20 - Red Teamers and Pen Testers: Technical, Cloud and Soft Skills

There's no shortage of cybersecurity tools, but most compromises don't happen because of technology failures, they happen because of a failure in organizational processes. In today's episode, we explore how penetration testing and red teaming expose the people, processes and operational weaknesses that technology alone cannot.

We discuss why security is ultimately a people problem, why organizations struggle to identify their own blind spots and how offensive testing reveals hidden vulnerabilities that technologies alone miss.

In today's broad ranging episode, we cover the following:

• Penetration testing vs. red team engagements
• What a real red team assessment looks like
• Attack vectors that still work surprisingly well
• Interesting "ins" from the real-world
• The ongoing role of social engineering
• Custom tooling vs. off-the-shelf frameworks
• Staying current with attacker techniques
• Finding business-logic flaws automated tools miss
• The hardest parts of offensive security work
• Common organizational mistakes that create risk
• Making findings actionable for engineering teams
• Skills the next generation of operators should build
• Soft skills that matter in offensive security
• How AI and cloud are changing modern red teaming
• Underestimated attack surfaces
• Whether offense will always outpace defense