meta_pixel
Tapesearch Logo
Log in
CyberWire Daily

Live from Black Hat: Ransomware, Responsible Disclosure, and the Rise of AI [Microsoft Threat Intelligence Podcast]

CyberWire Daily

N2K Networks, Inc.

Daily News, Tech News, News, Technology

4.61K Ratings

🗓️ 1 September 2025

⏱️ 43 minutes

🧾️ Download transcript

Summary

While our team is observing the Labor Day holiday in the US, we hope you will enjoy this episode of The Microsoft Threat Intelligence Podcast . New episodes airs on the N2K CyberWIre network every other Wednesday. In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is live from Black Hat 2025 with a special lineup of Microsoft security leaders and researchers. First, Sherrod sits down with Tom Gallagher, VP of Engineering and head of the Microsoft Security Response Center (MSRC). Tom shares how his team works with researchers worldwide, why responsible disclosure matters, and how programs like Zero Day Quest (ZDQ) are shaping the future of vulnerability research in cloud and AI security. He also announced the next iteration of ZTQ with $5 million up for grabs. Next, Sherrod is joined by Eric Baller (Senior Security Researcher) and Eric Olson (Principal Security Researcher) to unpack the fast-changing ransomware landscape. From dwell time collapsing from weeks to minutes, to the growing role of access brokers, they explore how attackers operate as organized ecosystems and how defenders can respond. Finally, Sherrod welcomes Travis Schack (Principal Security Researcher) alongside Eric Olson to examine the mechanics of social engineering. They discuss how attackers exploit urgency, trust, and human curiosity, why AI is supercharging phishing campaigns, and how defenders can fight back with both training and technology. In this episode you’ll learn:     How MSRC partners with researchers across 59 countries to protect customers Why Zero Day Quest is accelerating vulnerability discovery in cloud and AI How ransomware dwell times have shrunk from days to under an hour Resources: View Sherrod DeGrippo on LinkedIn  Zero Day Quest — Microsoft Microsoft Security Response Center Blog Related Microsoft Podcasts:   Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks      Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider   The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network. Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0

Welcome to the Microsoft Threat Intelligence Podcast.

0:09.2

I am Jared DeGrippo, director's threat intelligence strategy here at Microsoft,

0:12.7

and this week we're coming to you live from Black Hat with three mini episodes in one.

0:18.8

First, we'll chat with MSRC's Tom Gallagher about our bug bounty program

0:23.1

and round two of the zero-day quest. Then, we shift into a chat about the current

0:28.0

ransomware landscape with the Erics. After that, we'll wrap up with a talk about fishing and

0:33.3

social engineering with members of Microsoft's incident response. Hello, everyone.

0:38.1

I am Shera DeVirco Director of Threat Intelligence Strategy here at Microsoft.

0:41.8

I am joined by one of my most favorite people, Tom Gallagher, Vice President of Engineering,

0:47.8

and quite importantly, the head of the Microsoft Security Response Center.

0:54.5

Welcome, Tom.

0:58.2

Thanks for having me here, Sherrod.

1:00.5

It's so good to see you.

1:01.7

I've tried to get you on my podcast several times,

1:04.2

and it has not happened.

1:06.4

Why is that?

1:07.0

That's your first question.

1:08.7

I look forward to our conversation today. Oh, that was very

1:12.7

difficult. That was really good. So give me just a rundown of MSRC, the Microsoft

1:19.6

Security Response Center. What's the main responsibility is a mission there? What do you guys do?

1:24.4

There's a lot of different things that we do, but the main thing is any security

1:29.0

vulnerability that's found by somebody outside of the company gets reported through the MSRCs.

...

Please login to see the full transcript.

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.

Copyright © Tapesearch 2025.