Welcome to the Blue Security Podcast, a weekly podcast for information security defenders where we bring you discussions on best practices, tools, and implementation for enterprise security.

Now here are your hosts for today's show, Andy JA and Adam Brewer.

Welcome to this week's episode of the Blue Security Podcast.

I'm Andy, your host.

I'm Adam, your Co host.

All right, we got 3 great articles to talk about today.

The first one I wanted to highlight is I came across this article and I thought it was really interesting, you know, like we had our 2026 predictions for security and of course AI security was at the top of it.

This article just highlights a little bit more from a leadership perspective.

So I wanted to just talk about it briefly.

So according to a report published by the World Economic Forum, more than 94% of the global 800 plus secure cybersecurity leaders that were surveyed believe that AI is expected to be the most significant driver of change in cybersecurity this year.

Not really a surprise or anything like that.

However, there was an interesting data point within that report which was there was a divergent between CEOs and Csos.

So the top concern for CEOs was a cyber enabled fraud, which, you know, kind of left and they're not as concerned with ransomware and they've moved their focus to more emerging risks such as cyber enabled fraud and AI vulnerabilities.

And while, you know, that was for CE OS, CE OS on the other hand are more concerned with ransomware and then supply chain resilience.

So in the article they highlighted a couple of top AI security concerns.

C level leaders were concerned a lot with AI related vulnerabilities, which were identified as the fastest growing cyber risk by 87% of the respondents.

Cyber enabled fraud and phishing, supply chain disruption, exploitation of software vulnerabilities in the ransomware attacks were still cited as growing risks by more than half of the survey respondents.

And then insider threat and denial of service were seen as growing concerns by 30%.

So AI vulnerabilities and cyber enabled fraud phishing were at the very, very top of the concerns.

And then when it comes to generative AI concerns, the top one was data leaks exposing personal data, advancement of adversarial capabilities like phishing, malware development, deep fakes and the technical security of AI systems themselves and the increasing complexity of security governance.

So data leaks was at the top and then, you know, concerned with attackers and how they can use AI in their attacks going on.

So the increasing focus on AI security is also leading to action within organizations as a large percentage of the respondents assessing the security tools of the security of AI tools grew from 37% in 2025 to 64% in 2026.

And I want to make sure we have the wording like really solid here because this is looking at the security of AI tool.

So like, you know, when we're using AI tools, how secure are they versus just AI security in general, right?

So this is helping close a significant gap as organizations are looking at taking action and and thinking about this, it's closing that gap between the widespread recognition of AI driven risks and the rapid adoption of AI technologies without adequate safeguards.

The survey also found that 77% of organizations have adopted AI for cybersecurity purposes, primarily to enhance phishing detection, which was 52% of the survey respondents, intrusion and anomaly response at 46% and then user behavior analytics at 40%.

And then finally, the report noted that the confidence in national cyber preparedness continues to erode in the face of geopolitical threats, with 31% of the survey respondents reporting low confidence in their nation's ability to respond to major cyber incidents, which was up from 26% in 2025.

So I think more so to me, this whole article kind of demonstrates the the thinking as well as kind of reassures my thinking as well of where AI is and where we think it's going to go in 2026.

Lot to unpack here.

This is from a report published by the World Economic Forum.

Shout out to our friends about to party down in Davos here sooner than later.

This is interesting, the divergent between the CEO's and the CSO's and it almost seems strategic versus tactical.

And I know CSO's typically aren't tactical in their thinking, but if you're more like, I'm worried about supply chain disruption and you know, you could mean software supply chain too, which remains a big concern.

But worrying about it's like a rocking chair.

It gives you something to do, but it kind of doesn't get you anywhere.

The fact is most of software today is built on a very flimsy foundation of open source libraries that are maintained by one or two people, and all the software in the world is built on top of them.

And ultimately, you can worry about that all you want, but it's very difficult to change course on that and it's very difficult to justify rewriting those tried and true libraries.

So I kind of put that to the side.

Not to say you shouldn't have a bill of material, shouldn't know what's going on, but I'm kind of with the CE OS on this one.

The risks of fraud and impersonation are extremely high.

We have quoted Rachel Toback on the show many times and she has been very vocal in talking about the risks of voice cloning, of deepfakes, of being able to have a fake CEO call up administrative assistant and say wire this money to this other organization.

And there are very few ways to truly protect that unless you put really strong social engineering guard rails in in place.

That's a huge, huge risk and I'm much more concerned about that than than some of the other things on here.

