Episodes

  • Ep52: How to Get Into Cybersecurity With No Experience

    Ep52: How to Get Into Cybersecurity With No Experience
    Nov 9 2026

    No degree, no IT background, and every entry-level posting wants three years of experience. Marc lays out the realistic path into cybersecurity: why the market feels jammed even with a talent shortage, what to learn first, which single certification to get (including the end of ISC2's free Certified in Cybersecurity offer), how to build experience with a home lab and public write-ups, the on-ramp jobs that hire beginners, and a 90-day plan you can start this week.

    Chapters

    • 0:00 Cold open: booming field, locked door
    • 0:16 Why right now is a strange time to break in
    • 1:13 Where to start
    • 2:24 Your first certification
    • 4:04 Getting experience when every job wants experience
    • 5:22 The jobs to target first
    • 6:21 Your first ninety days
    • 7:41 Outro and homework

    Sources

    • Full article: How to Get Into Cybersecurity With No Experience
    • BLS Occupational Outlook Handbook: Information Security Analysts
    • ISC2 Certified in Cybersecurity (CC)
    • ISC2 One Million Certified in Cybersecurity program update
    • CompTIA Security+
    • Google Cybersecurity Certificate
    • CISA free cybersecurity training
    • Related: The full cybersecurity career guide, Is the Google Cybersecurity Certificate worth it?, Build cyber proof, not just certs, and Portfolios trump pedigree

    Certification prices as of November 3, 2026. Check the vendor before you buy.
    Show More Show Less
    9 mins
  • Ep51: Polymarket Had a CSP. Here's Why It Didn't Help

    Ep51: Polymarket Had a CSP. Here's Why It Didn't Help
    Oct 30 2026
    Episode Summary:On October 29, 2026, a performance-monitoring script Polymarket loaded from an outside vendor was swapped for code that used logged-in traders' open sessions to sell positions and move funds out. Researchers traced the file to DebugBear, which confirmed a security incident, but Polymarket hasn't named DebugBear and the root cause is unconfirmed. Marc uses the attack to explain one thing: any outside script on your site runs with your users' full access, and a Content Security Policy is the browser rule built to limit that. He covers what a Content Security Policy is, why Polymarket's own policy still let this attack through, and why so few sites use one at all, or use it well.Key Topics Covered:How a page-speed script on Polymarket was swapped and used open sessions to move fundsWhy a third party script runs with the same access as your own codeWhy two-factor authentication doesn't stop code running inside an open sessionWhat a Content Security Policy is, and what it can and can't blockWhy Polymarket's policy allowed every server the malicious script usedHow few sites deploy a Content Security Policy, and how many policies have gapsMain Takeaways:Every outside script on your page runs with your users' full access.A Content Security Policy blocks code and connections to servers not on your list. It trusts every server that is on the list, so keep the list short.Per the HTTP Archive Web Almanac 2025, Content Security Policy adoption reached 21.9%, and about 92% of policies that set script rules include unsafe-inline, which weakens them.Start in report-only mode, list what your site loads today, cut what nobody uses, and keep outside scripts off login, donation, and checkout pages.Timestamps:[0:00] Cold open[0:32] Intro[0:55] What happened at Polymarket[1:56] Why an outside script gets full access[2:49] What a Content Security Policy is[3:28] Would it have stopped this one?[4:19] Few sites use it, fewer use it well[5:12] Your homework[5:59] OutroLoss Estimates by Source (each measured something different):Hudson Rock: about $2.19 million at the script's recipient wallet, from a screenshot, "not a verified total of stolen funds."BleepingComputer: about 28.6 million POL, "valued at roughly $2.57 million," moved to three other wallets.The Record: blockchain firms traced "more than $2.1 million."Polymarket postmortem: returning $3.9M to traders, "the $2.7M plus $1.2M to cover pause-related losses."Tools & Resources Mentioned:Paired guide on the blog: Third Party Scripts: Lessons From the Polymarket Hack (2026)Polymarket status page and postmortemDebugBear on X, incident notice (Oct 29)DebugBear on X, follow-up (Oct 29)Hudson Rock, Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptOhey, Polymarket wallet drainer served from DebugBear's script CDNBleepingComputer, Polymarket halts trading after crypto-draining script breach, $2.5M tracedThe Record, Polymarket confirms cyberattack on third-party provider after outagesMDN, Subresource IntegrityMDN, Content Security Policy guideMDN, Content-Security-Policy-Report-Only headerW3C, Content Security Policy Level 3HTTP Archive Web Almanac 2025, Security chapter (Content Security Policy adoption and script-src keywords)Weichselbaum, Spagnuolo, Lekies, Janc (Google), CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy, ACM CCS 2016W3C, Subresource IntegrityThis episode's audio was produced with an AI voice clone of Marc, from a script Marc reviewed and approved.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Listen and subscribe: https://bytesizedsecurity.show/listen--Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively--Questions or tips: email marc@bytesizedsecurity.show (subject: Byte-Sized Security). TikTok: @bytesizedsecurity
    Show More Show Less
    7 mins
  • Ep50: Arrested in a State She'd Never Visited: The Cash App Account in Her Name

