In more than 90% of breaches, preventable gaps enabled the attack.
Steve Elovitz leads Unit 42’s North America Consulting practice. His team responded to 750+ major cybersecurity incidents in 2025. In this episode, we unpack the 2026 Unit 42 Global Incident Response Report and what these investigations reveal about how attackers are succeeding.
What you’ll learn:
How AI compressed attack timelines from 5 hours to 1 hour for data exfiltration
Why identity weaknesses played a material role in 90% of investigations (not vulnerabilities, not zero-days)
How supply chain risk expanded beyond code to OAuth tokens and SaaS integrations (up from 6% to 23% of cases)
What nation-state actors are doing to avoid detection (living on network devices, applying for jobs to get credentials)
The 5 highest-ROI security controls based on 750 real-world breaches
Steve brings 15 years of incident response experience from Mandiant, Booz Allen, and PwC. He’s been on the front lines during some of the worst days in security teams’ careers.
Fair warning: this conversation gets technical. We dig into defense strategy, attacker TTPs, and what’s actually working in the field versus what just looks good on paper.
Timestamps:
00:00 – Cold open: Prevention vs detection
00:33 – Introduction
02:03 – What pulling the fire alarm looks like
06:41 – The human cost of breaches
09:30 – How AI accelerates attacks (5 hours to 1 hour)
16:25 – Identity as the new attack surface (90% of cases)
23:26 – Supply chain risk and SaaS security
27:10 – Nation-state stealth tactics
30:54 – The preventable gaps paradox
32:41 – The 5 controls that actually work
36:01 – Unit 42’s role in incident response
38:00 – Closing thoughts
Read the 2026 Unit 42 Global Incident Response Report: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
Email the show: threatvector@paloaltonetworks.com
Credits:
Host: David Moulton
Executive Producer: Michael Heller
Production Team: Kenny Miller, Joe Bettencourt, Virginia Tran
Editor & Audio Mix: Elliott Peltzman
#Cybersecurity #IncidentResponse #ThreatIntel #AI #IdentitySecurity #CISO
