Soap Box: Using threat hunting to drive detection
In this wholly sponsored Soap Box edition of the podcast Patrick Gray chats with Damien Lewke, the CEO and founder of Nebulock, about the future of threat hunting and detection.
Damien spent a decade in the EDR and MDR space before founding Nebulock in 2024. It started off as an AI-powered threat hunt platform but has evolved into a broader security data platform that can answer questions, drive hunts and drive detections.
This product is engineered around the idea that a lot of security is a data problem. So, if we accept this premise, how do we solve security? And how much of that solution is about agents, vs building a good graph? And if you’re going to build a good graph, do you want to build it for a person to use, or an agent to use?
This is truly a conversation for the security nerd’s nerd. Enjoy!
This episode is also available on YouTube
Show notes
Risky Business #817 -- Less carnage than your usual Thanksgiving
In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. It’s a quiet week with Thanksgiving in the US, but there’s always some cyber to talk about:
Airbus rolls out software updates after a cosmic ray bitflips an A320 into a dive
Krebs tracks down a Scattered Lapsus$ Hunters teen through the usual poor opsec…
… as Wired publishes an opsec guide for teens.
Microsoft decides its login portal is worth a Content Security Policy
South Korean online retailer data breach covers 65% of the country
This week’s episode is sponsored by Nebulock. Founder and CEO Damien Lewke joins to talk through their work bringing more SIgma threat detection rules to MacOS.
This episode is also available on Youtube.
Show notes
Airlines race to fix their Airbus planes after warning solar radiation could cause pilots to lose control | CNN
Congress calls on Anthropic CEO to testify on Chinese Claude espionage campaign | CyberScoop
Post-mortem of Shai-Hulud attack on November 24th, 2025 - PostHog
Update: Shai-Hulud and the npm Ecosystem: Why CTEM Must Extend Beyond Your Walls | Armis
Glassworm's resurgence | Secure Annex
4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign | Koi Blog
Post by @spuxx.bsky.social — Bluesky
Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ – Krebs on Security
The WIRED Guide to Digital Opsec for Teens | WIRED
Perth hacker Michael Clapsis jailed after setting up fake Qantas Wi-Fi, stealing sex videos - ABC News
Ed Conway on X: "The person who first downloaded the OBR's document at 11:35 on Budget day (I'm guessing someone at Reuters, given they first reported it) had already guessed the web address and tried and failed to download it 32 times so far that day(!) https://t.co/6iLm2uEUj2" / X
Reuters accused of hack attack | ZDNET
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Microsoft tightens cloud login process to prevent common attack | Cybersecurity Dive
Fortinet FortiWeb flaws found in unsupported versions of web application firewall | Cybersecurity Dive
Cryptomixer platform raided by European police; $29 million in bitcoin seized | The Record from Recorded Future News
Officials accuse North Korea’s Lazarus of $30 million theft from crypto exchange | The Record from Recorded Future News
Data breach hits 'South Korea's Amazon,' potentially affecting 65% of country’s population | The Record from Recorded Future News
NSA Contractor Groomed Teenage Girls On Reddit, DOJ Alleges
Nebulock developed coreSigma for MacOS
coreSigma repo:
Snake Oilers: Nebulock, Vali Cyber and Cape
In this edition of the Snake Oilers podcasts, three vendors pop in to pitch you all on their wares:
Automated, AI-powered threat hunting with Nebulock
Damien Lewke from Nebulock joins the show to talk about how its agentic AI platform can surface attacker activity out of all those “low” and “informational” findings your detection team doesn’t have time to look at.
Runtime security for hypervisors from Vali Cyber
Austin Gadient from Vali Cyber stops by to talk about ZeroLock, its hypervisor security product. It’s marketed as a counter-ransomware control but is just a generally useful security platform for virtualised environments.
A secure mobile telco: Cape
The only thing American cell providers love more than providing patchy coverage is getting their customers’ data owned. Cape is here to change that. It’s a security and anonymity-focussed virtual mobile network operator (MVNO) that’s been spun up by a highly competent team. If we lived in the USA we would be customers, and a bunch of CISOs listening to this might want to consider Cape subscriptions for their workforce.
This episode is also available on Youtube
Show notes