The episode challenges the idea that phishing can be solved by training employees to recognize every malicious message. Because attackers can repeatedly target publicly discoverable employees, even a tiny failure rate eventually produces a successful compromise with organization-wide consequences.

Employee identities and emails are often discoverable
Repeated attempts make occasional human error inevitable
Near-perfect training still leaves exploitable failures
One successful phish can affect an entire organization
Technical controls must assume someone will eventually be deceived

“teaching people to not get fish is like teaching them not to fall in love. It's never going to happen.”
David Adrian · 13:43

“Even if it works ninety nine point nine nine percent of the time, the point zero one percent that it doesn't is enough for everything…”
David Adrian · 13:56

#phishing#security-awareness#human-error#social-engineering

Hot Take· 1

Hot Take05:21

Studios Spend Millions on Anti-Cheat but Leave Accounts Exposed

Game companies have strong economic incentives to combat cheating because it directly affects player retention and revenue. Yet some deploy sophisticated AI-based anti-cheat technology while failing to protect core corporate accounts with MFA, leaving the business itself exposed to catastrophic losses.

Cheating receives attention because its revenue impact is immediate
Studios may spend millions on cutting-edge anti-cheat systems
Corporate security can remain comparatively immature
A breach can cost millions or destroy years of development work

“They're leveraging all of this great technology to do that, and then on their corporate side, they don't have MFA to protect their main accounts.”
Adam Murray · 06:01

“But you have to understand you could have a breach that costs you millions, tens of millions of dollars.”
Adam Murray · 06:18

#anti-cheat#security-budget#mfa#risk

Explainer· 2

Explainer03:22

Why Ransomware Crews Steal Unreleased Game Assets

The studio faced more than encryption risk because attackers had also taken intellectual property, release details, videos, and images. This creates double extortion: criminals can demand payment both for restoring access and for withholding stolen material from the public.

Attackers stole intellectual property before deploying ransomware
Unreleased assets create additional leverage
Backups may also be targeted and encrypted
Operational urgency can make game companies more likely to pay

“We call it double extortion, where I've sealed up your code, right, and then not only am I saying pay me the ransom where you…”
Adam Murray · 03:46

#double-extortion#intellectual-property#ransomware#gaming

Explainer12:13

Why Every Game Developer Can Be a High-Value Target

Traditional enterprises often concentrate protection around administrators, but game developers may already possess broad access to code and assets. An attacker who compromises a developer might steal the entire game without creating accounts or escalating privileges.

Valuable targets extend beyond formal administrators
Developers may need broad access to build the game
Existing permissions can expose all underlying assets
Attackers may not require privilege escalation after account takeover

“in the gaming industry, there might be a broader set of targets because any developer who can build the game likely has access to all…”
David Adrian · 12:47

“if they get a game developer, they might just be able to walk away with all of the assets for the game by default”
David Adrian · 13:13

#developer-access#least-privilege#game-assets#account-security

Story· 1

Story00:02

The Admin Who Shut Down a Studio to Stop Ransomware

An engineer noticed that an unfamiliar account had moved a file, prompting the studio's lead IT administrator to terminate sessions, lock accounts, and require password changes. Investigators found unauthorized super-admin accounts, data exfiltration, and ransomware staged for deployment, forcing the company to halt work while it assessed the damage.

A moved file exposed the presence of an impostor account
The administrator immediately killed sessions and locked users out
Attackers had created multiple super-admin accounts
Ransomware was staged but had not yet been deployed
Containment delayed production but may have prevented a much larger loss

“So actually what he did just shut down all the accounts, killed all sessions, locked everybody out, required a password change”
Kate Fazzini · 00:32

“it was a really a courageous call that he made to do this, knowing what it was going to cost the company.”
Kate Fazzini · 01:39

#ransomware#incident-response#gaming#account-takeover

Tool· 1

Tool09:16

The Browser Is a Security Boundary for Distributed Teams

Remote game teams pass sensitive information through browsers and interconnected SaaS applications, but organizations may overlook browser hardening. Standardizing a managed browser and controlling personal synchronization or extensions can reduce unexpected data movement and inconsistent protection.

Sensitive collaboration increasingly happens in browsers
A standard browser enables consistent organization-wide controls
Personal account synchronization can import unsafe extensions
Extensions and backup tools may copy company information elsewhere
Browser hardening matters especially for distributed teams

“so much work happens right in the browser, and many companies just don't think of the security of that particular piece of software.”
Adam Murray · 10:05

“Are you making sure they're not sinking personal accounts that can bring in different extensions that they're using at home that do backups or copy…”
Adam Murray · 10:26

#browser-security#remote-work#saas#data-protection

Frameworks in this episode

Identity-or-Vulnerability Threat Model

Managed Unfishable Authentication

Shift-Left Security and Anti-Cheat Design

Insights & moments

⚡Myth Buster· 1

Why 99.99% Phishing Awareness Still Is Not Enough

◆Hot Take· 1

Studios Spend Millions on Anti-Cheat but Leave Accounts Exposed

✶Explainer· 2