And and so, you know, I think in terms of the ability to determine like we are of cyber risk increased, decreased or stayed the same.

AI vulnerabilities, the risk of that has increased.

Sure.

Cyber enabled fraud, absolutely.

Supply chain disruption, they're probably thinking bigger than the software supply chain.

So sure.

Yeah, I mean, that's that's always been a cyber risk though.

And that's more of a geopolitical thing too.

Exploitation of software vulnerabilities, ransomware attacks, those were rated by the way at 58 and 54%.

So for the most part, barely over half of people think that threat has increased.

And that's kind of borne out when you talk about the second thing where they went into detail on what are the cybersecurity issues related to generative AI concern.

You we the, the data here, Andy, you didn't unpack this, but I'll, I'll talk about it briefly.

Actually shows year over year.

So there's a 2026, a 2025 and a 2024 data point.

So the last basically since the AI boom kind of kicked off with ChatGPT here a couple of years ago.

And what's interesting are where it's grown and where it's declined.

So, for example, concerns about data leakage has grown.

It was 21 percent, 22% jumped to 34% in the most recent poll.

I think that's accurate.

At the same time, one that has decreased substantially was advancement of adversarial capabilities.

That went 4647% all the way down to 29%.

And I the reason why I think that's happening is we've constantly heard this drum beat up.

Oh, just you wait.

These attackers are going to start using AI to do better phishing, develop better malware, generate better deep fakes.

It's been the boogeyman.

And as of yet, we haven't seen that play out.

So there's some skepticism here.

We've been hearing this threat for 2-3 years and kind of haven't seen it materialize.

That doesn't mean it's not coming.

That doesn't mean you won't be hit by it, but you can see cybersecurity professionals see so as being pragmatic and shifting to where is the most tangible risk right now, not the boogeyman someday, but today.

And data leakage is the most substantial risk to organizations today.

And so I agree with that shift in focus, how those survey results have shifted over time.

And Andy, we're going to talk about AI browsers in a second and that touches on this even further.

But you and I kind of both have this attitude on and part of it is against by our day jobs.

We both work at Microsoft.

We do field security sales.

We've talked about data security as well in our day jobs.

And it's one of those things that's been on the radar of everyone for a very long time.

And most organizations haven't done the work.

And had they done the work, they would be in such a better spot right now.

And that doesn't help to say that really, because shaming someone for not getting it done when they were responding to the threats closest in front of their face.

But I just got done saying that.

So I'm not talking out of both sides by mouth.

But the good thing about data leakage concerns, there are really strong tools to help with that.

And for the most part, the tools, tactics, techniques have not changed.

The way you protect data from leaking to say a consumer version of CLOD or Hitachi PT is the same way you protected your data leaking from a consumer Google Drive or consumer Dropbox.

That is the exact same thing.

It's just a browser endpoint.

Ultimately you don't need to reinvent the wheel.

And you've got every VC backed company in the world showing up to RSA right now saying they can solve your AI security challenges.

And your biggest AI security challenge is data security.

And the way you solve that really hasn't changed.

It's by having that multifaceted approach that's not just data loss revention, that's not just sensitivity labeling, that's not just inside of risk management.

It's all the above all together in a holistic platform and we can talk about that more later.

But anyhow, I just wanted to get on my soapbox there for a second.

And then finally, just to close, I found it funny that it just kind of threw it at the end of the Eddie, you included this bullet.

And by the way, everyone's really concerned about their national cyber preparedness.

The confidence in that continues to erode.

I don't even know what to say.

That's so almost funny in a sad way because it's it's comically correct, right?

I know in the United States have had some major turnover in Seesaw and some concerns about its independence and ability to operate and provide advisories against adversarial nation States and all the stuff we've documented on the show, the concerns with that and other countries have been going through similar things as well.

We continue to sometimes talk about getting tough on cybersecurity and treating it like a sovereign threat.

And then sometimes we get bored and, and get back to talking about really big bombs and missiles and cool kinetic war stuff and forget there's this invisible war on our country's people and companies all of the time.

And it's really being perpetrated by geopolitical actors that are adversarial to the United States.

And we just have a weird kind of come and go attention span to that.

Anyhow, that's a whole other show to talk about.

But yeah, you throw that in there, it's like, yeah, I, I totally understand that that is a fair statement to make.

That's I my confidence in that has eroded too.

Yeah.

And and that, that number is global, right?

So it's, it's really people responding from all over the world in their own countries and not just the United States.

