumé and some uncomfortable interview questions. Connect your next step to the work you want to do—and learn how to demonstrate what you know.▶ PREVIOUS EPISODEThe Truth About Breaking Into Cybersecurity With No Experiencehttps://www.youtube.com/watch?v=Obr55rr5E08Media/interview: admin@legitimatecybersecurity.comAudio: https://legitimatecybersecurity.podbean.com/CHAPTERS00:00 Getting into cybersecurity: more listener questions01:15 Cybersecurity is bigger than hacking02:41 Choosing your specialty06:09 Finding your path and exploring the NICE Framework09:56 Degrees vs. certifications vs. experience10:50 The unavoidable He-Man detour12:45 Credentials and hands-on learning14:21 Students working with real clients15:42 What hiring managers look for18:37 Are vendor certifications worth it?23:39 Which skills should you build first?27:04 Networking, Wireshark, and making it click29:44 Building computers and revisiting the fundamentals32:49 Finding your direction—and what comes nextWhich part of getting into cybersecurity has you stuck: choosing a specialty, deciding on a certification, or finding hands-on experience? Tell us in the comments.If you want dangerous technology explained through what it actually does to your life, subscribe.Keep on cybering.#Cybersecurity #CybersecurityCareers #CybersecurityJobs #CybersecurityCertifications #CybersecurityDegree #EntryLevelCybersecurity #CareerChange #Networking #Wireshark #LegitimateCybersecurity

How do you get a cybersecurity job without experience—and which certifications are actually worth your money? Frank and Dustin answer.Frank Downs and Dr. Dustin Brewer tackle three career questions submitted by listeners and students: how to land your first cybersecurity job, how to choose certifications, and how to stand out to employers.Dustin’s path ran through the Coast Guard and the NSA. Frank was preparing to sell suits at Nordstrom before a recruiter called. Neither story followed a neat checklist, and that’s part of the point: there’s more than one way into cybersecurity.In this episode:• Getting started without professional cybersecurity experience• Military and civilian routes into the field• Where degrees, certifications, internships, and volunteer work fit• Network+ and Security+ as foundational options• Choosing specialized certifications around your interests and career goals• Training costs, renewal fees, and why collecting credentials can get expensive• What employers look for in résumés and interviews• Explaining the experience you actually gained through projects and internships• Why a tailored résumé matters• The certified applicant who couldn’t draw a basic home networkWe also discuss CyberSeek, hands-on training, government qualification requirements, and the difference between cybersecurity programs housed in business schools and computer science departments.The warning: a certification can help demonstrate knowledge, but you still need to explain—and show—what you can do. Before paying for another credential, connect it to the work you want to pursue.Media/interview: admin@legitimatecybersecurity.comAudio: https://legitimatecybersecurity.podbean.com/CHAPTERS00:00 Three cybersecurity career questions00:57 Getting your first job without experience01:32 Dustin’s Coast Guard route into cybersecurity06:18 From IT training to the NSA08:23 Security clearances and civilian transitions10:48 Frank’s unexpected route into the NSA14:11 There’s more than one way into cybersecurity15:38 Degrees, certifications, and earning employer trust18:05 Which cybersecurity certifications are worth getting?19:31 Government requirements and hands-on exams21:43 Training costs and the SANS discussion23:36 Foundational and specialized certifications26:18 CyberSeek and choosing your direction28:18 Renewal fees and the cost of keeping certifications30:47 Different types of cybersecurity degrees32:15 How to stand out to employers33:12 The applicant pile and applying early34:14 Certifications versus demonstrated ability35:11 The home-network interview test36:32 Résumé requirements and relevant experience38:54 Explaining your work without burying the reader40:22 Tailoring résumés and writing cover letters41:23 What’s coming in the next career discussionIf you want dangerous technology explained through what it actually does to your life, subscribe.Keep on cybering.#cybersecurity #cybersecuritycareers #cybersecurityjobs #EntryLevelCybersecurity #securityplus #networkplus #CybersecurityCertifications #CareerChange #JobInterview #LegitimateCybersecurity

