In more than 90% of breaches, preventable gaps enabled the attack. Steve Elovitz leads Unit 42's North America Consulting practice. His team responded to 750+ major cybersecurity incidents in 2025. In this episode, we unpack the 2026 Unit 42 Global Incident Response Report and what these investigations reveal about how attackers are succeeding. What you'll learn: How AI compressed attack timelines from 5 hours to 1 hour for data exfiltration Why identity weaknesses played a material role in 90% of investigations (not vulnerabilities, not zero-days) How supply chain risk expanded beyond code to OAuth tokens and SaaS integrations (up from 6% to 23% of cases) What nation-state actors are doing to avoid detection (living on network devices, applying for jobs to get credentials) The 5 highest-ROI security controls based on 750 real-world breaches Steve brings 15 years of incident response experience from Mandiant, Booz Allen, and PwC. He's been on the front lines during some of the worst days in security teams' careers. Fair warning: this conversation gets technical. We dig into defense strategy, attacker TTPs, and what's actually working in the field versus what just looks good on paper. Timestamps: 00:00 - Cold open: Prevention vs detection 00:33 - Introduction 02:03 - What pulling the fire alarm looks like 06:41 - The human cost of breaches 09:30 - How AI accelerates attacks (5 hours to 1 hour) 16:25 - Identity as the new attack surface (90% of cases) 23:26 - Supply chain risk and SaaS security 27:10 - Nation-state stealth tactics 30:54 - The preventable gaps paradox 32:41 - The 5 controls that actually work 36:01 - Unit 42's role in incident response 38:00 - Closing thoughts Read the 2026 Unit 42 Global Incident Response Report: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report Email the show: threatvector@paloaltonetworks.com Credits: Host: David Moulton Executive Producer: Michael Heller Production Team: Kenny Miller, Joe Bettencourt, Virginia Tran Editor & Audio Mix: Elliott Peltzman #Cybersecurity #IncidentResponse #ThreatIntel #AI #IdentitySecurity #CISO

 190      15