But interesting enough, you know, we've talked about how that cyber attack might be more of a, an attack on a nation.

And over the last few decade or whatever other countries have proposed this and the United States in general has said, no, we don't want to participate in in like a treaty or something like that because we want to continue to have offensive cyber capabilities.

So it's like if we were to have a treaty, then we would lose that capability where we would violate the treaty.

So we actually have turned down agreements or like even talks for an agreement to make that a possibility just mainly because, and, and this is true of like all, you know, collection of data you want to talk about like back doors for like encryptions, you know, so on and so forth.

So it's, it's, it's not new.

It's something that security professionals and, and people who want to keep the data secure versus like people who want to continue to gather that data.

It's that adversarial attitude that has been going on for forever, basically.

Absolutely.

And so hey, before we pivot to our next segment, I was looking through the rundown.

Let me just mention I, I already said Andy and I both work for Microsoft on our field security sales.

I just wanted to add, we do the show outside of work and self fund the show.

So the opinions and attitudes you hear expressed on the show are those of Adam Brewer and Andy Jaw and do not necessarily represent those of Microsoft Corporation.

And with that, let's let's pivot over to AI browsers.

Yeah, AI browsers, this came up actually in like our global security community call, which I'm a part of at Microsoft.

And I didn't realize that AI browsers was even a thing because like everyone builds AI into the browsers themselves, right?

So if you like are using Edge, it has Copilot built in.

If you're using Chrome, it has Gemini built in.

I use on my personal computer, I use Brave and it has this thing called Neo AI which is built on clod.

And so like pretty much I think every browser that you are using, I think there's like DuckDuckGo has a browser and it has like something called Duck AI or something like that.

And so every browser has AI built in, but apparently there are like companies that are building browsers that are are I guess more integrated with AII.

Don't know what the like the draw is.

Open AI Built or building one?

Yeah.

Open AI has 1 arc.

From the browser company, they are like deprecating ARC to build a new agentic or AI or some buzzwordy browser thing.

I mean even to be fair, Edge has like agent mode or AI mode or something.

There's like a different mode you can switch it into where it's more AI driven as well.

So it's not just a sidebar, what we call pilot, but you can make it kind of the primary UI where you're, you're more of a prompt driven browsing experience, which I think I'm missing a little bit of the, the value prop there personally, 'cause I, I'm not completely understanding why you'd want to do that.

But you know, it's sometimes it's hard to rewire our brains when we've been computing and enthusiastic about as long as we have.

Because Andy, I was just talking to someone the other day how the non deterministic nature of AI models is really hard for me because in computing generally, it used to be, you know, 1 + 1 always equals 2.

And with AI, it's more like, well, 1 + 1 usually equals 2.

And that usually is doing a lot of heavy lifting there because it's a probabilistic model, not a deterministic model.

And that means you get different results when you try things more than once.

And also just with the rapid pace of development, something that completely fell on its face, a worthless prompt six months ago can be an incredibly helpful prompt six months later.

I was in a grip chat at work and someone provided some copilot output and I was floored.

I'm like, that's actually useful for this specific use case.

And I've asked it before and it completely failed at that effort.

What kind of prompted you issue?

And it was like the most basic prompt in the world.

It's like, OK, so it just got better.

And so having that mindset on, I need to go back even when I know something has failed spectacularly and try again every three to six months is so unusual.

Cause at the speed computing used to improve and change, and especially in a deterministic computing world, if something was garbage six months ago, it's probably still garbage.

And with this stuff, it's not.

And it's so hard because I, I will try to do things with Copilot and some things it does really well and some things that it struggles with maybe because it's not connected to that data source or whatever.

And I won't think to try it again.

I have in my mind, Yep, that didn't work.

And instead I've got to get in this habit of, well, let's try it again.

Let's see what happens now.

It's been 3 months, maybe there's new connections to new MCP servers, there's new updates to the model, there's this or that.

It has better reasoning.

And it's just, it's, so, it's so hard to wrap my brain around.

So AI browsers hard to wrap my brain around because I'm used to the browser is the thing where you give a URL and it loads the page the end.

And I'm not used to like, well, let's work together on solving what you're trying to do while I'm trying to book a cruise.

OK, well let me, you know, run a whole bunch of queries in the background and aggregate them and bring them to you like, wow, that's cool.

I didn't think to do that and it's it's hard.

So I think we're both going through that.

A lot of our generation that grew up in that world has a hard time with this, where maybe AI natives don't have an easier time because they're used to things changing so rapidly.

