<![CDATA[Outside the Perimeter]]>This podcast is for IT and cybersecurity leaders who are busy, under pressure, and just want straight answers.  

Each episode, we will talk about the latest innovations in cybersecurity that are changing the game with expert guests from across the industry.  

You’ll get straightforward takeaways you can use right away to build better defences. 

]]>https://arugacyber.com/Riverside.fm (https://riverside.com)Tue, 13 Oct 2026 15:10:29 GMTMon, 01 Jun 2026 13:40:49 GMT60Aruga Cyber<p>This podcast is for IT and cybersecurity leaders who are busy, under pressure, and just want straight answers.  </p><p></p><p>Each episode, we will talk about the latest innovations in cybersecurity that are changing the game with expert guests from across the industry.  </p><p></p><p>You’ll get straightforward takeaways you can use right away to build better defences. </p>episodicAruga Cyberjonathan.broadley@arugacyber.comno<![CDATA[You Pay for a Pen Test. You Get a Scan Report.]]>A former GCHQ operator on what real security testing actually looks like

Most organisations have pen testing on their security checklist. They scope it, budget for it, sign it off, and file the report. Job done.

But what if most of what gets sold as pen testing isn't actually pen testing at all?

In this episode of Outside the Perimeter, David is joined by Nathan Jones, co-founder of SecuraNova and a former member of the active cyber team at GCHQ. Nathan has spent his career at the sharp end of offensive security, and he has seen the same story play out more times than he can count. A business pays for a pen test, receives a report full of scan output, and files it away believing they are covered. They are not.

Nathan breaks down what separates genuine security testing from a glorified vulnerability scan, why the rise of AI in this space has made the problem worse rather than better, and what the shift toward proper security assurance actually means for organisations trying to make their budgets work harder.

If you have signed off a pen test in the last two years and assumed the job was done, this one is worth 30 minutes of your time.

No waffle. No jargon. Just the stuff you actually need to know.

]]>3069085f-8a17-49cd-a7ff-94118d07f45eMon, 12 Oct 2026 19:33:28 GMT<p>A former GCHQ operator on what real security testing actually looks like</p><p>Most organisations have pen testing on their security checklist. They scope it, budget for it, sign it off, and file the report. Job done.</p><p>But what if most of what gets sold as pen testing isn't actually pen testing at all?</p><p>In this episode of Outside the Perimeter, David is joined by Nathan Jones, co-founder of SecuraNova and a former member of the active cyber team at GCHQ. Nathan has spent his career at the sharp end of offensive security, and he has seen the same story play out more times than he can count. A business pays for a pen test, receives a report full of scan output, and files it away believing they are covered. They are not.</p><p>Nathan breaks down what separates genuine security testing from a glorified vulnerability scan, why the rise of AI in this space has made the problem worse rather than better, and what the shift toward proper security assurance actually means for organisations trying to make their budgets work harder.</p><p>If you have signed off a pen test in the last two years and assumed the job was done, this one is worth 30 minutes of your time.</p><p>No waffle. No jargon. Just the stuff you actually need to know.</p>no00:33:39You Pay for a Pen Test. You Get a Scan Report.full<![CDATA[£25 Million Hiding in Plain Sight]]>Most organisations think their biggest cyber security risk is the next attack. Louis Holt thinks it's something much closer to home.

Louis spent years in cyber forensics, counter-terrorism and high-tech policing before founding ESprofiler - a platform built to answer a question almost nobody can: what security tools do you actually have, what are they costing you, and are they even switched on properly?

In this episode of Outside the Perimeter, David is joined by Louis to talk about the millions of pounds enterprises are quietly wasting on overlapping, underused, or completely forgotten security tools - including one organisation that was still paying storage fees on hardware that had reached end of life and was never deployed. Louis explains why this happens, why "nobody gets fired for buying the big name" thinking makes it worse, and what genuinely good security spend actually looks like.

This isn't about more tools. It's about knowing what you've already got.

No waffle. No jargon. Just the stuff you actually need to know.

]]>3e7e20a0-3a5a-4869-9c9d-16810bf95746Thu, 06 Aug 2026 16:47:53 GMT<p>Most organisations think their biggest cyber security risk is the next attack. Louis Holt thinks it's something much closer to home.<br /><br />Louis spent years in cyber forensics, counter-terrorism and high-tech policing before founding ESprofiler - a platform built to answer a question almost nobody can: what security tools do you actually have, what are they costing you, and are they even switched on properly?<br /><br />In this episode of Outside the Perimeter, David is joined by Louis to talk about the millions of pounds enterprises are quietly wasting on overlapping, underused, or completely forgotten security tools - including one organisation that was still paying storage fees on hardware that had reached end of life and was never deployed. Louis explains why this happens, why "nobody gets fired for buying the big name" thinking makes it worse, and what genuinely good security spend actually looks like.<br /><br />This isn't about more tools. It's about knowing what you've already got.<br /><br />No waffle. No jargon. Just the stuff you actually need to know.</p>no00:37:13£25 Million Hiding in Plain Sightfull<![CDATA[Your Breach Plan Has a Blind Spot]]>Most organisations have spent serious money on cybersecurity tools. EDRs, next-gen SIEMs, vulnerability management platforms. The prevention and detection stack has never been better.

