Easy Prey

Why You Fall For Scams

Why do smart, capable people fall for scams even when the warning signs seem obvious in hindsight? In this episode, Dan Ariely joins us to examine how intuition often leads us in the wrong direction, especially under stress, uncertainty, or emotional pressure. A renowned behavioral economist, longtime professor of psychology and behavioral economics at Duke University, and bestselling author of Predictably Irrational, The Upside of Irrationality, Misbehaving, and Misbelief, Dan has spent decades studying why rational people consistently make choices that don't serve them. We talk about the deeply human forces that shape how we decide who to trust, and how easily those instincts can be exploited in high-stakes situations involving fraud, financial loss, and digital deception. Dan shares a deeply personal story about surviving severe burns and the long process of self-acceptance that followed, using his own experience to show how hiding, blending in, and social pressure quietly influence behavior in ways most of us never stop to question. We also explore why stress pushes people to search for patterns, stories, and a sense of control, even when those explanations aren't accurate. Dan explains how our minds operate like a "vintage Swiss Army knife," well suited for small, predictable communities but poorly equipped for modern risks like scams, cybersecurity threats, and low-probability, high-impact events. Topics include why near-misses teach the wrong lessons, why authority and urgency are so effective in manipulation, and why expecting people to be perfectly rational is a losing strategy. We also discuss practical ways to slow decisions down and bring in outside perspectives to help design safeguards that work with human nature. Show Notes: * [01:52] Dan Ariely joins the episode to examine how human decision-making actually works under pressure. * [03:41] How intuition can point us in the wrong direction during moments of stress and uncertainty. * [05:26] Trust, authority, and urgency as core levers used in fraud and manipulation. * [07:12] When decisions feel overwhelming, the brain's tendency to rely on shortcuts. * [08:58] Dan explains why rational thinking often breaks down faster than we expect. * [10:34] Near-misses and how they quietly reinforce false confidence instead of caution. * [12:09] Why repeated exposure to risk doesn't necessarily make people better decision-makers. * [13:55] Stress-driven pattern seeking and the human need for explanation and control. * [15:32] Superstition, conspiracy thinking, and what they reveal about uncertainty tolerance. * [17:18] Why modern threats like scams and cybercrime confuse brains built for simpler environments. * [18:56] The "vintage Swiss Army knife" analogy and what it says about human cognition. * [20:41] Authority cues and why skepticism often disappears in the presence of perceived expertise. * [22:27] Slowing decisions down as one of the most reliable defenses against manipulation. * [24:13] Dan reflects on how behavioral economics challenged traditional models of rational choice. * [25:59] A personal story about surviving severe burns and the long path to self-acceptance. * [27:44] How hiding and blending in can quietly shape behavior and self-perception. * [29:31] Social pressure and its role in everyday compliance and risk-taking. * [31:16] Why vulnerability doesn't look the way people expect it to. * [33:02] Expecting perfect rationality and why that assumption consistently fails. * [34:47] Designing systems that account for human limits instead of ignoring them. * [36:33] The value of outside perspective when decisions carry real consequences. * [38:19] Practical ways individuals can reduce risk by changing how they decide. * [40:05] When slowing down matters more than having more information. * [41:52] Applying behavioral insights to fraud prevention and digital safety. * [43:38] Why better tools help, but mindset still plays a critical role. * [45:24] Final thoughts on working with human nature rather than fighting it. * [48:02] What listeners can take away about decision-making, risk, and self-awareness. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Dan Ariely [https://danariely.com/all-about-dan/] * Dan Ariely - LinkedIn [https://www.linkedin.com/in/danariely/] * Books by Dan Ariely [https://www.amazon.com/s?k=dan+ariely&adgrpid=192132124771&hvadid=779576127358&hvdev=c&hvexpln=0&hvlocphy=1014424&hvnetw=g&hvocijid=3861454944472323533--&hvqmt=e&hvrand=3861454944472323533&hvtargid=kwd-5568692795&hydadcr=22529_13730677_8633&mcid=526858b62a573b9498b156bfa3d7202f&tag=googhydr-20&ref=pd_sl_4pid177tql_e] * Dan Ariely - YouTube [https://www.youtube.com/user/danariely]