And I'm sure there's some reason, right?

I'm sure there's there's people who are using them or want to try them out, have a reason to do it.

And what struck me as kind of interesting was Gartner has a report.

I wasn't able to read the report because you have to be like a Gartner customer.

Gartner.

Yeah, but if you are a Gartner customer you can go and download it and and take a look at it.

The reports titled Cybersecurity must block AI browsers for now.

And that, to me is just the wrong attitude to have.

Like everything wrong with cybersecurity, right?

Yeah, like we get something new or we get this thing and we're our knee jerk reaction is to block it.

You know, when AI came out, the knee jerk reaction was OK, we got block ChatGPT and then also Claude is out and and so you can see like it becomes a whack A mole game, right?

Like I'm sure if you block one AI browser, it's going to there's going to be 10 more that pop up.

But in general, controlling browsers isn't like a new idea.

You know, I think you should already have.

An organizational browser.

Yeah, we, we probably talked about this, maybe we have a show somewhere where we're talking about Edge, but in general, you should have an organization browser.

And and I will argue and and you know, not because I'm not only because I'm, I work for Microsoft, I should say if if I went to another company and and they're Microsoft customer, which a lot of companies are like if you're AG Suite customer, obviously like use Chrome and you know, do the things in within G Suite.

But if you're a Microsoft customer, you use Exchange, Teams, you have, you know, you're using Word, PowerPoint, all that stuff, then you should be using Edge.

If you're in Windows, you should be using specifically Edge for Business.

Well, what we came down to on that, Andy, is we kind of decided it's like the sorting had in Harry Potter.

You're sorted into Hufflepuff or Slytherin or Ravenclaw or whatever.

If you're an enterprise, you're basically you're sorted into your G Suite or your M365, right?

And that should dictate what managed browser you use, where you wherever your managed identity is.

If you have a managed a Google enterprise identity, then sign in to that with Chrome.

If you have a managed Microsoft Entra identity, then sign in to Edge for Business.

They're the same rendering engine other than the covers.

So ultimately where you're going is what is the native integration with my enterprise identity.

And trying to shoehorn that either way in the wrong direction is just extra work for no benefit when the rendering engine is the same gosh darn thing at this point so.

To be fair, you you can.

We're just talking about Edge and Chrome, right?

And, and I'm not talking about like other browsers like Opera or Firefox or whatever, but like Edge and Chrome, a lot of organizations use them, whether you're AG Suite or M365 customer.

Now you can manage Chrome via GPO.

Like you have to import the Gpos.

They're not native to Active Directory.

So you got to import the Gpos.

You can do it through like ACSP for Intune as well, or XML file into import those policies and, and make sure that you, you manage it.

But it it gets more difficult like there you need to have like a, an extension or purview, I believe and other things.

So it gets a little bit harder.

And for what benefit?

I don't see the benefit when like you said, the rendering engine, it's going to render this the web pages the same.

So it's.

Not an app compat thing.

I think for a lot of orgs it's, I mean when Edge was its own rendering engine, it updated very slowly because it used to only ship with Windows updates.

Meanwhile Chrome was decoupled from any other updating service and was shipping updates all of the time.

While you know, that's been different for half a decade, right?

That the Edge chromium based Edge has been out since 2020 or 2019 or something.

So ultimately, sure, if that was a legacy way of thinking and that's fine.

I understand.

I mean, Edge used to suck, let's be honest.

That's why it's switched.

And today it's just why are you making your life harder?

Because that, and that's why I described is really the sorting mechanism should be what is your enterprise productivity and collaboration platform and that should inform what browser you use.

And to also just to just to make sure you know, to our listeners, I'm just talking from an organization standpoint on a personal note, you can use whatever browser do whatever you.

Want.

Yeah, whatever makes you happy.

But from a from an organization standpoint, you know, if you're a Microsoft customer, Edge makes sense, right?

Like you can integrate conditional access seamlessly, Purview DLP policies, session controls through Defender for cloud apps.

You have unified manageability configuration policies through Intune.

You can block like stuff like copilot to page content, ensuring that your company data is not sent to copilot.

You have integration with insider risk management, policy based risk monitoring, alerting, auditing, all that part of the incident, forensics and mitigation.

And I could go on and on.

But the point that I'm trying to make is for Microsoft customers that this is not a point of contention.

Like you, I, I will argue until I'm blue in the face that Edge is by far, if you are Microsoft customer, you use Microsoft.

It is the most secure browser that you can use for your organization, period.

