Phillip Wylie Show

Hosted by Phillip Wylie

TechnologyInterviews guests

Website RSS feed

Episodes

220

Latest episode

Oct 2026

Language

About the show

The Phillip Wylie Show is a premier cybersecurity podcast and media source for offensive security professionals. Hosted by Phillip Wylie, globally recognized ethical hacking expert, keynote speaker, and co-author of The Pentester Blueprint, the show features elite red team operators, penetration testers, and security leaders sharing real-world tradecraft, advanced tactics, career strategy, and insights on AI-driven cyber threats.

Listen to episodes

60 recent

October 27, 2026Episode 4239 min

Purple Teaming, AI, and Small Business Security with Trey Bilbrey

What happens when a red teamer spends years sitting side by side with defenders, watching every EDR and SIEM on the market up close? Trey Bilbrey has spent 18 years in IT and cybersecurity, from helping build the U.S. Marine Corps cyber program to red teaming industrial control systems for the Army Corps of Engineers, building Hack The Box Academy content and leading purple team engagements at Scythe, and he just launched his own consultancy. Trey returns to the show two years after his first appearance as episode 100, and this time he shares why he now often recommends a detection over a fix, the moment leadership finally takes a pen test seriously, and how often organizations should really be running purple team exercises. He also gives a candid look at where AI fits into red teaming and threat emulation, including how far it can actually get from threat intelligence to a usable test plan, why a confident AI-built Sigma rule fooled no one, and his honest timeline for when AI could run a full red team engagement on its own. Whether you’re trying to land your first cyber role, weighing Hack The Box against a degree, or curious about how purple teaming changes security culture, this episode is packed with real-world insight. Stick around to hear why Trey left big enterprise work behind to protect the small businesses in his own backyard, and how his Tampa nonprofit, the Neon Temple, is helping people break into the field. ======================== Connect with Trey Bilbrey: LinkedIn: https://www.linkedin.com/in/georgebilbrey/ X: https://x.com/TCraf7 BSides Tampa Keynote: https://youtu.be/TBkzFBYU5vU?si=EtHqSUnAxIIv10yO Trey's first appearance on the Phillip Wylie Show: https://www.youtube.com/watch?v=3n0BKLaqDvs The Neon Temple (Non-Profit): https://www.theneontemple.com/https://www.youtube.com/@theneontemple/videos Trey's Website: https://www.treycraft.com/ ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie

October 20, 2026Episode 4136 min

From DevOps to Mobile App Hacking with Jarrod Rizor

What happens when someone who knows exactly how applications are built decides to start breaking them? Jarrod Rizor went from writing code and running DevOps to hacking web and mobile apps for a living, and he recently joined TrustedSec as a penetration tester. His path is a real-world playbook for anyone trying to break into offensive security. Jarrod shares what actually gets someone hired as a pen tester, why being stubborn can matter more than being the smartest person in the room, and how putting your work out there can open doors a certification alone never will. He also gives an inside look at how AI is changing ethical hacking, including what happened when he turned Claude Code loose on an iOS app with Frida, and lays out a low-cost way to start learning mobile application security on Android before you ever spend money on iOS gear. Whether you’re working toward the OSCP, grinding through Hack The Box, curious about mobile app pen testing, or wondering where AI fits into offensive security, this episode is full of practical insight from someone who has walked the path. Stick around to find out why the volunteers at his local wildlife rehab center say nobody else can handle Grimble the great horned owl. ========================= Connect with Jarrod Rizor: LinkedIn: https://www.linkedin.com/in/jarrod-rizor-7270a832 X: https://x.com/Jr0dR87 ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie

