Most of what Damon Fleury described on this episode happens out of sight, in places most people never visit. His job, as he put it, is to get there first and tell the people whose data is sitting there.
“So let’s go close those doors before they can get there.”
Damon Fleury, at 7:18
Damon is the chief product officer of SpyCloud, the Austin company that recaptures data from the criminal underground and turns it into alerts and automated fixes for the companies it belongs to (SpyCloud). He joined in 2022 as vice president of strategy and has run product since that November (LinkedIn). Before SpyCloud he spent nearly five years at CyberDefenses, most of them as chief technology officer and vice president of cybersecurity services, a managed security services provider in Round Rock, Texas, where his team grew to more than 50 people and worked on election security among other things. His career started in 1995 as an applications engineer at Dialogic and ran through embedded systems, network stacks and network security, with stops at Mirage Networks, TippingPoint under 3Com and then Hewlett-Packard, Cache IQ and NetApp.
SpyCloud’s own description of the work is short. It turns recaptured darknet data into identity threat protection that helps enterprises stop account takeover, session hijacking, ransomware and fraud (SpyCloud). A few weeks before we recorded, it published its 2024 Malware and Ransomware Defense Report, and that report is where this conversation spends its middle (SpyCloud).
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security reviews enterprise buyers run, and questions about stolen credentials come up in almost every one of them. Jon McLachlan and Sasha Sinkevich co-hosted this one. We recorded on October 31, 2024, and the episode aired on January 7, 2025. SpyCloud came back to the show a year later, when Trevor Hilligoss, now its chief intelligence officer, joined us on episode 86, and the two episodes read well together.
One of many
Jon opened with a simple question. Was Damon a security person?
“Wow. I’ve worked in security a long time. So I guess by most definitions, I would, if I was somebody looking at my resume, I would call me a security guy.”
Damon Fleury, at 0:51
Then he qualified it, the way people who have done this for thirty years usually do.
“You can’t know everything about security. It’s such a massive landscape. I would hate to say I’m the security guy, but I’m one of many.”
Damon Fleury, at 1:03
“Yeah, growth mindset. I love that.”
Jon McLachlan, at 1:12
Damon grew up mostly in San Antonio, has lived in Austin for most of his adult life, and spent a little time in the Bay Area about twenty years ago. He was broadcasting from Texas, where SpyCloud is headquartered.
Hard problems
What pulled him into security wasn’t security. It was difficulty.
“Yeah, well, for me, the interest in security was really just an interest in solving really hard problems, right?”
Damon Fleury, at 1:24
The path he described matches his LinkedIn almost step for step. First code, then embedded systems, then the networking software underneath everything else.
“Eventually, I got into embedded systems computing, those were great problems. Then, eventually, building network stacks, and then eventually trying to secure network stacks and network products.”
Damon Fleury, at 1:39
Those years included Windows CE products at Eclipse International, an embedded TCP/IP stack at Surgient Networks, the security rules engine at Mirage Networks, a network access control company that Trustwave later bought, and product management for TippingPoint’s intrusion prevention system. TippingPoint went to 3Com in 2005 for $442 million, came to Hewlett-Packard with 3Com in 2010, and went to Trend Micro in 2015 (Wikipedia). The hard problems stayed. What changed was who they were for.
“And certainly, once I got into security, the aspect of solving a problem that truly helps people and tries to protect people, that was also really enticing for me.”
Damon Fleury, at 1:57
These days, he said, he works more at the business level than the coding level. The problems haven’t run out.
A layered economy
Sasha asked what Damon finds most interesting in security today.
“Based on your career path and based on other threats, what do you see as the most interesting aspect of cybersecurity today?”
Sasha Sinkevich, at 2:24
Damon’s answer was the subject of the whole episode. The crime that reaches most companies doesn’t look like a heist movie, with one crew doing months of research for one big job. It looks like an industry.
“It’s not that way at all. It’s a layered economy where people come in, and for their day jobs, they perpetuate crime, and they build such an amount of data that gets shared with others, gets shared amongst themselves.”
Damon Fleury, at 3:02
The people in it have different jobs. Some write the malware, some rent it out, some spread it, some sort what it steals, and some buy the access and use it. Security researchers have names for several of those roles, from ransomware as a service to the initial access brokers who specialize in breaking into networks and selling that access to other criminals. Damon said he first saw the whole picture at his last company.
“I discovered it in the last place I worked, and it’s certainly something that attracted me to SpyCloud when I came here.”
Damon Fleury, at 3:17
His colleague Trevor Hilligoss made the same point from the intelligence side on episode 86, where everything in the criminal underground is for sale as a service.