Police officers used Flock Safety cameras to track exes and other personal targets. Flock’s security chief explains what its cameras record, who can search the data, and what the company says is changing now.In this episode, Frank Downs and Dr. Dustin Brewer sit down with Chris Castaldo, Chief Information Security Officer at Flock Safety, for a direct conversation about the nationwide license-plate-reader network appearing along roads, in neighborhoods, and outside private businesses.Chris previously worked in the NSA’s Tailored Access Operations, served in the U.S. Army during Operation Iraqi Freedom, and is the author of Startup Secure.The conversation covers:• Officers accused of using license-plate searches for personal tracking • Flock’s announced reduction of its default retention period from 30 days to seven days for new customers • Anomalous-search detection, account lockouts, case numbers, and audit controls • Why multi-factor authentication only recently became mandatory • What a Flock camera records when a vehicle passes • How the image travels from the roadside camera to cloud storage • How law-enforcement agencies, businesses, and HOAs can share camera observations • Who Flock says owns the data and who can search it • Whether Flock cameras collect Wi-Fi, Bluetooth, or phone identifiers • The separate Flock camera feeds exposed through a cellular-provider configuration issue • The absence of a comprehensive federal privacy law governing this technology • Whether Flock plans to add facial recognition • How some vehicle images may be used for machine-learning training • The public-safety argument involving stolen vehicles, missing people, and AMBER Alerts • Whether Frank and Dustin’s opinions changed after hearing Flock’s answers The central question is not whether this technology can help solve crimes. It can.The question is whether a system powerful enough to help locate a missing child is also powerful enough to expose the movements of innocent people—and whether companies, police departments, lawmakers, and oversight systems can keep up.EDITORIAL NOTE: Chris Castaldo represents Flock Safety. Statements concerning Flock’s products, controls, security, data handling, accuracy, and public-safety outcomes reflect the company’s position unless independently sourced. Several safeguards discussed in this interview were announced as phased changes and are not yet mandatory for every customer.Additional context and competing perspectives:Associated Press — Flock’s announced changes and the national backlash: https://apnews.com/article/flock-license-plate-cameras-surveillance-deflock-2a93bc075e2f7ffcca9e04a35d75a3feWashington Post — investigation of officer misuse: https://www.washingtonpost.com/technology/2026/08/02/how-police-officers-used-vast-network-cameras-spy-their-exes/Flock Safety — the company’s announcement: https://www.flocksafety.com/blog/flock-guardrails-address-lpr-privacy-concerns-and-police-transparencyACLU — criticism and competing perspective: https://www.aclu.org/news/privacy-technology/tracking-alpr-cameras/flock-safety-credibility-lost-as-it-repeatedly-lies-to-city-councils-police-departments-and-public-across-the-countryMedia/interview: admin@legitimatecybersecurity.com Audio podcast: https://legitimatecybersecurity.podbean.com/If you want dangerous technology explained through what it actually does to your life, subscribe.Keep on cybering.CHAPTERS00:00 Officers tracking exes—and Flock’s response 00:41 Meet Flock Safety’s security chief 01:49 What does a Flock camera capture? 03:05 From the roadside camera to the cloud 04:56 Can HOAs share camera data with police? 08:22 Police misuse and Flock’s new safeguards 12:19 Why are these changes happening now? 15:42 How officers use real-time Flock alerts 17:00 Who controls police camera data? 18:40 Who owns the images? 21:51 Could Flock cameras track phones or Wi-Fi? 26:00 Were Flock cameras exposed online? 29:14 America’s privacy-law gap 31:19 Why regulation always trails technology 33:32 Safety versus abuse 35:21 Why nobody trusts the system 37:08 Transparency portals and public audits 38:58 Will Flock add facial recognition? 39:43 The public-safety argument 41:11 Wi-Fi, Bluetooth, and camera hardware 42:33 Does Flock use images to train AI? 44:43 Chris Castaldo’s path into cybersecurity 48:11 The one security rule everyone should follow 48:25 Did this interview change our minds?#FlockSafety #FlockCameras #Privacy #Surveillance #LicensePlateReaders #ALPR #DataPrivacy #PoliceTechnology #CivilLiberties #Cybersecurity #LegitimateCybersecurity