But when something gets through (and it will) what happens next?

In this episode of Outside the Perimeter, David is joined by Will Poole and Ollie Fletcher, co-founders of Strand Intelligence, an AI-powered platform built to automate the digital forensics and incident response that most organisations are completely unprepared for.

Will spent years as a technical director of an insurance-backed incident response company - parachuted into businesses at their worst moments. Ollie has seen the same story play out from the commercial side. Together they have a clear-eyed view of where the industry is falling short, and what needs to change.

In this episode we will cover:
• Why incident response has barely changed in a decade despite the explosion in tooling
• What your cyber insurer actually expects when you make a claim
• How AI is finally closing the gap between getting breached and getting back on your feet - without destroying your evidence in the process.

Straight talk. No hype. Just the stuff you actually need to know.

]]>71fddfe1-2917-4028-ad4e-7d05b6256181Tue, 30 Jun 2026 12:30:15 GMT<p>Most organisations have spent serious money on cybersecurity tools. EDRs, next-gen SIEMs, vulnerability management platforms. The prevention and detection stack has never been better.<br /><br />But when something gets through (and it will) what happens next?<br /><br />In this episode of Outside the Perimeter, David is joined by Will Poole and Ollie Fletcher, co-founders of Strand Intelligence, an AI-powered platform built to automate the digital forensics and incident response that most organisations are completely unprepared for.<br /><br />Will spent years as a technical director of an insurance-backed incident response company - parachuted into businesses at their worst moments. Ollie has seen the same story play out from the commercial side. Together they have a clear-eyed view of where the industry is falling short, and what needs to change.<br /><br />In this episode we will cover:<br />• Why incident response has barely changed in a decade despite the explosion in tooling<br />• What your cyber insurer actually expects when you make a claim<br />• How AI is finally closing the gap between getting breached and getting back on your feet - without destroying your evidence in the process.<br /><br />Straight talk. No hype. Just the stuff you actually need to know.</p>no00:33:482Your Breach Plan Has a Blind Spotfull<![CDATA[No One Ever Gets Fired for Buying CrowdStrike]]>Luke Collinson is a Royal Academy of Engineering Enterprise fellow, former Head of Cyber, and founder of Cybersecurity Stack - and he's got some things to say that most people in this industry won't.

In this episode, Luke breaks down why the perimeter-based tooling most organisations are relying on is fundamentally flawed, how CISO pack mentality is creating dangerous blind spots, and why the compliance frameworks designed to protect you might actually be slowing down the innovation that would.

No fluff, no vendor pitches. Just a practitioner who's been on both sides of the table telling it like it is.

What you'll take away:
1. Why "nobody gets fired for buying CrowdStrike" is a security problem - the herd mentality shaping CISO buying decisions, and why it's leaving gaps that attackers are actively exploiting

2. How ransomware actually spreads inside your network - and why most current solutions are addressing the wrong part of the problem, causing operational downtime when it matters most (yes, think M&S)

3. A practical framework for evaluating newer, smaller security vendors - without compromising your baseline compliance requirements or taking on unacceptable risk

]]>471f468b-3822-4054-8743-62832b329cb9Mon, 01 Jun 2026 15:11:05 GMT<p>Luke Collinson is a Royal Academy of Engineering Enterprise fellow, former Head of Cyber, and founder of Cybersecurity Stack - and he's got some things to say that most people in this industry won't.<br /><br />In this episode, Luke breaks down why the perimeter-based tooling most organisations are relying on is fundamentally flawed, how CISO pack mentality is creating dangerous blind spots, and why the compliance frameworks designed to protect you might actually be slowing down the innovation that would.<br /><br />No fluff, no vendor pitches. Just a practitioner who's been on both sides of the table telling it like it is.<br /><br /><b>What you'll take away:</b><br />1. Why "nobody gets fired for buying CrowdStrike" is a security problem - the herd mentality shaping CISO buying decisions, and why it's leaving gaps that attackers are actively exploiting<br /><br />2. How ransomware actually spreads inside your network - and why most current solutions are addressing the wrong part of the problem, causing operational downtime when it matters most (yes, think M&amp;S)<br /><br />3. A practical framework for evaluating newer, smaller security vendors - without compromising your baseline compliance requirements or taking on unacceptable risk</p>no00:25:4911No One Ever Gets Fired for Buying CrowdStrikefull