October 13, 2026Episode 4040 min

Red Teaming, Real Risk, and the Race for Speed with Tim MalcomVetter

Tim MalcomVetter has spent 26 years moving between offense and defense, and his biggest takeaway is that the future of security comes down to speed - whoever has the fastest software wins. Tim got his start by offering to work for free at a hospital in the early days of HIPAA, which turned into his first security job. From there he moved into pen testing, including work on the point-of-sale system behind roughly one in three U.S. credit card transactions, and then into red teaming at Walmart, where engagements could run as long as eight months. Today he is the co-founder of Wirespeed and General Manager of Coalition Security. Recorded in person at Cybr.Sec.Con in Houston, this conversation with Phillip gets into what separates real red teaming from pen testing, what cyber insurance data reveals about which security controls actually work, and why so many in the industry misjudge risk. Tim also shares how his red team experience shaped his approach to automation, and why he sees the next era of attack and defense being decided in milliseconds. ========================= Connect with Tim MalcomVetter: LinkedIn: https://www.linkedin.com/in/malcomvetter WireSpeed: https://wirespeed.co ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie

October 6, 2026Episode 3928 min

From War Driving to Counter-Surveillance with Colonel Panic and Cooper

License plate readers, police drones and fake cell towers are spreading fast, and two hackers are proving that anyone can detect them with about ten dollars of hardware and some open source firmware. Colonel Panic is a malware researcher and hardware builder whose hacking started with AOL dial-up and stacks of 2600 Magazine. After years in restaurants and grocery retail, he went back to school during COVID, earned his certs and turned his love of rapid prototyping into privacy tools like OUI Spy. Cooper got his start on a hand-me-down 286 in fifth grade, spent his early years teaching privacy and security to activists, and has been a public interest technologist at the Electronic Frontier Foundation for almost thirteen years, where he works on Rayhunter. Building on their DEF CON talk, "ESP32 as a Counter-Surveillance Platform," this episode covers: - How OUI Spy uses an ESP32-S3 and a buzzer to alert you when specific Bluetooth or Wi-Fi devices or drones are nearby, and what changed when Flock updated its firmware - Mesh Detect, which sends alerts over Meshtastic networks to build a sensor net for tracking drones - Rayhunter, EFF's open source firmware that turns a cheap Orbic mobile hotspot into a cell-site simulator detector - Why "I have nothing to hide" falls apart, including a Flock misread that put an innocent woman in jail for weeks - The national security risk of ALPR data piling up with vendors who have a track record of vulnerabilities - The current surveillance boom and EFF's work on litigation, activism, Privacy Badger and Certbot - Why war driving is legal, and how to get involved by building tools or showing up at city council meetings DEF CON 34 - ESP32 as counter-surveillance platform: https://www.youtube.com/watch?v=PcK-TDmzshcEFF ========================= Connect with Colonel Panic: Website: https://colonelpanic.tech https://x.com/_colonel_panic https://colonelpanic.tech/ Connect with Cooper: https://bsky.app/profile/cooperq.com EFF: https://www.eff.org ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie

September 29, 2026Episode 3831 min

Drones, RF, and the Hacker Mindset with Luke Canfield

Luke Canfield came up the way a lot of hardware hackers do, the geeky kid in high school everyone came to when the school's computers broke, tinkering with Windows XP and war driving with homemade Yagi antennas built out of Pringles cans. That fascination with the hardware side never left him, and today he runs Reconnaissance Drone Consulting, teaching people about a threat surface most of the security world still isn't looking at. Phillip and Luke met at KernelCon, and this conversation is a wide tour through the corners of security that live outside the usual enterprise conversation. They get into the resurgence of war driving and how a headless Kali Pi has replaced a car full of gear, why AI is reshaping RF and CTF competitions and what that means for people who still want to learn things manually, and Luke's real focus, drones as a multi-domain problem spanning the cyber, operational, and physical. From there it opens up into the stuff that makes you rethink physical security entirely, the six-week drone iteration cycle coming out of Ukraine and how much of it ends up freely available online, why the cartels have run in-house drone design teams for over a decade, prison contraband as the biggest domestic misuse case, and the simple reason nobody looks up - as Luke puts it, humans evolved to avoid being eaten by big cats, not big birds. He also shares his current build, an open source unmanned ground vehicle named Tortuga, made from two donated power wheelchairs, that's headed into Texas cattle pastures to spot parasite outbreaks with thermal imaging. ========================= Connect with Luke Canfield:LinkedIn: https://www.linkedin.com/in/luke-a-canfield/ ========================= Connect with your host, Phillip Wylie:LinkedIn: https://linkedin.com/in/phillipwylieX: https://x.com/PhillipWylieInstagram: https://www.instagram.com/phillipwylie

