Phillip Wylie Show

What does it take to go from growing up on welfare in Jamaica, Queens to running your own penetration testing company on your own terms?Patrick Gorman, better known as InfoSecPat, has lived that path, and his story proves that where you start doesn’t decide where you end up.Patrick is the CEO and founder of ISP Security, a pen testing firm built to give startups and small businesses access to testing they can actually afford. He brings experience across network, systems and cloud security, detection engineering and nearly four years as a CISO for a credit union, and he recently stepped into a new role as head trainer for a CISO program.Pat explains why he chose freedom over chasing millions, the business headache nobody warns new founders about, and how an hour a day of his own marketing keeps the leads coming in. He also shares why governing AI tools like ChatGPT and Microsoft Copilot is one of the biggest new challenges for today’s CISOs.Whether you’re thinking about starting your own cybersecurity business, working toward a CISO role, or wondering how much of yourself to share online, this episode is packed with honest insight. Stick around for the story behind Hack the Odds, the book Pat is writing now.Chapters00:00 Intro02:15 Pat’s InfoSecPat Origin Story04:39 Building ISP Security for Small Businesses08:37 Trading the 9 to 5 for Freedom11:45 The Hardest Part of Running a Business13:43 How Pat Markets His Pen Testing Business16:51 Brand Deals and a Privacy Wake-Up Call19:29 Teaching the Next Generation of CISOs24:35 What the Internet Doesn’t Know About You29:25 Why Showing Off Success Draws Hate34:59 Growing Up in Jamaica, Queens40:23 Hack the Odds and Pat’s Final Advice=========================Connect with Patrick Gorman (InfoSecPat):LinkedIn: https://www.linkedin.com/in/infosecpat/ISP website: https://ispsecurity.co/Pat's YouTube: https://www.youtube.com/@InfoSecPatPat's Instagram: https://www.instagram.com/infosecpat/Previous episode featuring Pat: https://youtube.com/live/jjk4Fgfogd4=========================Connect with your host, Phillip Wylie:LinkedIn: https://linkedin.com/in/phillipwylieX: https://x.com/PhillipWylieInstagram: https://www.instagram.com/phillipwylie

What does it take to go from hacking your way to more time on Oregon Trail in third grade to doing offensive AI research for a living?
Richie Vinson, an offensive AI security researcher at Cobalt, took the long way into cybersecurity, going from a rugby career and a help desk job to security work on the nuclear side, and now research into how AI is changing penetration testing.
Richie shares how his advice for breaking into offensive security has changed in just the past year, why building your own model from scratch can teach you things a certification never will, and what hardware you actually need to start running local LLMs at home. He also gives his honest answer on whether AI will replace pen testers, why so many companies are quietly hiring back the people they cut, and why he thinks local models are about to become a much bigger deal for organizations watching their token costs.
Richie also opens up about why volunteering and community helped him find his footing as an introvert, and gives a first look at Hack Myrtle, his new small-format cybersecurity conference on December 5, with an AI training from Royce Davis the day before. Whether you’re working toward the OSCP, experimenting with local AI models or trying to get better at networking, this episode is packed with practical advice from someone who started at the bottom. Stick around to hear about Netrunner, the upcoming documentary about his journey.
=========================
Connect with Richie Vinson:
LinkedIn: https://www.linkedin.com/in/r2600/
Hack Myrtle website: https://hackmyrtle.com/
=========================
Connect with your host, Phillip Wylie:
LinkedIn: https://linkedin.com/in/phillipwylie
X: https://x.com/PhillipWylie
Instagram: https://www.instagram.com/phillipwylie

What happens when a red teamer spends years sitting side by side with defenders, watching every EDR and SIEM on the market up close?

Trey Bilbrey has spent 18 years in IT and cybersecurity, from helping build the U.S. Marine Corps cyber program to red teaming industrial control systems for the Army Corps of Engineers, building Hack The Box Academy content and leading purple team engagements at Scythe, and he just launched his own consultancy.