Private equity is moving into the infrastructure beneath your internet—and the real prize may be control over who gets data first.Frank Downs and Dr. Dustin Brewer examine the undersea cables carrying the world’s communications and why financial firms increasingly see them as valuable digital real estate.These cables connect countries, financial markets, cloud services, governments, and billions of people. But when a small number of powerful organizations own the infrastructure, they may gain enormous leverage over speed, access, competition, maintenance, and the flow of information itself.In this episode:- How undersea internet cables actually work- Why private equity considers them attractive infrastructure- The “internet toll booth” business model- Why milliseconds matter in financial markets- Whether corporate ownership could create a privatized Great Firewall- Net neutrality, monopoly power, and national security- The uncomfortable question of who should own essential communications infrastructureWe also get distracted by GeoCities, Second Life, Roku, Starbucks cup sizes, Zuckerberg attempting to appear human, and the Amish community that may have saved Wall Street from itself.The key warning: controlling content is powerful. Controlling the pipes beneath that content may be even more powerful.Media/interview: admin@legitimatecybersecurity.com Audio: https://legitimatecybersecurity.podbean.com/Hosted by Frank Downs and Dr. Dustin Brewer.CHAPTERS00:00 Private equity’s next target 00:44 The rise of digital real estate 02:14 How the internet crosses an ocean 03:39 What happens when one cable fails 05:06 Why Wall Street wants the seafloor 06:44 The internet toll-booth model 10:02 Controlling who gets data first 12:26 A corporate Great Firewall? 14:11 Why monopolies keep surviving 16:56 The slow death of net neutrality 21:38 The national-security problem 23:30 Who should own the internet? 26:38 What can anyone actually do?If you want dangerous technology explained through what it actually does to your life, subscribe.Keep on cybering.#underseacables #cybersecurity #internetinfrastructure #dataprivacy #PrivateEquity #NetNeutrality #InternetFreedom #DigitalInfrastructure #NationalSecurity #SubmarineCables

Grok Build reportedly uploaded entire Git repositories—including files it never opened, full Git history, and deleted secrets—to xAI-controlled cloud storage.In this episode of Legitimate Cybersecurity, Frank Downs and Dr. Dustin Brewer unpack what that means for anyone allowing an AI coding agent inside a real computer.Independent researcher CerebLab captured Grok Build packaging a complete repository into a Git bundle and sending it to cloud storage after being explicitly told not to read any files. Turning off “Improve the model” did not stop the transfer in the researcher’s test.That does not prove xAI trained on the code. It exposes a different problem: “don’t train,” “don’t transmit,” and “don’t retain” are three very different promises.Frank and Dustin discuss:• Why deleted passwords and API keys can survive in Git history• How AI coding agents gain broad access to your computer• Why developers keep treating security as something to add later• The difference between a breach, a leak, and a breach of trust• Why old code can be more dangerous than current code• What developers should do now: rotate secrets, isolate projects, restrict permissions, and monitor unexpected outbound dataIMPORTANT UPDATE: CerebLab reports that whole-repository uploads later stopped after xAI enabled a server-side control. SpaceXAI also promised to delete previously retained coding data and subsequently open-sourced Grok Build. This episode examines the documented behavior before that change—and the trust problem it exposed.Research and updates:https://cereblab.com/https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123Media/interview: mailto:admin@legitimatecybersecurity.comAudio podcast: https://legitimatecybersecurity.podbean.com/CHAPTERS00:00 — Grok Build reportedly uploaded whole repositories01:20 — Why Git repositories are a gold mine03:19 — Breach, leak, or breach of trust?04:23 — What AI coding agents actually do05:20 — Why old code still matters08:56 — Deleted passwords can survive in Git history10:41 — “Don’t train” vs. “don’t retain”12:30 — When an AI codes its own connector badly14:30 — What affected developers should do now16:38 — AI agents are becoming highly privileged19:31 — What system-level AI access can destroy21:26 — The network anomaly that exposed the upload22:19 — When bandwidth becomes a security signal23:43 — Patch quickly—without becoming CrowdStrike24:34 — The practical takeaway#Grok #GrokBuild #Cybersecurity #DataPrivacy #AICoding #VibeCoding #AIAgents #xAI #GitSecurity #SourceCode #ArtificialIntelligence #LegitimateCybersecurity