A trillion-dollar economy
What bothered Damon was the scale, and the fact that it keeps adapting.
“Like, how do we stop a trillion-dollar economy that’s built off of damaging the rest of the society and economy?”
Damon Fleury, at 3:36
The trillion is his figure for the whole criminal economy, and estimates of it vary widely. The part reported to the FBI is smaller and still growing. The Internet Crime Complaint Center received 1,008,597 complaints in 2025 with $20.877 billion in reported losses, a 26 percent increase over 2024, and it says ransomware losses in particular are artificially low because some victims don’t report a loss amount at all (FBI IC3).
“It truly is in the shadows, but it’s very real, and it’s actually affecting all of us every day.”
Damon Fleury, at 4:03
The adapting part matters as much as the size. As soon as defenders fix something, he said, the members of this economy work around the fix. That’s why he called it an intractable problem, and why the rest of the conversation is about getting ahead of it rather than solving it once.
What SpyCloud does
Jon asked what SpyCloud does better than anyone else. Damon pointed back at the same economy.
“And what we are really great at is understanding how to gain access to that information and then bringing it to our customers, companies primarily, that can then use it to immediately remediate the damage that can be done with that information.”
Damon Fleury, at 4:31
The goal, in his words, goes beyond telling someone that something bad happened. It’s automated remediation, so the stolen information stops being useful to the person who stole it.
That’s a lie
Jon tested his understanding with an example. A ransomware crew copies a company’s data before encrypting it, and the copy ends up for sale.
“Maybe that ends up for sale somewhere in some forum or a dark website hidden behind Tor services or something like that.”
Jon McLachlan, at 5:01
Damon said that’s exactly right, and added the part victims most need to hear.
“We collect petabytes and petabytes of data that was collected through ransom events. And they often say if you pay the ransom, they won’t share it. That’s a lie. They share it. The data is out there. Once it’s out there, others get it.”
Damon Fleury, at 5:16
SpyCloud’s report has a number that fits. Of the organizations it surveyed, 62 percent had paid a ransom in the previous year, up from 48 percent, and only about a third of those fully recovered their data (SpyCloud). Paying buys less than the note promises. Our guide to backups that survive ransomware covers the alternative, a restore you’ve already tested, so the payment never becomes the only way back.
Before the ransom event
The more useful part of SpyCloud’s work, Damon said, happens earlier.
“But we’re just as focused on the thing that happened before the ransom event. So most of those ransom events happen when they’ve already gained access to your environment through a phish or through a malware event.”
Damon Fleury, at 5:34
If a company learns about that first access in time, the rest of the attack never happens.
“And so if you can find out that these bad guys did something to get a credential or get access to some part of your network, and then you can automatically know this and shut it down, then you can stop that ransom event from happening to you.”
Damon Fleury, at 5:47
“I would love to be more proactive in that space instead of just reactive all of the time.”
Jon McLachlan, at 6:03
Sixty-one families
Jon asked what the signal actually looks like. Damon said it isn’t a guess. It’s the stolen data itself.
“We monitor and track the data that’s stolen by 61 families of malware right now.”
Damon Fleury, at 6:29
Those families are infostealers, malware built to copy whatever a computer holds and send it to the people who rent the malware out.
“It could be usernames, passwords, session cookies, crypto wallet addresses, credit card information. It steals everything in less than a minute and shoves it up to the darknet, to the command and control, or often called the panel.”
Damon Fleury, at 6:43
The panel isn’t slang Damon made up. When the Justice Department seized the domains behind the LummaC2 stealer in May 2025, its announcement described them as “also referred to as user panels,” the login pages where criminal customers accessed and deployed the malware (Justice Department). SpyCloud’s research from that fall puts numbers on the haul. As many as one in five people have been infected by an infostealer, and each infection exposes anywhere from 10 to 25 or more business application logins on average (SpyCloud). In SpyCloud’s September 2024 announcement of that research, Damon called infostealers “the go-to tool for cybercriminals” (SpyCloud).
Close those doors
Because SpyCloud gets copies of the same logs, it can tell a company exactly who was hit and what was taken.
“So we can tell you without a doubt that somebody in your company, or somebody using an email address or a website in your company, experienced a malware infection, and all these access details and all these details about that individual were stolen, and that the bad guys have it and they’re going to soon be using it.”
Damon Fleury, at 7:03
That’s the line this page is named for. The stolen log is a list of doors, one for every app the person was signed in to, and the work is closing each one before somebody walks through it. Wiping the laptop closes none of them, because the passwords and session cookies have already left. Our blast radius playbook covers what to do when a door was already used.