    Ep50: Arrested in a State She'd Never Visited: The Cash App Account in Her Name
    Oct 23 2026
    Episode Summary:In this short episode, Marc covers 404 Media's reporting on Amanda Smith, a Pennsylvania woman arrested on an Arkansas warrant after someone opened a Cash App account with her Social Security number and date of birth and used it to collect $1,000 from a Facebook Marketplace scam. He walks through how investigators tied the account to her, the account details that don't match her, and why Cash App wouldn't share account information with her. The case is ongoing and Smith is presumed innocent. Marc closes with one record you can start keeping this week.Key Topics Covered:The arrest: a warrant from Arkansas, a computer fraud charge, and three nights in jailHow police got to her: a hacked Facebook account, a fake Marketplace sale, and a search warrant to Block, which owns Cash AppThe data that didn't match: a Philadelphia address, an iPhone running a 2022 operating system, and a Verizon connection when she's on AT&TWhere the case stands: Cash App wouldn't share account details with her, she turned down a plea offer, and a hearing is set for NovemberMain Takeaways:Identity theft isn't only a money problem. Stolen identity data can attach your name to someone else's crime.In this case, a Social Security number and date of birth were enough to put Smith's name on a payment app account.The details that didn't line up were the address, the device, and the phone carrier.Write down which accounts are actually yours: your banks and payment apps, your phone number, your carrier, and your devices.Timestamps:[0:00] The hook[0:17] The arrest[0:35] How police got to her[1:06] The data that didn't match[1:27] Where the case stands[1:50] What you can do this weekTools & Resources Mentioned:404 Media, Joseph Cox, "Someone Opened a CashApp In Her Name. She Faces Years in Prison" (Oct 21, 2026): https://www.404media.co/amanda-smith-opened-a-cashapp-in-her-name-she-faces-years-in-prison-cashapp-fraud/FTC IdentityTheft.gov, report identity theft and get a recovery plan: https://www.identitytheft.gov/FTC, Credit Freezes and Fraud Alerts: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alertsFTC, What To Know About Identity Theft: https://consumer.ftc.gov/articles/what-know-about-identity-theftEquifax credit freeze: https://www.equifax.com/personal/credit-report-services/credit-freeze/Experian credit freeze: https://www.experian.com/freeze/center.htmlTransUnion credit freeze: https://www.transunion.com/credit-freezeSocial Security Administration, Fraud Prevention and Reporting: https://www.ssa.gov/fraud/Free credit reports: https://www.annualcreditreport.com/This episode's audio was produced with an AI voice clone of Marc, from a script Marc reviewed and approved.Not legal advice. If you're facing criminal charges, talk to a licensed attorney.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Listen and subscribe: https://bytesizedsecurity.show/listen--Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively--Questions or tips: email marc@bytesizedsecurity.show (subject: Byte-Sized Security). TikTok: @bytesizedsecurity
    Show More Show Less
    3 mins
  • Ep49: ChatGPT Ads: Your Prompts, Your Email, and the Switch That Doesn't Stop Ads

