Episode
Your Security Tools Can Be Used Against You
- Published
- Aug 25, 2026
- Duration seconds
- 971
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/cyberside-chats-cybersecurity-insights-from-the-experts-7144591/episodes/your-security-tools-can-be-used-against-you/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cyberside-chats-cybersecurity-insights-from-the-experts-7144591/your-security-tools-can-be-used-against-you.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
On the first night of a remote internal penetration test, a bank’s own vulnerability scanner tried to log in to our computer, using a highly privileged account. That was all it took. We had started with nothing: a foothold on the internal network, no credentials, no domain access. A day later we had domain admin and the password hashes of every user in the bank, a complete takeover built out of the bank’s own security tooling. Sherri Davidoff and Tom Pohl walk through the whole chain: why we relayed the scanner’s login instead of cracking it, the “low severity” SMB signing finding the entire compromise turned on, and the misconfigured certificate template that handed over domain admin. Then they widen the lens: the breach-simulation platform that had a domain admin account of its own, the backup server with administrative rights nearly everywhere, and why the tools you bought to watch your network are the ones most worth attacking. Plus what to actually change: not just what your scanner finds, but how and to what it authenticates. Key Takeaways: Your security tools are among the most attractive targets on your network, because you gave them the keys. Scanners, backup, EDR, and breach-simulation platforms routinely hold domain admin and reach every host. Inventory those privileged service accounts and know exactly what each one can reach. Check how your scanner authenticates — not just what it finds. Credentialed scanning that will authenticate to an untrusted or unknown host, without signed/mutual authentication, hands out privileged credentials to whatever answers. Ask your vendor how to enforce this and verify the setting. “Low / informational” findings are the pivot. Missing SMB signing is the classic example: it barely rates in a report, and it’s the hinge the who…