The Audit - Cybersecurity Podcast

What if the most valuable software your company owns isn't something you bought, but the processes your team already knows how to run? In this episode of The Audit, Joshua Schmidt, Eric Brown, and Nick Mellem welcome back Alex Bratton, CEO and Chief Geek of Lextech, founder of AI Why, and author of the new book Capability Equity. Alex helps mid-market organizations get real business value out of AI, and he brings that practical lens to the assistants, wearables, and platforms showing up on everyone's phones right now. 
The crew puts the Instinct AI assistant under the microscope, and Alex explains why he calls these tools free range agents and why Meta's Muse lands firmly in his no-go category for privacy. From there the conversation turns to Apple's privacy-first approach to Siri, why big SaaS platforms like Salesforce need to rethink their value, and how teams can build AI skills that capture the work that makes them unique. Alex also shares research showing nearly a third of skills in popular online repositories contained security vulnerabilities. Watch until the end to see Eric reacting to a takeoff from Nepal's Lukla Airport. 
In this episode: 
Why Alex calls tools like Instinct and Muse “free range agents,” and what that means before you hand them your passwords, credit cards, or personal data. 
How owning your processes as AI skills, rather than renting them from someone else’s platform, turns everyday know-how into lasting company value. 
Why Apple’s on-device approach and Private Cloud Compute make Siri a privacy model enterprises should be watching. 
The six-phase path from bloated SaaS to AI skills and micro apps, and why platforms that are just a UI on top of your data may not survive. 
Why skills from online repositories should be inspiration only, since running someone else’s code invites it into the middle of your ecosystem. 
If this conversation changed how you think about the AI tools on your phone, share it with someone who needs to hear it. Like, share, and subscribe for more of the discussions shaping the future of cybersecurity and IT. 
#AISkills #CapabilityEquity #Cybersecurity #AIAgents #DataPrivacy #AppleIntelligence #Siri #SaaS #ITAudit #ClaudeCode

What does a device shaped like a 90s pager have to do with the Wi-Fi network your laptop joined at Starbucks last month? In this episode of The Audit, Joshua Schmidt, Eric Brown, and Nick Mellem are joined by IT Audit Labs' own Cameron Birkland to get hands-on with the Hak5 Wi-Fi Pineapple Pager, the newest tool in the Pineapple lineup. Before the gear comes out, the crew unpacks a nine-year-old who ran up $118,000 in YouTube ads on his dad's saved work credit card, how Chrome sync quietly blends work and personal accounts, and new research showing LG smart TVs listening and collecting data even when they appear to be off. 
Cameron walks through what the Pineapple Pager does right out of the box, from passive recon and handshake capture to Wi-Fi 6E support and the reality that WPA3 has made many classic attacks far harder to pull off. Eric explains how probe requests let a rogue device impersonate your home or office network to set up a man-in-the-middle attack, shares what he captured at the Minnesota State Fair, and the team talks through war driving with GPS and WiGLE and how these demos land in security awareness training. The episode wraps with the debut of a new segment, Eric Reacts, featuring a pilot's breakdown of a gnarly crosswind landing. 
In this episode: 
• The Wi-Fi Pineapple Pager runs recon by default and supports Wi-Fi 6E, though WPA3 networks remain out of reach for today's Wi-Fi pen testing tools. 
• Eric explains how your devices call out for saved networks and how a rogue access point answers back to launch evil twin and man-in-the-middle attacks. 
• War driving in 2026 comes to life with GPS modules, WiGLE integration, and everything a pocket-sized device picked up in one afternoon at the state fair. 
• New findings show LG smart TVs listening and collecting data through automatic content recognition, which helps explain why TV prices stay so low. 
• A $118,000 ad bill shows what happens when Chrome sync blends work and personal accounts and kids share a browser with a company credit card.
If you've ever connected to public Wi-Fi without a second thought, this one is worth sharing with your team. Like, share, and subscribe for more of the discussions shaping the future of cybersecurity and IT. 
#PineapplePager #Hak5 #WiFiHacking #Cybersecurity #EthicalHacking #WarDriving #WPA3 #SmartTVPrivacy #InfoSec #PenTesting