    Ep49: ChatGPT Ads: Your Prompts, Your Email, and the Switch That Doesn't Stop Ads
    Oct 15 2026
    Episode Summary:ChatGPT now shows ads on its Free and Go plans. In this episode Marc walks through what 404 Media found when it ran its own test ads: advertisers can upload lists of emails, phone numbers, or Android advertising IDs, and your current chat shapes which ad appears. Turning off ads personalization changes how ads are picked, but it does not stop them. Marc covers what each setting does and five steps you can take today.Key Topics Covered:404 Media's test ads: how Joseph Cox used OpenAI context hints to steer ads toward privacy and AI chatsCustom audiences: email, phone, hashed identifiers, and Google Advertising IDs, plus include, exclude, and bid-adjustment bucketsThe two switches: Personalize ads vs Ads-Free mode, and why one does not equal the otherWhat OpenAI commits to: advertisers do not get your chats; Temporary Chats show no ads; health and politics limitsFive actions: check your plan, Data Controls, delete ads data, Temporary Chat, and shrink the lists you are onMain Takeaways:Free and Go show ads. Plus, Pro, Business, Enterprise, and Edu do not.Context hints are guidance, not keyword triggers, but your prompt still decides whether an ad fits.Advertisers can match uploaded emails, phone numbers, or Android advertising IDs to ChatGPT users (inclusion and bid bumps need at least 25,000 matched users).Turning off ads personalization still leaves context-based ads on. Ads-Free (Free plan only) or a paid plan is what removes ads.Your personalization setting does not take you off an advertiser's uploaded list.For sensitive topics, use Temporary Chat. It shows no ads and does not use or update memory.Timestamps:[0:00] Cold open[0:50] Intro[1:13] What 404 Media did[2:22] Your email and phone number[4:17] The switch which doesn't stop ads[5:42] What OpenAI promises[6:27] Five things to do today[7:42] OutroTools & Resources Mentioned:404 Media (Joseph Cox, Oct 15, 2026): How ChatGPT Targets Ads To You Based On Your Prompts, Phone Number, and EmailOpenAI Help: Ads in ChatGPTOpenAI Help: Set up Custom Audiences for your CampaignOpenAI Help: Write Context Hints for ChatGPT AdsOpenAI: Our approach to advertising and expanding access to ChatGPTGoogle: Advertising IDByteSizedSecurity blog: ChatGPT ads targeting (prompts, email, phone)Not legal advice. Settings and plan details reflect OpenAI's help pages as of October 15, 2026 and change over time.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Listen and subscribe: https://bytesizedsecurity.show/listen--Support ByteSizedSecurity (501(c)(3)): Donate via GiveLively--Questions or tips: email marc@bytesizedsecurity.show (subject: Byte-Sized Security). TikTok: @bytesizedsecurity
    Show More Show Less
    10 mins
  • Ep48: A Short Poem About MFA

    Ep48: A Short Poem About MFA
    Oct 12 2026

    A 20-second poem about multi-factor authentication (MFA), the second step that proves it's really you when you log in.

    Main Takeaway
    • A password alone can be copied, lost, or sold. Add a second factor, ideally a hardware security key or passkey, which a fake login page can't capture.

    Timestamps
    • 0:00 The poem

    Tools & Resources Mentioned
    • CISA: More than a Password
    Show More Show Less
    2 mins
  • Ep47: Why AI Risks Are Different