Hackers no longer need to steal your password. Software vulnerabilities have overtaken stolen credentials as the leading way attackers break into breached organizations.According to Verizon’s 2026 Data Breach Investigations Report, exploitation of software flaws now accounts for 31% of breach entry points. After years of companies concentrating on phishing, password security, and employee training, attackers may have found an easier target: the software itself.Frank Downs and Dr. Dustin Brewer examine why critical vulnerabilities remain exposed for months—even when patches already exist—and how artificial intelligence is changing the speed at which attackers can discover and exploit security flaws.In this episode:• Why software vulnerabilities have overtaken stolen credentials• How AI helps attackers find exploitable flaws faster• Why companies delay installing critical security patches• What the MOVEit breach revealed about patching failures• Why old printers, servers, and business applications remain dangerous• How organizations test patches without breaking production systems• Why network segmentation often becomes cybersecurity duct tape• What vulnerability scanners can—and cannot—detect• How threat intelligence, SOC teams, and vulnerability management should work together• Why the National Vulnerability Database is struggling to keep pace• What organizations can realistically do to reduce their exposureThe warning is simple: your password can be perfectly secure, and an attacker may still find another way in.Media/interview: mailto:admin@legitimatecybersecurity.comAudio: https://legitimatecybersecurity.podbean.com/CHAPTERS00:00 Hackers don’t need your password00:07 The new leading way attackers break in01:09 AI is finding software exploits faster02:19 MOVEit: The patch existed02:38 Why critical vulnerabilities remain exposed03:36 It is always the printer04:17 Is segmentation just security duct tape?05:00 Microsoft’s “keep an eye on it” solution05:50 Testing security patches on Timmy06:31 Making vulnerability management satisfying07:10 Excel formatting becomes a professional sport08:08 Scientists made brain cells play Doom10:10 The vulnerability-management maturity model11:38 Software is the weakest link again13:26 Can AI find unknown vulnerabilities?14:32 What AI can and cannot fix15:41 Why vulnerability scanners miss emerging threats18:14 Connecting SOC, threat intelligence, and vulnerability data18:52 Why cybersecurity remains a cost center20:01 The processes that can save an organization21:16 A high CVSS score is not everything21:40 Is the National Vulnerability Database falling behind?24:27 Why old vulnerabilities remain useful to hackers25:46 Your software is the new password#cybersecurity #hackers #databreach #SoftwareVulnerabilities #PasswordSecurity #ArtificialIntelligence #ZeroDay #PatchManagement #VulnerabilityManagement #VerizonDBIR

A $3 pair of kids’ shoes rang up for almost $19 at checkout. Mistake, dynamic pricing, or something much creepier?In this episode of Legitimate Cybersecurity, Frank Downs and Dr. Dustin Brewer break down a viral Walmart pricing story and ask the bigger question hiding behind it: what happens when stores, apps, location tracking, purchase history, and data brokers all meet at the register?This is not just about one pair of shoes. It is about whether the price you see is still the price everyone gets — or whether companies can quietly personalize what you pay based on where you are, what device you use, what you have bought before, and what they think you are willing to tolerate.Frank and Dustin discuss the difference between normal retail mistakes, dynamic pricing, surge pricing, geofenced pricing, and surveillance pricing. They also explain why this gets especially uncomfortable when the products involved are basic needs like food, clothing, and household goods.Main discussion threads:* The Walmart shoe price story* Why a $3 price becoming almost $19 gets people angry* Digital shelf tags and app-based prices* Dynamic pricing vs. surveillance pricing* How GPS, IP addresses, cookies, shopping apps, and data brokers can affect what companies know about you* Why VPNs may not solve the real problem* Why the person at the register is not the villain* What shoppers can do when prices change before checkoutThe key warning: the future of shopping may not be one price for everyone. It may be one price for you.Media/interview: mailto:admin@legitimatecybersecurity.comAudio: https://legitimatecybersecurity.podbean.com/Chapters:00:00 The price changed before checkout00:45 The $3 Walmart shoes story02:24 The app said $3, checkout said almost $1902:58 Retail mistake or something bigger?04:04 Why people trust prices less now04:50 Delivery apps and dynamic pricing05:40 Walmart, digital tags, and checkout confusion07:54 Are we already in the middle of surveillance pricing?09:01 How location and devices can influence prices10:49 Why phone GPS changes the game11:16 Digital shelf tags and backend prices12:12 The Sam’s Club checkout experiment13:29 Why VPNs may not save you14:30 Data brokers and behavioral pricing17:00 Dynamic pricing vs. surveillance pricing19:15 Privacy settings may not be enough21:23 What shoppers can do22:30 Don’t yell at the cashier23:25 The price tag may not be the real price#Cybersecurity #Walmart #DynamicPricing #SurveillancePricing #ConsumerPrivacy #DataPrivacy #RetailTech #DataBrokers #LocationTracking #ShoppingApps #DigitalPrivacy #LegitimateCybersecurity