September 22, 2026Episode 3731 min

From Law Degree to AI Cyber Defense with Zack Korman

Zack Korman came into cybersecurity from about as far outside the field as you can get, a UK law degree and a master's in law and finance, and he now spends his days on the AI defense problems most of the industry is still catching up to. His outsider path is exactly what makes his take on the current AI moment worth hearing. Based in Norway, Zack got into code to win an argument with a professor, worked his way up to running a media company's tech department, then spent four and a half years as CTO of an Oslo cybersecurity startup building AI phishing simulations and AI insider threat detection. That work pulled him deep into the defensive side of security and into a conviction that detection is one of the most underserved areas of the field. Phillip and Zack get into why the "thousand crap alerts" model of detection is broken, the blind spots that let obvious insider threats slip past a SOC that was never even receiving the data, and Zack's work on AI agent security, including the malicious MCP server he built to prove how completely an agent can exfiltrate a company. From there the conversation turns to the thing Zack has become known for online, pushing back on inflated AI risk claims, the fallout from the Hugging Face incident, and why so many of the loudest warnings about AI in cybersecurity are coming from people who have never worked in security. They also cover frontier versus local models, why smaller models could reshape defensive work, model guardrails and offensive testing, and Zack's straightforward advice for anyone trying to fold AI into their day to day. ========================= Connect with Zack Korman: LinkedIn: https://www.linkedin.com/in/zacharyakorman/ X: https://x.com/ZackKorman ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with Suzu Labs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/

September 15, 2026Episode 3642 min

Cloud Security, Shadow IT, and Breaking Into the Field with rekdt

Most advice about breaking into cybersecurity tells you to follow the path. rekdt makes the opposite case: the path is exactly what makes you look like everyone else. In this episode he shares a candid, sometimes contrarian view of the field, shaped by nearly two decades in it. rekdt runs a cloud security tower for a large enterprise operating across multiple clouds, and he came up through the professional cloud world during his time at AWS. He is also a longtime fixture in the hacker community, volunteering with the DEF CON Social Engineering Community and helping out at Red Team Village. His start in tech goes back to a teenage fascination with dial-up, the piracy and IRC scene, and picking apart malicious code on early MySpace pages, before a winding route through bartending and help desk work led him into engineering and eventually security. In this episode, rekdt and Phillip get into why the most interesting security conversations happen at cloud and developer conferences rather than security echo chambers, how cloud and containers upended traditional defenses, and why shadow IT and vibe coding are making things harder. rekdt explains why cybersecurity is really a people problem, what actually makes a candidate stand out when everyone has the same resume, and why he sometimes asks people why they want to get into security at all. He closes with honest, practical advice on building a career with an actual plan instead of just chasing the title. ========================= Connect with rekdt: https://x.com/rekdt ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with Suzu Labs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/

