RunAs Radio

How have large language models impacted hacking? Richard talks to Erica Burgess about her experiences using LLMs for red team hacking, collecting bug bounties, and identifying vulnerabilities in systems. Erica discusses the power of LLMs to generate a variety of viewpoints on a potential exploit and help the hacker think "out of the box." Coordinating multiple agents to attempt a variety of exploits, retrieve information, and otherwise deal with the drudgery parts of hacking means a skilled operator can move faster - what once would be days of work can be minutes. Where does AI in hacking go? Lots of scary places - but also pointing the way to new ways to protect systems!
Links
Burninator Sec
Recorded January 24, 2026

You're using Active Directory Certificate Services - but is it configured securely? Richard talks to Ron Arestia about his work with organizations implementing their own Public Key Infrastructure (PKI) with ADCS. Ron explains how poorly configured ADCS enables lateral attacks within an organization once an initial breach occurs, allowing black hats to move throughout your network. A well-designed PKI system has tiers of protection, with the top level completely disconnected from the network. Or do you really need your own PKI system? The conversation digs into the various scenarios, including third-party options. Certificates are the top level of security for your organization - you need to get it right!
Links
Active Directory Certificate Services
Windows Hello for Business
Certified Pre-Owned
Microsoft Defender for Identity
Secure Privileged Access
Pass the Hash
Microsoft Cloud PKI for Microsoft Intune
Microsoft Entra Conditional Access
Microsoft Autopilot
Ron's Blog
Recorded February 6, 2026

Ready to get started with Purview? Richard chats with Erica Toelle about the first steps you can take to harness the power of Purview in your organization. Erica explains that Purview is an umbrella product that covers several infosec technologies, including information rights management, data loss prevention, structured data governance, and more. When preparing for M365 Copilot, you want to start tagging sensitive information in your organization, and Purview can help by using LLMs to identify potentially sensitive content. You can also monitor how data is used, the types of prompts sent to M365 Copilot, and more. This can help you bootstrap M365 Copilot by using Purview to see which data Copilot uses, and then tune the access rules for that data. "Getting your data estate in order" is not a destination; it's a journey, and Purview can give you a map!
Links
Microsoft Purview
Data Security Posture Management
Data Governance with Microsoft Purview
Conditional Access with Microsoft Purview
SharePoint Advanced Management
Microsoft 365 Archive
Endpoint Data Loss Prevention
Purview Browser Extension
Recorded January 7, 2026

Business Process Automation has been around a long time - what are the latest approaches? Richard talks to Ian Cooper about his work building BPA workflows in organizations - starting on paper or a whiteboard to make sense of the process before bringing tools into the equation. Ian talks about building repeatable workflows that are well-documented and source-controlled, typically through GitHub. As workflows get more complex, you'll need orchestration engines that can handle failures and provide telemetry to identify when and where things go wrong. And make sure you let users know how things are going - or they will worry!
Links
Kafka
Durable Functions
GitHub Actions
Temporal
Pulumi
OpenTelemetry
Recorded December 5, 2025

How do you get an idea to implementation in your organization? Richard chats with Amber Vanderburg about the work she's done helping teams understand the process of getting projects started and finished. Amber talks about defining a clear starting line, ending line, and dead line. While many projects are important, prioritization is the challenge. This means often other priorities have to be resolved before something new can be started - you need resources and time to be successful. Working through the process takes time, but the alternative is failure to meet expectations. It takes planning and clear communication to get things done!
Links
Pathwayz Group
Mythical Man Month
The Four Disciplines of Execution
Speed of Trust
The Culture Map
Recorded December 4, 2025