While dashboards may show 100% MFA coverage, real-world testing proves this is often a myth. Andrew McNicol explains how attackers bypass perimeters by exploiting human nature and application logic rather than technical bugs. Learn how help desk vulnerabilities and slow brute-forcing can enable unauthorized access despite your security controls. Move beyond checkbox security.
AI is being integrated into hospitals at breakneck speed, often leaving security as an afterthought. Andrew McNicol discusses treating AI as a “feature” that can be systematically abused through prompt injection and procurement blindspots. Close the governance gap by implementing clear policies and asking vendors critical questions about whether they process data locally or remotely.
Digital firewalls cannot protect a wide-open “front door”. Andrew McNicol shares startling examples of bypassing hospital security layers to gain access to sensitive areas like the NICU. Discover how we used a common office item to help bypass a sophisticated lock and why the “trusted layer” trap makes staff less vigilant.
Standard vulnerability scanners only tell half the story. Andrew McNicol explains why the most dangerous risks—like medical IoT devices and printers—often go undetected by automated tools. Learn why “abusing logic” is more effective for an attacker than exploiting a version-based bug. Gain visibility into your true external footprint to secure your most vulnerable clinical assets.
Hacking a hospital requires a safety-first approach to protect critical care. Andrew McNicol outlines a methodical strategy to identify high-impact risks without disrupting clinical operations or system uptime. Learn how codified rules of engagement and assumed breach scenarios ensure patient safety remains the priority during deep security assessments.
Targeted threat actors often persist for over 200 days by using native network protocols to move undetected. Andrew McNicol explains why relying on malware detection isn’t enough to stop human actors. Gain insights into Active Directory vulnerabilities like Kerberos and certificate abuse. Secure your environment by validating alerts through expert Purple Team integration.
Standard scanners only tell half the story of a targeted attack. Following numerous hospital tests with the HHS-OIG, Andrew McNicol reveals why “checkbox compliance” fails. Explore five high-level takeaways, from enforcing configuration management to auditing business flow logic. Learn to close the “human open door” and secure the logic flaws that scanners ignore.
A true penetration test reveals exactly how you will be breached, moving beyond simple out-of-date software lists. Andrew McNicol explains how adversarial emulation uncovers gaps in permissions and business logic that automated tools miss. By mimicking real-world Command and Control (C2) traffic, you can validate if your team is truly prepared to alert on malicious activity.
Breakpoint Labs CTO Andrew McNicol reveals how attackers bypass traditional defenses by exploiting application logic, misconfigured Active Directory, and human error to compromise life-supporting systems. Learn five high-impact takeaways developed with HHS OIG to strengthen defenses and proactively mitigate risk across your healthcare organization. This is essential viewing for healthcare cybersecurity teams.
In Part II of our AD-RECON series, Luke Hudson details the --pathing and --transitive modules for advanced analysis. He demonstrates programmatically filtering BloodHound datasets to identify hidden attack paths, such as nested ADCS rights and object control. Learn to isolate users with paths to Domain Admin without manual GUI traversal.
In this Part 1 update, Luke Hudson walks through AD-RECON for rapid Bloodhound triage. This video covers environment setup using Python and the Neo4j driver, and executing automated queries to instantly surface critical findings like Kerberoasting and AS-REP Roasting. Learn to prioritize high-risk vectors using programmatic analysis.
Discover critical cybersecurity gaps traditional scanners overlook. BreakPoint Labs CTO Andrew McNicol reveals 10 common attack methods hackers actively use against healthcare networks. Learn practical, actionable steps your organization can implement immediately to better protect sensitive data, strengthen defenses, and proactively mitigate risks. This is essential viewing for healthcare cybersecurity teams.
AD-RECON swiftly triages BloodHound data, identifying potential attack paths and misconfigurations. Written in Python with the Neo4j driver, it automates high-value queries and delivers insights in minutes, saving hours of manual analysis. A must-have tool from BreakPoint Labs for Red Teams, Pentesters, and Defenders.
Ray Blasko, Technical Director of Offensive Operations at BreakPoint Labs, breaks down how attackers exploit overlooked OT weaknesses, from supply chain gaps to wireless threats. See your environment through an adversary’s eyes and learn practical steps to harden defenses and secure industrial systems.
Active Directory Certificate Abuse is a technique that leads to Domain Admin privileges in an astonishing 90% of cases. This video explains how attackers exploit misconfigured certificate templates and introduces free tools like Certify and Certipy that can help you find and fix this critical risk.
Network file shares are a “treasure trove” of risk that exists on nearly every network. Standard users often have access to forgotten spreadsheets and files containing sensitive information. Learn about free tools like Snaffler that can automatically audit your shares to find this sensitive information before an attacker does.
Vulnerability scanners often flag issues like a lack of SMB signing as “medium” risk, but attackers see it as a critical vulnerability. These flaws enable devastating relay attacks that can compromise your network. Learn to see this risk from an attacker’s perspective and discover tools like Responder that can safely help you find these gaps.
Even with 2FA, weak passwords on non-enforced accounts, especially service accounts, remain a critical risk. Attackers use slow brute-force techniques and targeted password lists to gain initial access. This segment covers the persistence of this threat and the importance of proactive password auditing to uncover these vulnerabilities.
Internal networks, especially in healthcare, are filled with web applications that create unmanaged risk. The first step is gaining visibility. Learn about the free tool GoWitness, which can create a visual map of your internal web apps, allowing you to identify and disable unneeded services before moving to more advanced hacking techniques.
| Kerberoasting is an attack that exploits a core feature of Active Directory and isn’t going away. It allows attackers to extract password hashes from service accounts, which are often highly privileged. This segment explains the four key steps to mitigate this risk: auditing accounts, tightening permissions, using strong passwords, and strengthening Kerberos encryption. |
Default credentials and configurations are a problem on virtually every network, often left over from old systems. A default setting, like a dropdown menu listing all users, can be the first step in a chain that leads to full domain compromise. Learn how attackers exploit these simple oversights, even on overlooked devices like printers.
Active Directory often becomes a “rat’s nest” of permissions, hiding your organization’s biggest flaws. Learn how admins accidentally create critical risks, like granting the “Everyone” group permissions, and why even disabled accounts often remain a significant threat that attackers can simply re-enable and abuse to escalate their privileges.
Many organizations lack effective internal network monitoring, focusing only on external malware threats. This leaves them blind to common attacker “tradecraft” like DC Sync or Kerberoasting. When tested, the answer to “What did you catch?” is usually “nothing.” This video explains why testing your internal detection capability is a critical, high-value exercise.
An organization’s help desk is often a key target for attackers. With just a name and a bit of confidence, an attacker can often social engineer a password reset, bypassing technical controls entirely. This segment explains why weak reset procedures are a common entry point and why regular testing of your help desk is essential.
To truly defend Active Directory, you need to view it from the perspective of an attacker. In this segment from his BSides talk, CTO Andrew McNicol shows you how. He introduces AD-RECON, a powerful tool that automates complex BloodHound queries to uncover the hidden AD security flaws that attackers exploit but scanners often miss. Learn what attackers look for and how you can secure those gaps.
In this 25-minute talk from Critical Effect DC, BreakPoint Labs Technical Director Ray Blasko shares what attackers see that you don’t. Gain essential insights into attack surface management and view your systems from an adversary’s perspective. Learn the key steps to strengthen your defenses against modern threats.