Mobile Device Threats

In a world where we're told to carry our entire lives in our pockets, we've reached a strange tipping point where the very devices meant to connect us have become windows into our private lives for those who wish us harm. It's no longer a matter of looking for the "shady" corners of the internet; today, the threats come from nation-state actors, advanced AI, and even the people we think we're hiring. We are living in an era where the most sophisticated hackers aren't just trying to break into your phone, they're trying to move into your business by pretending to be your best employee. Joining the conversation today is Jared Shepard, an innovative industry leader and the CEO of Hypori. A U.S. Army veteran with over 20 years of experience, Jared's journey is far from typical; he went from being a high school dropout to serving as a sniper and eventually becoming the lead technical planner for the Army's Third Corps. He is also the founder of Intelligent Waves and the chair of the nonprofit Warriors Ethos, bringing a perspective shaped by years of advising technologists in active war zones. We're going to dive deep into why Jared believes everything you own should be considered already compromised and why that realization is the first step toward true security. From the terrifying reality of his own 401k being stolen via identity theft to the future of "dumb terminals" that protect your privacy by storing nothing at all, this discussion challenges the status quo. We'll explore how to navigate a future where AI can fake your identity in real-time and why the ultimate battle in cybersecurity isn't against a specific country, but against our own human tendency toward laziness. Show Notes: * [[02:12] Jared Shepard of Hypori is here to discuss how modern cyber threats actually play out in real life. * [04:48] How modern attacks unfold slowly instead of triggering obvious alarms. * [05:55] Why many victims don't realize anything is wrong until secondary systems start failing. * [07:56] What identity theft looks like when accounts are targeted methodically over time. * [08:48] How attackers prioritize persistence and access over immediate financial gain. * [10:32] A real attempt to take over long-term financial accounts and how it surfaced. * [13:07] Why financial institutions often respond late even when fraud is already underway. * [15:44] The limits of traditional identity verification in an AI-driven threat environment. * [16:52] Why layered authentication still fails when underlying identity data is compromised. * [18:21] Deepfakes, voice cloning, and why video calls no longer prove much. * [20:57] How laptop farms are used to bypass hiring controls and internal access checks. * [22:18] Why insider-style access is increasingly coming from outside the organization. * [23:33] Why some companies are quietly bringing back in-person steps for sensitive roles. * [26:09] SIM farms, mobile identity abuse, and how scale changes detection. * [28:47] The growing tension between personal privacy and corporate device control. * [31:22] Why assuming device compromise changes everything downstream. * [33:58] Isolating data from endpoints instead of trying to secure the device itself. * [35:12] How moving compute and data off the endpoint reduces exposure without requiring device monitoring. * [36:35] How pixel-only access limits data exposure even on compromised hardware. * [39:11] Why AI training data introduces new security and poisoning risks. * [41:46] Why recovery planning is often overlooked until it's too late. * [44:18] The problem with victim-blaming and how it distorts security responses. * [46:52] Why layered defenses matter more than any single tool or platform. * [47:58] What practical preparation looks like for individuals, not just enterprises. * [49:12] Rethinking privacy as controlled access rather than total lock-down. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Jared Shepard - Hypori [https://www.hypori.com/leadership-and-board] * Jared Shepard - LinkedIn [https://www.linkedin.com/in/shepardj/] * Warriors Ethos - Jared Shepard [https://www.warriorsethos.org/jared-shepard/]

