Hacker Valley Studio·Oct 26, 2026·45m·Episode #448

Your Cloud Backup Won’t Save You with Jake Bernardes

Download audio Show notes Apple Podcasts

Show notes

Jake shares the social engineering tricks that got him past security guards. He also explains why voice phishing now takes almost no effort. Then he walks through Gambit’s research on an AI-run attack that cost about $25 per target and needed fewer than ten non-technical prompts. Along the way, he takes on phishing simulations, AI guardrails and cyber insurance.

Then comes recovery, the part of security Jake says is still broken. His take: tabletop exercises are “Dungeons & Dragons for executives.” Instead, figure out your minimum viable business, the systems you can’t live without, and prove you can bring them back. Ron closes by tying it to the grocery chain outage that hit his family’s workplace.

Impactful Moments

00:00 - Introduction
03:20 - Busting the myth: the cloud has your back
05:45 - Seven minutes of agentic ransomware
10:35 - Breaking into a CEO’s office for a CISO job
12:15 - Paying strangers to get past security guards
15:25 - People don’t hack in, they log in
18:55 - The ASOS incident and the short-stock theory
20:00 - Too much exposed to the public internet
23:05 - Anatomy of a $25 AI attack
27:10 - Translating the attacker’s Chinese prompt
29:40 - Can CISOs rely on AI guardrails?
32:25 - Why cyber insurance is a tick box
35:30 - Minimum viable business for 2027
38:25 - Ron digs into the Giant Food outage

Links

Connect with Jake Bernardes on LinkedIn: https://www.linkedin.com/in/jakeleobernardes/

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/

← Previous

Voice Phishing Is the New Front Door

If someone wiped your cloud environment tomorrow, how long until you’re back in business? Not what the plan says. What would actually happen? Ron sits down with Jake Bernardes, CISO at Gambit Security, who got his first CISO job by sneaking into a company’s office and sitting in the CEO’s chair. He has since run security for tech companies and early-stage security vendors, and he hosts the Random Access Memories podcast. Jake shares the social engineering tricks that got him past security guards. He also explains why voice phishing now takes almost no effort. Then he walks through Gambit’s research on an AI-run attack that cost about $25 per target and needed fewer than ten non-technical prompts. Along the way, he takes on phishing simulations, AI guardrails and cyber insurance. Then comes recovery, the part of security Jake says is still broken. His take: tabletop exercises are “Dungeons & Dragons for executives.” Instead, figure out your minimum viable business, the systems you can’t live without, and prove you can bring them back. Ron closes by tying it to the grocery chain outage that hit his family’s workplace. Impactful Moments 00:00 - Introduction 03:20 - Busting the myth: the cloud has your back 05:45 - Seven minutes of agentic ransomware 10:35 - Breaking into a CEO’s office for a CISO job 12:15 - Paying strangers to get past security guards 15:25 - People don’t hack in, they log in 18:55 - The ASOS incident and the short-stock theory 20:00 - Too much exposed to the public internet 23:05 - Anatomy of a $25 AI attack 27:10 - Translating the attacker’s Chinese prompt 29:40 - Can CISOs rely on AI guardrails? 32:25 - Why cyber insurance is a tick box 35:30 - Minimum viable business for 2027 38:25 - Ron digs into the Giant Food outage Links Connect with Jake Bernardes on LinkedIn: https://www.linkedin.com/in/jakeleobernardes/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/