Cybersecurity Mentors Podcast · Cybersecurity Mentors

Turning Sheep Into Wolves: Brian Brushwood’s Plan to Defend Against the Scampocalypse

·51 min·3 clips

Brian says cybersecurity training should be "sheep turned wolves" with deceptive role play, not fence-building.

1. Cybersecurity Mentors Podcast centers on Brian Brushwood and his argument for turning social engineering into a defensive training method. 2. Brian Brushwood is the guest, and the hosts identify him as a magician, podcaster, and YouTuber who built Scam School and now hosts World's Greatest Con. 3. The episode asks whether security teams should train people with deceptive role play instead of only videos and quizzes. 4. Brian says he has worked on "human-on-human scamming" for 25 years, and he compares it to "player versus player" gaming rather than bot practice. 5. He describes DEF CON as a place where security people told him their first trick from Scam School and their stories about human deception. 6. He also describes Magic Live in Vegas, where magicians say "you fooled me" and immediately share methods without stigma. 7. Brian cites a Deloitte analysis that he says reported $16 billion in AI-powered scam and deepfake losses this year. 8. He adds that Deloitte expects losses could reach $40 billion by 2027, while reported losses still miss the full picture. 9. He argues that many CISOs still treat scams as a technology problem and focus on the tech stack. 10. He says the missing piece is the "wetware" side, meaning human judgment and reaction under pressure. 11. Brian uses Daniel Kahneman's "system two" language to criticize training that is top-down, forced, and easy to forget. 12. He contrasts that with system one, which he links to Gavin DeBecker's The Gift of Fear and the idea of listening to gut reactions. 13. His main analogy is a pen of sheep behind a fence, where defenders keep making the fence taller instead of teaching the sheep to fight back. 14. He proposes regular 15-minute exercises where employees take turns trying to trick coworkers with business-like messages that hide a gotcha. 15. He says the goals should evolve toward realistic drills like spotting deepfake video meetings and noticing when the CEO may not be the CEO. 16. He tells a story from age 18 at a movie theater, where he recognized a short-change scam because it felt like a magic trick. 17. The conversation stays energetic and conversational, with Brian speaking in long, rapid explanations and the hosts asking follow-up questions about awareness training. 18. The format mixes interview questions with extended monologues, examples, and practical security advice. 19. Listeners interested in social engineering, security awareness, and magic-based teaching will get the most from it. 20. Listeners wanting a short tech-news recap without behavioral training ideas may skip it.

As heard by us

The episode argues that people get better at spotting scams by learning to think like the attacker.

PlayNext keeps the focus on human-on-human scamming, and the guest's best point is simple: people learn faster when they try to think like the attacker.

Read the full review in PlayNext →

Why you'd press play

Learn to think like the scammer before your team gets burned.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cybersecurity Mentors Podcast