It is the easiest, the least amount of work and the most secure when it comes to data security, right?

And, and this is the biggest thing, right?

Like we talked about data security beforehand in, in the AI security, Edge is going to, is going to be that way.

Like you can require Edge to to have that conditional access policy.

You can integrate with DLP.

It is, it is the easiest way that you can control your company data from not getting exfiltrated.

And it'll integrate with stuff like like an endpoint DLP solution, which again, like Microsoft has something.

But if you have your own, you know, you can, you can tag that on as well.

If you're a Microsoft customer, it's already built in, right?

So, yeah.

And and like you said, Adam, in our previous thing, AI security, AI when you talk about like data exfiltration to AI, it's nothing more than just data security, which you should already be doing.

So if you're concerned about data security within AI, you should get started on data security in general.

And that best time to do that would have been yesterday, but the next best is right now.

So, and you know, like we said this before, where organizations are so overwhelmed thinking about like all the data they have to protect from like, you know, the last year and the previous year that they, they let that be a barrier to just starting.

And you know, we, we recommend that organizations just get started on data security, protecting what is generated now.

And then once that those are in place, you can go back and look at the previous data that was generated.

And additionally, I think a lot of organizations, you can expand on this, Adam, but a lot of organizations don't have that personnel or knowledge to do that.

There are plenty of really good partners in this space that can help you kick off Apoc, you know, kind of give you a jump start if you need to and just get you started in that process.

And there's even like ways to fund that if you need to.

So, you know, don't let any of those like concerns that you have be a barrier to just getting started, because I know that this is a concern of every single person listening to this show.

Perfectly said.

I think ultimately to sum up our point on this, going back to the browser thing first and then tying off on the data security thing, Gartner says cybersecurity must block AI browsers for now.

And what we're saying is that's the wrong mindset with browsers.

You should have one browser to rule them all.

And now I've gone from a Harry Potter reference to a Lord of the Rings reference.

But seriously, you should have.

This is our browser.

This is the only browser you will use unless and only you have a documented exception.

That's how you should run it.

And so it should be.

There's nothing to block because you've already done the work.

You've already established that this is our browser.

The end.

You don't use other browsers.

Now on the data security piece, Andy, I think you said everything beautifully.

The only thing I'll add you touched on, hey, a lot of organs don't have the expertise in house.

And what I would say to that is data security is so is so little of it, so little of data security is a technology problem.

Most of it is in other parts of the business.

It's in compliance, it's in legal, it's in risk, it's in overall management of the company being on board with we are going to do this and leading from the front and leading by example.

And so the best partners to bring in to help with this typically are not like the Super great Microsoft 365 security partners that do a great job.

And we've got some awesome partners there.

And you know what, they can do a bang up job doing data security as well.

But if you want the best, where you go are the firms that are primarily dealing with legal teams and a lot of compliance teams, a lot of risk teams.

I'm talking about Epic Global, I'm talking about Lighthouse.

Those are my top 2 for this because they know how to come in and speak the language of your legal team.

They know how to come in and speak the language of your compliance team and partner with them and help them understand what they're trying to do and speak in their natural tongue.

And then they can translate that to the technology part.

And they can provide excellent guidance on not just how to achieve great data security, but how to achieve great data life cycle management, great records management, all of these things that are all interrelated that help you secure the company, secure your data, get rid of your data when you don't need it anymore, meet your legal needs for discovery and production, meet your protecting the company needs by getting rid of data you no longer need and no longer have a compliance reason to retain.

They can do all of that.

So highly recommend if you're still sitting on the fence or you're trying to get started.

Those are actually some of the best orgs to talk to and I, I promise you, your Microsoft account team can put you in touch with them if you need help getting connected.

And Andy's point again, you know, we gave the disclaimer, but for awareness, Microsoft does invest in customers that are already licensed with the technology and are not using it.

There are funding mechanisms available to bring in partners to help advise on how to get stuff turned on and operational.

There are internal resources if you have a unified agreement.

There are workshops.

There are cloud solution architects that can help if, even if you don't have a unified agreement, if you just literally have 250 Microsoft 365 licenses or more, you are entitled to help from the Fast Track Center.

And they can provide guidance on how to get stuff turned up too.

So the point is, there are multiple layers and levels of investment from Microsoft to help you get this stuff turned on.

And we love to see customers do more with data security because it's not just AI security.

AI security is just one outcome from it, but you get so much more when you do it because this stuff's been around for a long time.

