Stories from an Expert Threat Hunter | 31

If an attacker has already been inside your network for months, would you know? In this episode, Ciaran and James are joined by Taz Wake, Digital Forensics & Incident Response expert, to talk about the realities of defending organisations today. Drawing on his background in military intelligence and years on the front line, Taz shares insights on incident response, threat hunting, and the common myths the industry still gets wrong. 

Highlights:

Taz Wake training and writing:

Examples courses and posts referenced in the episode.

• FOR577: LINUX Incident Response and Threat Hunting | SANS Institute
• FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics | SANS Institute
• Cybersecurity certifications - are they valuable?
• Linux intrusions – a growing problem | SANS

Industry signals and how attacks are changing

How attacker behaviour and detection timelines have shifted, and what this means in practice.

• M-Trends 2026 Executive Edition
• CrowdStrike 2026 Global Threat Report | Latest Cybersecurity Trends & Insights
• Verizon 2025 Data Breach Investigations Report
• IBM 2015 Cyber Security Intelligence Index
• Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft | ShinyHunters (Threat Actor)

Cyber turning points and real-world impact

Moments that shaped how organisations think about cyber risk.

• Stuxnet explained: The first known cyberweapon | CSO Online | Stuxnet: The Paradigm-Shifting Cyberattack, Implications and way forward - Modern Diplomacy
• The 21st-century evolution of cyber security | ICAEW | Telcos: The Supply Chain Attack You're Not Ready For UK Telecoms Supply Chain Review Report

Additional Resources:

Naming Names: How Adversary Taxonomies Strengthen Global Security

Subscribe & Follow:

• Subscribe to the podcast on Apple Podcasts, Spotify, or your favorite podcast platform.
• Follow us on X, Facebook, and LinkedIn for updates.

Contact:

• Have questions or comments? Email us at cyberleadersnetwork@sans.org