Past, Present, and Future of AI agents

The intersection of AI and cybersecurity is changing faster than anyone expected, and that pace is creating both incredible innovation and brand-new risks we're only beginning to understand. From deepfake ads that fool even seasoned security professionals to autonomous agents capable of acting on our behalf, the threat landscape looks very different than it did even a year ago. To explore what this evolution means for everyday people and for enterprises trying to keep up, I'm joined by Chris Kirschke, Field CISO at Tuskira and a security leader with more than two decades of experience navigating complex cyber environments. Chris talks about his unconventional path into the industry, how much harder it is for new professionals to enter cybersecurity today, and the surprising story of how he recently fell for a fake Facebook ad that showcased just how convincing AI-powered scams have become. He breaks down the four major waves of InfoSec from the rise of the web, through mobile and cloud, to the sudden, uncontrollable arrival of generative AI. He then explains why this fourth wave caught companies completely off guard. GenAI wasn't something organizations adopted thoughtfully; it appeared overnight, with thousands of employees using it long before security teams understood its impact. That forced long-ignored issues like data classification, permissions cleanup, and internal hygiene to the forefront. We also dive into the world of agentic AI which is AI that doesn't just analyze but actually acts and the incredible opportunities and dangers that come with it. Chris shares how low-code orchestration, continuous penetration testing, context engineering, and security "mesh" architectures are reshaping modern InfoSec. Chris spends a lot of time talking about the human side of all this and why guardrails matter, how easy it is to over-automate, and the simple truth that AI still struggles with the soft skills security teams rely on every day. He also shares what companies should think about before diving into AI, starting with understanding their data, looping in legal and privacy teams early, and giving themselves room to experiment without turning everything over to an agent on day one. Show Notes: * [00:00] Chris Kirschke, Field CISO at Tuskira, is here to explore how AI is reshaping cybersecurity and why modern threats look so different today. * [03:05] Chris shares his unexpected path from bartending into IT in the late '90s, reflecting on how difficult it has become for newcomers to enter cybersecurity today. * [06:18] A convincing Facebook scam slips past his defenses, illustrating how AI-enhanced fraud makes traditional red flags far harder to spot. * [09:32] GenAI's sudden arrival in the workplace creates chaos as employees adopt tools faster than security teams can assess risk. * [12:08] The conversation shifts to AI-driven penetration testing and how continuous, automated testing is replacing traditional annual reports. * [15:23] Agentic AI enters the picture as Chris explains how low-code orchestration and autonomous agents are transforming security workflows. * [18:24] He discusses when consumers can safely rely on AI agents and why human-in-the-loop oversight remains essential for anything involving transactions or access. * [21:48] AI's dependence on context becomes clear as organizations move toward context lakes to support more intelligent, adaptive security models. * [25:46] He highlights early experiments where AI agents automatically fix vulnerabilities in code, along with the dangers of developers becoming over-reliant on automation. * [29:50] AI emerges as a support tool rather than a replacement, with Chris emphasizing that communication, trust, and human judgment remain central to the security profession. * [33:35] A mock deposition experience reveals how AI might help individuals prepare for high-stress legal or compliance scenarios. * [37:13] Chris outlines practical guardrails for adopting AI—starting with data understanding, legal partnerships, and clear architectural patterns. * [40:21] Chatbot failures remind everyone that AI can invent policies or explanations when it lacks guidance, underscoring the need for strong oversight. * [41:32] Closing thoughts include where to find more of Chris's work and continue learning about Tuskira's approach to AI security. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Tuskira [https://www.tuskira.ai/] * Chris Kirschke -LinkedIn [https://www.linkedin.com/in/kirschke/]