    Ep47: Why AI Risks Are Different
    Sep 19 2026
    Episode Summary:Someone told Marc that AI panic is nothing new — just the printing press or nuclear weapons all over again. He disagreed, and it turns out there was a report to back it up. In this episode he breaks down why AI collapses the cost of dangerous capability in a way the printing press, the internet, and even nuclear weapons never did, what Anthropic's brand-new September 2026 threat intelligence report documents, where his own "$200 expert" framing overstated the case, and the four guardrails that would close the gap.Key Topics Covered:The argument that started this episode — a debate about whether AI panic is history repeating, and the report Marc found three days later making his case for himWhy the printing press comparison breaks down — institutions had a century (and decades, for the internet) to catch up; AI's capability curve moves in monthsWhat's actually different about nuclear weapons — nuclear risk lives behind physical choke points: materials, facilities, expertise. AI risk lives in a skill, and skills can't be fenced offAnthropic's report: the receipts — three disrupted operations, walked through case by case, that turn the argument from speculative to documentedDoes AI make anyone an expert? Not exactly — Marc's own "$200 subscription = expert" line, and the more defensible version of the claimAttackers, defenders, and who adapts faster — the same models cutting attacker costs are cutting defender costs too, and why that race mattersWhat real AI guardrails would look like — four concrete guardrails: pre/post-release capability testing, enforceable standards, international coordination, and risk-scaled accessMain Takeaways:AI doesn't need generations to reach scale like the printing press or the internet did — model capability jumps happen every few months, not every few decadesNuclear risk is contained by physical choke points (fissile material, facilities, expertise); AI risk lives in a skill, and skills don't have a border to fenceAnthropic's September 2026 report documents real, disrupted operations — including a breach that went from one stolen developer token to full cloud admin control in roughly three hours"$200 subscription = expert" overstates it: AI doesn't manufacture expertise, it lowers the skill required to attempt tasks whose consequences the operator isn't trained to handleDefenders get the same acceleration attackers do — the organizations lagging on AI-assisted defense are the ones absorbing the most riskClosing the gap takes four things: pre/post-release capability testing, enforceable (not voluntary) standards, international coordination, and access that scales with risk instead of priceTimestamps:[0:00] The argument behind this episode[1:03] Why the printing press comparison breaks down[1:53] What's different about nuclear weapons[2:55] Anthropic's report: the receipts[4:46] Does AI make anyone an expert? Not exactly[5:45] Attackers, defenders, and who adapts faster[6:16] What real AI guardrails would look likeTools & Resources Mentioned:Anthropic: Detecting and Countering Misuse of AI (September 2026)NIST AI Risk Management FrameworkEU AI Act (European Commission)Full written guide: Why AI Risks Are DifferentAI is fueling the cybersecurity career boomWhy an AI agent shouldn't inherit your permissionsNot legal advice. Figures reflect Anthropic's report as published on September 10, 2026.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Find subscriber links on my site, add to your podcast player, or listen on the web players on my site:Listen to Byte Sized Security --Support this Podcast with a Tip:Support Byte Sized Security --If you have questions for the show, feedback or topics you want covered. Please send a short email to marc@bytesizedsecurity.show with the Subject line of "Byte-Sized Security" so I know it's about the podcast.Connect with me on TikTok: https://www.tiktok.com/@bytesizedsecurity
    Show More Show Less
    9 mins
  • Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited

    Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited
    Sep 10 2026

    Roughly 98.5% of all known CVEs have never been exploited. In this episode I break down a conversation between Jeremiah Grossman and Robert Hansen of Root Evidence, and host Raphael Mudge, on the Down the Rabbit Hole podcast, and what it means for how you prioritize a patch queue. I cover CVSS score versus exploitation evidence, how to use CISA's free KEV catalog, why the vulnerability management industry has no incentive to tell you the truth, and what separates a junior-sounding answer from a senior one in a security interview.

    In this episode:

    • (00:00) The scan report that isn't as urgent as it looks
    • (01:03) The 98.5% number and the mechanic analogy
    • (02:01) Why the industry defaulted to patch everything
    • (03:00) The 36-hour outage from a perfect-10 patch
    • (03:48) CVSS score vs. exploitation evidence vs. insurance-claims data
    • (05:08) What it sounds like when someone understands this in an interview
    • (06:15) Why the industry has no brakes, and the AI-hype myth
    • (07:49) Your homework

    Links:

    • Down the Rabbit Hole, episode 722, "Vulnerability Math Ain't Mathing"
    • CISA's Known Exploited Vulnerabilities (KEV) catalog
    • FIRST.org, the CVSS specification
    • Full written breakdown
    • Our cybersecurity career guide
    • Breaking into cybersecurity with no experience
    • Third-party risk and the AI bug-report flood

    Not financial or legal advice. Figures cited reflect Root Evidence's analysis as discussed on the source podcast episode.