September 8, 2026Episode 3533 min

From Cyber Warfare to AI-Powered Defense with Dave Kennedy

Dave Kennedy was a skeptic. After 28 years in the field, he had heard every claim about the next technology that was going to change cybersecurity, and he assumed AI was more of the same. Then it changed his mind, and now he is building some of the most advanced defensive AI in the industry. Dave is the founder of TrustedSec and Binary Defense. He got his start on the military intelligence side as a U.S. Marine in cyber warfare. He is a well-known name in the cybersecurity community through his work on BackTrack Linux, the Social-Engineer Toolkit, and Metasploit. Dave is also, by his own description, obsessed with cybersecurity as both a career and a hobby - he can't get enough of it. In this episode, Dave breaks down how AI has re-energized his work and, in his words, made this feel like the early 2000s all over again. He walks through Night Beacon, the AI system his team built to transform the security operations center, and explains why they train their own models instead of relying on frontier models, how they keep a human in the loop for every final determination, and why his teams now ship more than a million lines of code a week. Phillip and Dave get into what AI means for offensive work at TrustedSec and Binary Defense, concerns about autonomous hacking and cheaper zero days, and why Dave believes AI will create more work in cybersecurity rather than eliminate it. ========================= Connect with Dave Kennedy: https://www.linkedin.com/in/davidkennedy4 https://x.com/HackingDave https://binarydefense.com https://trustedsec.com ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with Suzu Labs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/

September 1, 2026Episode 3435 min

Vulnerability Research, AI Slop, and Why Fundamentals Still Win with Stephen Sims

AI can now hand someone a working Linux kernel privilege escalation exploit, even if that person cannot explain a single line of how it works. Stephen Sims joined the show to talk about what that shift means for offensive security, and why the fundamentals matter more now, not less.Stephen is the curriculum lead for SANS Institute's Offensive Operations program, where he has spent more than 15 years as an author and instructor, and he is a co-founder of Off by One Security. He is a longtime exploit developer and vulnerability researcher who came up through game hacking, network engineering, and years of binary exploitation, reverse engineering, and weaponizing bugs in browsers and the kernel.In this episode, Stephen and Phillip get into how AI is reshaping vulnerability research and exploit development. Stephen explains why human validation is still doing the heavy lifting behind the big vulnerability-count headlines, how AI tends to overstate or understate severity, and why so many submissions are now AI slop or duplicates. He makes the case that logic bugs remain the hardest thing for AI to find, walks through his roadmap for anyone serious about learning exploit development, and shares why he tells students to do the work manually before letting AI do it for them. Stephen also offers grounded advice for breaking into the field, from building a real technology foundation first to staying curious and paying your dues, and gives his honest read on where the opportunity is heading. ========================= Connect with Stephen Sims: LinkedIn: https://www.linkedin.com/in/stephen-sims-2788091/ X: https://x.com/Steph3nSims Off by One Security: https://offbyonesecurity.com/ YouTube: https://www.youtube.com/@OffByOneSecurity ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with Suzu Labs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/

August 25, 2026Episode 3329 min

Purple Teaming with Sarah Hume: Turning Threat Intelligence Into Actionable Testing

Penetration testing tells you where the vulnerabilities and misconfigurations are. Purple teaming asks a different question: when an attacker is actually operating inside your environment, what can your tools see, and what slips right past them? Sarah Hume has built her career around that second question. Sarah leads the Purple Team program at Security Risk Advisors. Her path into cybersecurity started with a single week at a summer camp at Dakota State University, which her dad talked her into against her wishes and which ended up changing everything. She went on to study cybersecurity at Penn State and began her career in network, physical, and OT/ICS penetration testing before moving into purple teaming as a red operator and eventually leading the practice. In this episode, Sarah breaks down how her team runs purple teams at scale, roughly 200 a year, working through TTPs across the full attack chain alongside a client's blue team. She explains why she favors smart automation over fully automated testing, how her team builds detections that hold up instead of breaking on a single command string or file hash, and why remediation only matters if it is actionable. She also covers living off the land binaries, her grounded take on AI in offensive testing, and real advice for breaking into the field, from home labs and certifications to taking down imposter syndrome and building the communication skills that separate a good tester from a useful one. ========================= Connect with Sarah Hume: LinkedIn: https://www.linkedin.com/in/sarah-hume1 ========================= Connect with your host, Phillip Wylie: LinkedIn: https://linkedin.com/in/phillipwylie X: https://x.com/PhillipWylie Instagram: https://www.instagram.com/phillipwylie ========================= Sponsored by Suzu Labs ========================= All the ways to connect with @Suzulabs https://suzulabs.com https://x.com/suzulabs https://www.linkedin.com/company/suzu-labs/