You Are Traceable with OSINT

Publicly available data can paint a much clearer picture of our lives than most of us realize, and this episode takes a deeper look at how those tiny digital breadcrumbs like photos, records, searches, even the background of a Zoom call can be pieced together to reveal far more than we ever intended. To help break this down, I'm joined by Cynthia Hetherington, Founder and CEO of The Hetherington Group, a longtime leader in open-source intelligence. She also founded Osmosis, the global association and conference for OSINT professionals, and she oversees OSINT Academy, where her team trains investigators, analysts, and practitioners from all experience levels. Cynthia shares how she started her career as a librarian who loved solving information puzzles and eventually became one of the earliest people applying internet research to real investigative work. She talks about the first wave of cybercrime in the 1990s, how she supported law enforcement before the web was even mainstream, and why publicly accessible data today is more powerful and more revealing than ever. We get into how OSINT actually works in practice, from identifying a location based on a sweatshirt logo to examining background objects in video calls. She also explains why the U.S. has fewer privacy protections than many assume, and how property records, social media posts, and online datasets combine to expose surprising amounts of personal information. We also explore the growing role of AI in intelligence work. Cynthia breaks down how tools like ChatGPT can accelerate analysis but also produce hallucinations that investigators must rigorously verify, especially when the stakes are legal or security-related. She walks through common vulnerabilities people overlook, the low-hanging fruit you can remove online, and why your online exposure often comes from the people living in your home. Cynthia closes by offering practical advice to protect your digital footprint and resources for anyone curious about learning OSINT themselves. This is a fascinating look at how much of your life is already visible, and what you can do to safeguard the parts you'd rather keep private. Show Notes: * [01:17] Cynthia Hetherington, Founder & CEO of The Hetherington Group is here to discuss OSINT or Open-Source Intelligence. * [02:40] Early cyber investigators began turning to her for help long before online research tools became mainstream. * [03:39] Founding The Hetherington Group marks her transition from librarian to private investigator. * [04:22] Digital vulnerability takes center stage as online data becomes widely accessible and increasingly revealing. * [05:22] We get a clear breakdown of what OSINT actually is and what counts as "publicly available information." * [06:40] A simple trash bin in a photo becomes a lesson in how quickly locations can be narrowed down. * [08:03] Cynthia shares the sweatshirt example to show how a tiny image detail can identify a school and possibly a city. * [09:32] Background clues seen during COVID video calls demonstrate how unintentional information leaks became routine. * [11:12] A news segment with visible passwords highlights how everyday desk clutter can expose sensitive data. * [12:14] She describes old threat-assessment techniques that relied on family photos and subtle personal cues. * [13:32] Cynthia analyzes the balance and lighting of a Zoom backdrop, pointing out what investigators look for. * [15:12] Virtual and real backgrounds each reveal different signals about a person's environment. * [16:02] Reflections on screens become unexpected sources of intelligence as she notices objects outside the camera frame. * [16:37] Concerns grow around how easily someone can be profiled using only public information. * [17:13] Google emerges as the fastest tool for building a quick, surface-level profile of almost anyone. * [18:32] Social media takes priority in search results and becomes a major driver of self-exposed data. * [19:40] Cynthia compares AI tools to the early internet, describing how transformative they feel for investigators. * [20:58] A poisoning case from the early '90s demonstrates how online expert communities solved problems before search engines existed. * [22:40] She recalls using early listservs to reach forensic experts long before modern digital research tools were available. * [23:44] Smarter prompts become essential as AI changes how OSINT professionals gather reliable information. * [24:55] Cynthia introduces her C.R.A.W.L. method and explains how it mirrors the traditional intelligence lifecycle. * [26:12] Hallucinations from AI responses reinforce the need for human review and verification. * [27:48] We learn why repeatable processes are crucial for building trustworthy intelligence outputs. * [29:05] Elegant-sounding AI answers illustrate the danger of unverified assumptions. * [30:40] An outdated email-header technique becomes a reminder of how quickly OSINT methods evolve. * [32:12] Managed attribution—hiding your digital identity—is explained along with when it's appropriate to use. * [33:58] Cynthia unpacks the reality that the U.S. has no constitutional right to privacy. * [35:36] The 1996 case that sparked her digital-vulnerability work becomes a turning point in her career. * [37:32] Practical opt-out steps give everyday people a way to remove basic personal data from public sites. * [38:31] She discusses how indirect prompting of AI tools can still narrow down someone's likely neighborhood or lifestyle. * [39:58] Property and asset records emerge as unavoidable exposure points tied to government databases. * [40:52] A high-risk client's situation shows how family members often create digital vulnerabilities without realizing it. * [42:44] Threats that surface too late demonstrate why proactive intelligence work is essential. * [44:01] Concerns about government surveillance are contrasted with the broader access private investigators actually have. * [45:12] Train tracks become an example of how physical infrastructure now doubles as a modern data network. * [46:03] She explains how audio signatures and forensic clues could theoretically identify a train's path. * [47:58] Asset tracking becomes a global operation as valuable cargo moves between ships, trucks, and rail systems. * [49:48] Satellite imagery makes monitoring even remote or underwater locations almost effortless. * [51:12] Everyday applications of geospatial analysis include environmental changes and shifts within local communities. * [52:19] Surveillance is compared to gravity; it's constant, invisible, and always exerting pressure. * [52:44] Cynthia shares practical strategies for controlling your environment and keeping conversations private. * [54:01] Resources like OSINT Academy, Information Exposed, and the Osmosis Association offer pathways for learning and strengthening personal privacy. * [55:32] The episode closes with encouragement to stay aware of what you share and how easily digital clues can be connected. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Hetherington Group [https://hetheringtongroup.com/] * OSMOSIS [https://osmosisassociation.org/] * OSINT Academy [https://osintacademy.com/] * Cynthia Hetherington - LinkedIn [https://www.linkedin.com/in/cynthiahetherington/] * OSINT: The Authoritative Guide to Due Diligence [https://www.amazon.com/Osint-Authoritative-Guide-Due-Diligence/dp/1960299425/] * Business Background Investigations: Tools and Techniques for Solution Driven Due Diligence [https://www.amazon.com/Business-Background-Investigations-Techniques-Diligence/dp/1889150495/]