    I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.

    --

    Find subscriber links on my site, add to your podcast player, or listen on the web players on my site:

    Listen to Byte Sized Security

    --

    Support this Podcast with a Tip:

    Support Byte Sized Security

    --

    If you have questions for the show, feedback or topics you want covered. Please send a short email to marc@bytesizedsecurity.show with the Subject line of "Byte-Sized Security" so I know it's about the podcast.

    Connect with me on TikTok: https://www.tiktok.com/@bytesizedsecurity
    Show More Show Less
    10 mins
  • Ep45: Fired for Failing a Phishing Test? What Binance Actually Does

    Ep45: Fired for Failing a Phishing Test? What Binance Actually Does
    Jul 28 2026
    Episode Summary:Binance fires employees who repeatedly fail its monthly phishing tests — while the entire security-awareness industry insists you should never punish someone for clicking. In this episode Marc breaks down what Binance actually does, whether you can really get fired for failing a phishing test, how corporate phishing simulations work, and what a program looks like that takes security seriously without torching its own culture. The honest answer isn't at either extreme.Key Topics Covered:What Binance's red team is doing — monthly tests, recruiter and fake-conference lures, and mandatory remedial training for anyone who failsCan you really get fired? — the "three strikes" model and the 2019 Krebs on Security debate over whether a failed phish test should be a fireable offenseHow corporate phishing tests work — the baseline click rate, the "gotcha" landing page, and the Hoxhunt failure-rate ladder (no program 20–35% down to highly mature 2–5%)"Weakest link"? — the industry split between Hook Security's "never punish a click" and the accountability camp, and where Marc landsAccountability without a blame culture — four principles for getting Binance's seriousness without the fearThe boring middle thing that actually works — train relentlessly, test fairly, measure reporting, and save real consequences for real patternsMain Takeaways:You usually can't get fired for a single click — real programs reserve consequences for repeated failures in high-risk roles, not one slip-up someone ownedPunishing clicks backfires: people who fear consequences hide mistakes, and a hidden compromise turns a five-minute cleanup into a five-month incidentThe metric that predicts resilience is report rate, not click rate — reward the people who spot the phish and hit "report," loudlyHumans aren't the weakest link; untrained, unsupported humans are — most failure is the program, not the personFair escalation targets the overlap of three things: repeated failure, high-risk access, and refusing to train or reportTimestamps:[0:00] The gotcha that shows up on your performance review[1:03] What Binance's red team is actually doing[2:23] Can you really get fired? Three strikes and the Krebs debate[3:34] How corporate phishing tests work, and the Hoxhunt failure-rate ladder[5:03] "Weakest link"? The industry split, and where we land[6:55] Accountability without a blame culture: four principles[8:19] The boring middle thing that actually worksTools & Resources Mentioned:Binance runs monthly phishing tests (crypto.news)Repeated failures may lead to dismissal (WEEX)Addressing the repeat phishing offender (IT Brew)"Should Failing Phish Tests Be a Fireable Offense?" (Krebs on Security, 2019)What to do (and not do) when employees click (Hook Security)What's a good phishing failure rate? (Hoxhunt benchmarks)KnowBe4 phishing security testProofpoint phishing simulationMicrosoft Defender attack simulation trainingFull written article: Fired for failing a phishing test?Why modern phishing beats smart peopleWhy employee security awareness training mattersGeneral education, not legal or HR advice. Reporting reflects coverage as of July 2026.---I do hope you enjoyed this episode of the podcast. Here are some helpful resources including any sites that were mentioned in this episode.--Find subscriber links on my site, add to your podcast player, or listen on the web players on my site:Listen to Byte Sized Security --Support this Podcast with a Tip:Support Byte Sized Security --If you have questions for the show, feedback or topics you want covered. Please send a short email to marc@bytesizedsecurity.show with the Subject line of "Byte-Sized Security" so I know it's about the podcast.Connect with me on TikTok: https://www.tiktok.com/@bytesizedsecurity
    Show More Show Less
    11 mins