Nation states are paying top dollar for zero day vulnerabilities, hackers went from an empty lab to domain admin in under four hours, and Nvidia's CEO says we just crossed into AGI. On this episode of The Audit, Joshua Schmidt, Eric Brown, and Nick Mellem break down the cybersecurity stories shaping the week and dig into a debate that has no clean answer. 
The crew opens with news that Eric Brown has a book on the way, built around lessons learned managing technology for clients over the years, before moving into Patch Tuesday, a PaperCut vulnerability that AI agents used to hack hundreds of organizations in seconds, and Nvidia CEO Jensen Huang's claim that artificial intelligence has already crossed into AGI territory. The conversation closes with an ancient parable about a fireman, and what it teaches modern IT teams about the habits they reward. 
In this episode: 
Eric Brown's upcoming book workshops potential titles for his book on fixing the managed service provider model. 
Patch Tuesday and zero days explained, covering what Microsoft's monthly patch cycle fixes and why a zero day can be worth a fortune to a nation state. 
The PaperCut breach and printer security, where an AI powered attack hit 395 organizations through a PaperCut flaw, echoing printer security nightmares the crew has seen during audits and pen tests. 
Have we already reached AGI, with Jensen Huang saying yes and Sam Altman calling the term meaningless, as the crew works through the paperclip dilemma and an AI sandbox experiment. 
The Fireman's Paradox, a centuries old parable about ignoring good advice and what it says about why organizations keep rewarding firefighting instead of prevention. 
If this episode gave you something to think about, share it with someone who needs to hear it. Like, share, and subscribe for more of the discussions shaping the future of cybersecurity and IT. 
#PatchTuesday #ZeroDay #Cybersecurity #AGI #PaperCut #ITAudit #InfoSec #AIThreats #Podcast #ITAuditLabs

What if your company didn't need a single line of code to build its own CRM, or a board of directors made up entirely of AI agents? In this episode of The Audit, Joshua Schmidt, Eric Brown, and Nick Mellem sit down with Loren Horsager, founder of Model Mind AI, who has been working in AI since 1993 and now spends his days coaching businesses and CEOs on how to actually put it to work. Loren has helped organizations trade their bloated software stacks, their expensive middleware, and their old habits for AI-driven processes that get built in days instead of quarters. 
The crew digs into vibe coding, AI councils, and the death of the traditional user interface, then pivots into the harder questions: what happens to developers, where security has to fit into the process, and why voice AI still hasn't earned people's trust. Along the way there's talk of AI trading bots, a QuickBooks security scare, a routing engine that hit 100 percent on-time delivery, and a debate about whether vinyl records and iPods still have a place in an AI-driven world. 
In this episode: 
Why vibe coding terrifies developers who ignore it 
The AI council approach to strategic thinking 
Why nobody loves their CRM anymore 
Where security has to sit in AI adoption 
Why voice AI works for productivity but not yet for trust 
If this conversation sparked something, share it with someone who needs to hear it. Like, share, and subscribe for more of the discussions shaping the future of cybersecurity and IT. 
#AI #VibeCoding #Cybersecurity #ITAudit #AIAgents #Automation #BusinessAI #TechLeadership #DigitalTransformation #TheAuditPodcast

What happens when nation-state hackers target the water coming out of your tap? In this episode of The Audit, Joshua Schmidt, Eric Brown, and Nick Mellem break down the recent wave of attacks on water utilities across Minnesota and 27 other states, where threat actors got their hands on administrative passwords to programmable logic controllers. The crew is joined for the first time by Kelly Venzke, Director of Business Operations at IT Audit Labs, who brings a business leadership perspective to a conversation that quickly turns technical. 
From there, Eric and Nick trace how these attacks echo the Stuxnet playbook used against Iran's nuclear program, explain how threat actors are impersonating help desk staff over Microsoft Teams to gain remote access, and dig into a blockchain-based command and control technique that hides inside paid search ads. The conversation wraps with practical advice on browser security, including why isolating AI browser extensions and ditching saved passwords in the browser matters more than most people realize. 
In this episode: 
Nation-state hackers breach US water utilities across 27 states. How Iranian threat actors obtained administrative access to programmable logic controllers and why Minnesota may have been ground zero. 
The Stuxnet connection. Eric breaks down how the historic attack on Iran's nuclear centrifuges bridged an air-gapped network, and why today's "air-gapped" systems often aren't as isolated as they seem. 
Help desk impersonation over Microsoft Teams. Why blocking external Teams-to-Teams calls has become a critical defense against social engineering attacks targeting employees. 
EtherHiding: blockchain-backed command and control. How attackers use paid search ads and blockchain infrastructure to maintain persistent, hard-to-detect access to compromised environments. 
Practical browser security tips. Kelly, Eric, and Nick talk through password managers, isolating LLM browser extensions, and why saving passwords in your browser is a bad habit worth breaking. 
Don't wait until your organization is the next headline. Like, share, and subscribe for more conversations on the threats shaping cybersecurity and IT today. 
#Cybersecurity #InfoSec #NationStateThreat #CriticalInfrastructure #WaterSecurity #APT #EtherHiding #BrowserSecurity #ITAudit #Stuxnet