Field-tested threat intelligence for defenders.
The Defender's Advantage Podcast follows threat activity from the first clue to the defensive lesson. Conversations with Mandiant and Google Threat Intelligence Group practitioners cover ransomware operations, VMware targeting, DPRK IT worker incidents, unusual RDP tradecraft, and the findings behind the M-Trends report.
PRESS PLAY
The Defender's Advantage Podcast is built for listeners who care about how intrusions actually unfold. Its center of gravity is threat intelligence shaped by incident response. Luke McNamara guides conversations with Mandiant and Google Threat Intelligence Group practitioners who have worked through details behind campaigns, reports, and research. The show is careful with the mechanics. It follows how attackers gain access, what they search for, how they escalate, and where defenders lose visibility. Recent episodes spend serious time on ransomware operators targeting VMware and vSphere environments. That focus leads into ESXi, virtual center control, Active Directory-linked VMware accounts, and the damage that can happen when hypervisor infrastructure is treated as ordinary back-office plumbing. The discussions are often sobering. They also stay practical, returning to controls, playbooks, and the limits of overreliance on endpoint detection where EDR cannot be deployed. M-Trends episodes add a broader field-report view, including faster adversary handoffs, prior compromises, and examples of custom malware being prepared before a second actor takes over. The show also examines DPRK IT worker incidents through a combined forensic, legal, and HR lens. Those conversations track laptops, false addresses, LinkedIn artifacts, remote access tooling, and the one-to-many use of personas. Another thread looks at Windows Remote Desktop Protocol abuse, including .rdp files, publisher policies, clipboard mapping, redirected devices, and how a legitimate connection can become a path for credential theft or data exposure. The register is technical but conversational. Jargon appears when it is useful, then gets anchored in the incident pattern. The show rarely treats threats as abstractions. It prefers concrete paths: firewall vulnerability to compromised account, compromised account to VMware group, VMware group to virtual center, virtual center to broad infrastructure risk. That makes it especially valuable for defenders who need to explain risk to teams outside security. It is not a headlines show. It is a working record of what incident responders and researchers are seeing, why it matters, and what defensive assumptions may need to change.
Made for: Security practitioners, incident responders, threat-intelligence analysts, and technical leaders who want grounded detail from investigations. It also suits defenders revising enterprise playbooks around ransomware, remote access, virtualization, and insider-risk scenarios.
What sets it apart: The show pairs threat research with incident-response texture: artifacts, access paths, blind spots, and control implications. It stands out by connecting report-level trends to the operational details defenders face during an investigation.
Learn about the latest threat and cybersecurity trends on The Defender’s Advantage Podcast! Hear from experts in the field as Host Luke McNamara, from Google Threat Intelligence Group, interviews analysts, researchers and other guests on the frontlines of the latest attacks. Episodes dive deep into various topics, including nation-state activity, cybercrime, malware and tradecraft, incident response, defensive guidance, and more. Don't forget to subscribe!
A routine RDP file becomes a clipboard siphon, and suddenly your copied password has an audience.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A clear, practical look at how compromised accounts can turn VMware infrastructure into a platform for wider damage.
VMware environments sit at the center of this focused security review, with initial access through a firewall vulnerability or phishing leading attackers toward accounts connected to Active Directory.
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
Luke McNamara and Chris Linklater examine takeaways from the 2026 M-Trends Report, including voice phishing surpassing email phishing as an initial access vector.
["Luke McNamara hosts Mandiant's Defenders Advantage podcast and talks with Stuart Carrera, a senior consultant in Mandiant Consulting, about how vSphere and ESXi became adversary targets.", "Carrera says he started as a VMware architect about 20 years ago and came back to the platform after roughly a decade away to find it still largely unchanged.", "He says VMware remains common because enterprise data centers run clusters of virtual machines on a stable control plane that just works for many workloads.", "He explains that ESXi and Virtual Center cannot run EDR or antivirus, so attackers can move from firewall footholds and Active Directory-linked accounts to ransomware or data exfiltration.", "He also covers the hardening steps he recommends, including lockdown mode, execInstalledOnly, phishing-resistant MFA, and upgrading from vSphere 7 to vSphere 8."]
A fraudulent W-2 exposed two supposed employees whose laptops converged on Nevada, triggering a DPRK IT-worker investigation.
The Defender's Advantage Podcast examines a 2024 phishing campaign targeting European government and military organizations with signed .RDP attachments.
The Defender's Advantage Podcast examines Google's 2025 threat forecast through ransomware, nation-state operations, and cloud compromise.