Anyone Could Walk In

Sometimes we forget how much trust we place in the little things around us like a lock on a door or a badge on someone's shirt. We see those symbols and assume everything behind them is safe, but it doesn't always work that way. A person with enough confidence, or the right story, can slip through places we think are locked down tight, and most of us never notice it's happening. My guest today is Deviant Ollam, and he's one of the rare people who gets invited to break into buildings on purpose. He talks about how he fell into this unusual line of work, the odd moments that shaped his career, and why understanding human behavior matters just as much as understanding locks or alarms. Listening to him describe these situations, where he's walking through offices, popping doors, or blending in with repair crews, makes you realize how blind we can be to our own surroundings. We also get into the practical side of things: the mistakes companies make, the small fixes that go a long way, and why teaching employees to slow down and ask a few extra questions can make all the difference. It's an eye-opening conversation, especially if you've ever assumed your workplace is more secure than it really is. Show Notes: * [03:24] Deviant shares how early adventures, abandoned buildings, and curiosity about locks pulled him toward physical security. * [06:20] A story about a law firm reveals how an office "secure" door was bypassed instantly, exposing major hardware flaws. * [09:16] Discussion shifts to how the locksmith and safe technician community reacted to his public teaching and how that's changed over time. * [13:28] The topic turns to security theater and the gap between feeling safe and actually being protected. * [16:18] An explanation of symbolic locks versus real security products highlights how easily people mix up the two. * [19:11] Conversation moves into the lack of clear U.S. lock standards and why European systems make things easier for consumers. * [21:51] Layered security comes into focus, emphasizing that the goal is to delay and deter rather than stop every possible attack. * [24:35] Monitoring tools, overlooked windows, and forgotten blind spots show how attackers often choose the easiest entry point. * [27:38] We look at the politics of penetration tests and why coordinating with building management is essential. * [31:28] Escalation testing illustrates how long suspicious behavior can go unnoticed inside an organization. * [34:34] The need for simple, obvious reporting channels becomes clear when employees aren't sure who to alert. * [37:00] A breakdown of common cover stories shows why attackers lean on confidence and industry jargon. * [39:50] Urgency and pressure tactics surface as key components of social engineering and why "polite paranoia" helps. * [41:14] A viral prank underscores how easily an unverified person can be escorted into restricted areas. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Deviant Ollam [https://deviating.net/] * Deviant Ollam - You Tube [https://www.youtube.com/deviantollam] * Deviant Ollam - Instagram [https://www.instagram.com/deviantollam/?hl=en] * Practical Lock Picking: A Physical Penetration Tester's Training Guide [https://www.amazon.com/Practical-Lock-Picking-Physical-Penetration/dp/1597499897]