Cybersecurity talk after the headline breaks.
Three Buddy Problem treats cybersecurity as a messy, human, geopolitical business rather than a neat stream of alerts. Episodes move from iOS exploit frameworks and ransomware playbooks to exposed executive data, conference-room threat research, and the ethics around modern surveillance.
PRESS PLAY
Three Buddy Problem is a cybersecurity show for listeners who want the version of the story that starts after the headline. It favors argument, context, and practitioner judgment over polished vendor language. The conversations range across nation-state activity, exploit development, ransomware, executive protection, mobile security, threat intelligence, and the culture around security conferences. A discussion about personal executive compromise becomes a broader look at how attackers use personal phones, home networks, exposed identity data, and weak authentication paths to reach corporate targets. A segment on ransomware can move from user psychology and fake troubleshooting prompts to PowerShell payloads, browser responsibility, extortion, and why the same playbook keeps working. The show is especially strong when it looks at offensive tooling. Episodes on an iOS exploit kit and related frameworks spend time on modules, version coverage, Lockdown Mode behavior, exploit economics, and the difference between a single exploit and a maintained platform. It also has a taste for attribution disputes and geopolitical overclaiming. When wiper attacks or Iranian operations enter the news cycle, the conversation is not interested in easy drama; it asks what was hit, who was affected, what the attacker actually achieved, and what journalists or analysts may be overstating. Live episodes bring another texture. At LABScon, the show moves through war crimes research, mercenary activity, intelligence analysis platforms, Synapse, and the private conversations that shape security knowledge before it becomes public. The format can feel mid-conversation because it often is. That looseness is part of the value. The hosts and guests interrupt, fact-check, needle each other, and return to the technical substance. The language can be blunt, but the aim is not shock. It is a refusal to sand down inconvenient realities about attackers, vendors, governments, and defenders. Three Buddy Problem suits people who can follow security acronyms and still want personality, skepticism, and lived operational judgment in the room.
Made for: Built for security researchers, threat intelligence teams, corporate defenders, CISOs, policy-minded listeners, and technically fluent observers of cyber conflict. It assumes comfort with malware, exploits, attribution, and incident response language.
What sets it apart: The show combines deep practitioner detail with live skepticism: exploit economics, attacker tradecraft, media framing, and defensive reality are argued in the same room. It feels less like a briefing and more like listening to security researchers stress-test the story in real time.
The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers.Connect with Ryan on Twitter (Open DMs).
A $35 million exploit valuation gets live-fact-checked before you have finished parsing lockdown mode.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A clear case for treating executives' personal security as part of corporate risk management.
Executives' personal digital lives come into view as part of the enterprise risk picture in this focused PlayNext review of a conversation with Jeremy Bannon, principal at CyberHealth.
A sharp exploit-market discussion built around Lockdown Mode, a $35 million valuation, and the contracts behind both.
Three-Body Problem frames an exploit framework's evasive behavior as a larger question about scale, restraint, and cost. The conversation moves from a tool that backs away when it sees Lockdown Mode or incognito browsing to the awkward incentive created by anyone trying to build…
A focused review of how the Coruna iOS exploit kit was investigated and tied to organized crime.
This single-episode review frames the Coruna iOS exploit kit as more than a bundle of bugs, using Matthias Freelingsdorf's account to show how mobile surveillance infrastructure is built, taken apart, and traced.
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
Ryan's Security Conversations interview with Jeremy Bannon centers on CyberHealth, which sells personal cybersecurity and online privacy to corporate customers who want executives protected outside the corporate perimeter.
["Three Body Problem episode 89 opens with Juanito in San Francisco for Nebula Fog, an AI hackathon organized by Rob Reagan at Bishop Fox.", "Kostin and Juanito use the hackathon to talk about AI hiring, Sentinel Labs publications, and the idea that small two-to-five person teams can build an AI product and get acqui-hired.", "The news segment centers on Handala's claimed attack on Stryker, where the group said it compromised more than 200,000 servers and used Microsoft Intune-style control to wipe employee devices.", "The hosts end up on canary tokens, MFA, just-in-time admin access, and CISA-style advisories, arguing that fleet-wipe features need more friction and security review."]
Google Threat Intelligence's Corona iOS exploit-kit report drives this Three-Body Problem episode, and the hosts keep returning to Peter Williams and Trenchant as the likely provenance question.
["Three Buddy Problem centers on Matthias Freelingsdorf and the Coruna iOS exploit kit, with Ryan pressing him on what iVerify can actually see on Apple devices.", "Matthias says iOS blocks file reads, directory listings, process lists, and app lists, so iVerify leans on indirect signals like temp-directory access, syscalls, and known implant behavior from Pegasus, Predator, and Noclip.", "He says Coruna was described as 23 exploits in five full chains against iOS 13 through 17.2.1, and iVerify tracked it after a suspicious URL tip and a proxy-based infection test.", "The discussion then turns to MetaMask, Binance, Phantom, WhatsApp, Apple Notes, Apple Photos, Lockdown Mode, and a possible L3 Trenchant link tied to Peter Williams and the Plasma naming."]
Three Buddy Problem talks with Huntress principal threat intelligence analyst Greg Linares about why ransomware crews now run like businesses, with KPIs, bottom lines, and role specialization.
Amazon Threat Intelligence reported Earth Lamia and Jackpot Panda probing React2Shell within hours of the December 3 disclosure, and the flaw carries CVSS 10.0.
Shai-Hulud 2.0 is described as a credential-harvesting npm supply-chain operation affecting an estimated 500–800 packages, with no public attribution.
Google’s Big Sleep and FFmpeg’s volunteer maintainers clash over AI-found bugs reported without accompanying patches.
JAGS opens his LABScon 2025 keynote by revising his previous year's claim that cybersecurity had failed, saying instead that one phase is ending and the field sits between "consolidation and standardization." He uses cybernetics, which he links to the Macy conference and to the Greek root of Kubernetes meaning steersmanship, to argue that complexity caused the failures and standardization is the fix.
Chris Eng, Veracode's chief research officer until about a year before this conversation, traces his path from an NSA scholarship program to @stake in Boston and employee number 15 at Veracode.
Ryan, Kostin and Juanito use episode 65 of Three Buddy Problem to unpack Google Threat Intelligence Group and Mandiant's Brickstorm report, in which China-nexus actors tunnel from virtual machines through hypervisors and stay undetected for 393 days on average.
Visi Stark discusses the Vertex Project and Synapse, an intelligence analysis platform for interdisciplinary analysis, at LABScon.
Live at LabsCon, the hosts introduce guest Lindsay Freeman to discuss tracking Wagner Group war crimes ahead of her keynote.
Aurora Johnson and Trevor Hilligoss discuss SpyCloud's data collection and analysis of breach, phishing, and malware data, including their work with Steeler logs.
Mikko Hypponen discusses drone warfare, APT naming schemes, and Finland's NATO membership amid the Russia-Ukraine war.