It's just it's never been as top of mind as it is right now to get it deployed and get going.

Well said, Adam.

All right.

Our final article that I just wanted to touch on, you know, like it's, it's interesting because some of those old vulnerabilities and old Attack Attack vectors are still lingering.

You know, we talked about turning off that or roasting a few weeks ago and how RC 4 is getting deprecated and so shout out to the Mandiant team, which is part of Google.

They put out this great guidance Then I'll put in the show notes on net and NTLNTLMNTLM V1 sorry, stumbling over that there.

And it has a comprehensive data set of rainbow tables and the hash values to under score the urgency of migrating away from this outdated protocol.

And the reason why they put this out is even though NTLM V1 has been deprecated and known to be insecure since at least 2012, Mandiant consultants continue to see its use in active environments.

And so the the release of the rainbow tables is really to help security professionals demonstrate and kind of prove out to maybe leadership if, if there's like some sort of pushback against disabling it.

So you can demonstrate the insecurity of this NTLM V1 by just saying, hey, look, they literally have hash tables that attackers can run through it and crack your, your encryption and get the keys.

So really there's, there's not a whole lot to do here.

Definitely make sure that you have policies.

You can go and look at GP OS or Intune and make sure that you are forcing NTLM V2 responses only.

So right at the end of the article, it walks you through which GP OS to go to.

And you can also probably translate that to Intune if you need to for endpoints.

But yeah, turn off NTLM V1.

It's one of those things that just kind of pops up and maybe you join the company and you don't know the GPO state or whatever because there's a bunch of legacy GP OS.

But yeah, just double check.

Make sure that you are forcing NTLM V2 only.

I immediately had the meme from dodgeball pop into my head.

That's a bold strategy, Cotton.

Let's see if it pays off for them.

I love it.

I love stuff like this.

I used to work at an organization and we had this vice president over us and he was so change averse, so risk averse.

If anything potentially had any user impact, he would completely push back, pump the brakes, not let us make the change until we could demonstrate there would be no impact or we had to give detailed explanation of exactly what the impact was.

I mean, that's good practice is to understand the impact of the high level, but I'm talking like an obscene amount of detail on every possible outcome.

It was really very painful.

And I can I could picture this VP and us going to him saying we need to turn this off and getting the pushback and saying, OK, watch this.

See these rainbow tables here that are posted publicly on cloud.google.com?

I can run these against this right now.

Watch me do it.

Aha.

I just came up with these credentials.

I'm able to now gain access because this is so insecure.

They're these pre computed rainbow tables out in the wild now.

I think it's a great way to help get those laggards over the line.

And to your point, Andy, most of them are not, it's not intentional, it's accidental.

And that's just the added firepower you may need to push a overly conservative or cautious leader to sign off on making the change and getting it turned off.

So I actually love the boldness of that and including the rainbow tangos that rainbow tables in there.

That's really cool.

You know, we talked about on this when we're talking about the RC4 change, which you know, we pointed out Microsoft has recommended disabling for 15 years or whatever it was.

But the change we talked about on this show was that it would now be disabled by default and future installations of Windows and Windows Server.

And this is another one of those things they could see same same thing happening to nothing to share today.

But as we continue to see that secure future initiative, Dr.

secure by design, secure by default design ethos, we will see more of these insecure settings like this just ships turned off.

And maybe it already does.

See, and this is where I can be ignorant.

I don't know the state of every default setting off the top of my head in Windows Server.

But if it's not already disabled by default, it could be.

And maybe it is.

And maybe this is just turned on in legacy environments because people's got old stuff running around.

I mean, Lord knows we've got plenty of old Windows servers sitting around that probably shouldn't still be in production, but they are.

And that's where stuff like this comes in.

Anyhow, thanks Bandy and and love posting the rainbow tables.

That's clever and cool.

And if you, you should probably, you know, do a double check in your environment, make sure this is disabled across the board.

And if not, some a really straightforward guidance to making it happen.

Yep.

All right.

Well, that's our show for this week.

Thanks for watching and listening.

As always, our contact information, along with the links to the articles that we talked about will be in the show notes if you want to review them.

If you have any questions, topics you want us to talk about in the future, just reach out to us by e-mail.

Thanks and we'll talk to you next week.

Thank you for listening to the Blue Security Podcast.

Please check out the show notes, catch up on episodes you may have missed, and subscribe so you don't miss any future episodes.

Find Andy on Twitter at a Jaw Zero and Adam at AJ Brewer.

See you at our next episode.