Trey returns to the show two years after his first appearance as episode 100, and this time he shares why he now often recommends a detection over a fix, the moment leadership finally takes a pen test seriously, and how often organizations should really be running purple team exercises. He also gives a candid look at where AI fits into red teaming and threat emulation, including how far it can actually get from threat intelligence to a usable test plan, why a confident AI-built Sigma rule fooled no one, and his honest timeline for when AI could run a full red team engagement on its own.

Whether you’re trying to land your first cyber role, weighing Hack The Box against a degree, or curious about how purple teaming changes security culture, this episode is packed with real-world insight. Stick around to hear why Trey left big enterprise work behind to protect the small businesses in his own backyard, and how his Tampa nonprofit, the Neon Temple, is helping people break into the field.

========================
Connect with Trey Bilbrey:
LinkedIn: https://www.linkedin.com/in/georgebilbrey/
X: https://x.com/TCraf7

BSides Tampa Keynote: https://youtu.be/TBkzFBYU5vU?si=EtHqSUnAxIIv10yO

Trey's first appearance on the Phillip Wylie Show: https://www.youtube.com/watch?v=3n0BKLaqDvs

The Neon Temple (Non-Profit): https://www.theneontemple.com/https://www.youtube.com/@theneontemple/videos
Trey's Website: https://www.treycraft.com/

=========================
Connect with your host, Phillip Wylie:
LinkedIn: https://linkedin.com/in/phillipwylie
X: https://x.com/PhillipWylie
Instagram: https://www.instagram.com/phillipwylie

What happens when someone who knows exactly how applications are built decides to start breaking them? Jarrod Rizor went from writing code and running DevOps to hacking web and mobile apps for a living, and he recently joined TrustedSec as a penetration tester. His path is a real-world playbook for anyone trying to break into offensive security.

Jarrod shares what actually gets someone hired as a pen tester, why being stubborn can matter more than being the smartest person in the room, and how putting your work out there can open doors a certification alone never will. He also gives an inside look at how AI is changing ethical hacking, including what happened when he turned Claude Code loose on an iOS app with Frida, and lays out a low-cost way to start learning mobile application security on Android before you ever spend money on iOS gear.

Whether you’re working toward the OSCP, grinding through Hack The Box, curious about mobile app pen testing, or wondering where AI fits into offensive security, this episode is full of practical insight from someone who has walked the path. Stick around to find out why the volunteers at his local wildlife rehab center say nobody else can handle Grimble the great horned owl.

=========================
Connect with Jarrod Rizor:
LinkedIn: https://www.linkedin.com/in/jarrod-rizor-7270a832
X: https://x.com/Jr0dR87

=========================
Connect with your host, Phillip Wylie:
LinkedIn: https://linkedin.com/in/phillipwylie
X: https://x.com/PhillipWylie
Instagram: https://www.instagram.com/phillipwylie

Tim MalcomVetter has spent 26 years moving between offense and defense, and his biggest takeaway is that the future of security comes down to speed - whoever has the fastest software wins.
Tim got his start by offering to work for free at a hospital in the early days of HIPAA, which turned into his first security job. From there he moved into pen testing, including work on the point-of-sale system behind roughly one in three U.S. credit card transactions, and then into red teaming at Walmart, where engagements could run as long as eight months. Today he is the co-founder of Wirespeed and General Manager of Coalition Security.
Recorded in person at Cybr.Sec.Con in Houston, this conversation with Phillip gets into what separates real red teaming from pen testing, what cyber insurance data reveals about which security controls actually work, and why so many in the industry misjudge risk. Tim also shares how his red team experience shaped his approach to automation, and why he sees the next era of attack and defense being decided in milliseconds.
=========================
Connect with Tim MalcomVetter:
LinkedIn: https://www.linkedin.com/in/malcomvetter
WireSpeed: https://wirespeed.co
=========================
Connect with your host, Phillip Wylie:
LinkedIn: https://linkedin.com/in/phillipwylie
X: https://x.com/PhillipWylie
Instagram: https://www.instagram.com/phillipwylie