Counter-espionage as a service
Jon heard something familiar in all this.
“That’s super interesting. This is almost like business espionage type stuff.”
Jon McLachlan, at 7:22
“Yeah, well, if it’s all within the criminal community, yeah. And so certainly the criminals are performing business espionage, and we’re trying to figure out what they’re doing and stop them.”
Damon Fleury, at 7:26
“Right. Right. It’s the counter-espionage as a service.”
Jon McLachlan, at 7:34
“There you go. Yeah. We like to consider ourselves spies. It’s not quite that dramatic.”
Damon Fleury, at 7:37
“Cue Mission: Impossible theme song.”
Jon McLachlan, at 7:41
Jon apologized for not getting the rights to the theme. The comparison holds up better than the soundtrack. Criminals collect intelligence on companies at scale, and someone has to collect it back. That’s the work our own counter business espionage team does for companies whose ideas are worth stealing.
A typical day
Most of Damon’s days, he said, are spent with customers, and lately that has meant travel.
“Well, for me personally, a lot of my days are talking to customers.”
Damon Fleury, at 7:49
He described a customer base that had gone global, from large MSPs to medium-sized companies, each seeing crime from its own angle. The rest of his time goes to the product roadmap, and to analytics on the data.
“And then much of my time is also, of course, working with our product team within SpyCloud and building the roadmap, building the requirements for these products, and helping us to take us, helping our entire company to take us to the next level, the ability to use and provide analytics around this data so that we can draw better conclusions and we can help people predict the next crime or stay ahead of the next crime.”
Damon Fleury, at 8:24
What did the criminals get?
Sasha asked what customers are telling Damon, and named the attacks that are getting cheaper.
“SMS phishing is a fairly old-school attack, but it hasn’t been really solved due to many different reasons.”
Sasha Sinkevich, at 9:11
SMS phishing and impersonation are getting easier, Sasha said, because crime follows the economics, and people will run an attack once it pays. Damon said customers name the same list everyone reads in the reports, phishing, business email compromise, ransomware and attacks on infrastructure. Then they ask him a harder question.
“And then, you know, because of where we approach the problem from, what we hear is, okay, we know this thing happened, and where we know this thing happened to a partner company or to a law firm that’s connected to us, but we don’t know what the criminals got, and we don’t know that we’re fully protected from whatever it is that they learned.”
Damon Fleury, at 10:00
His favorite part of those conversations is turning the answer into something that runs on its own.
“Will it feed into your orchestration? Is it a toolkit that I can provide that would automatically change your directory services? Is it something that can directly integrate with your email systems?”
Damon Fleury, at 10:35
A month before the recording, SpyCloud had launched SpyCloud Connect, a hosted service that builds and maintains automation workflows between its data and the tools a security team already runs. Damon was quoted in the announcement promising “an endless number of integrations available to take instant action” (SpyCloud). The partner and law firm example matters for founders too. A vendor’s breach is your exposure when the vendor’s people log in to your systems, and buyers ask about exactly that in security reviews.
Disrupt this cycle
Some of those customers, Damon said, know the underground as well as SpyCloud does.
“And a great conversation, because some of our customers, when we get to the large MSSPs, they have people that are very familiar with the darknet, that live in these channels that we’re also in.”
Damon Fleury, at 11:04
The conversations become a community effort, he said, among people with the same goal.
“And we’ve built fantastic relationships with people that we all have the same, at the end of the day, the same mission: we want to disrupt this cycle of cybercrime.”
Damon Fleury, at 11:16
They’re also where SpyCloud finds a lot of its product ideas.
Five countries in five days
Jon asked about his best day at SpyCloud, a little over two years in. Damon picked a trip.
“We took a trip to Europe in the middle of this year, in the fall, and it was a kind of a whirlwind trip where we hit five countries over five days and visited something like two or three dozen customers, lots of meetings.”
Damon Fleury, at 11:47
The best of those days was in Brussels, with government and large enterprise customers. What made it good was the scale of the question.
“It’s how do we really help you understand how to protect the entire country, right?”
Damon Fleury, at 12:18
Some of the agencies he met, he said, have a mandate like CISA’s in the United States, and in a smaller country, laws that allow them to control things like what their service providers do.
“And so you can do some really interesting things that can protect an entire citizenry with some of the controls that they have access to.”
Damon Fleury, at 12:38
Damon didn’t name the agencies. Belgium was one of the partners in a takedown announced two days before we recorded. On October 29, 2024, the Justice Department joined the Netherlands, Belgium, Eurojust and other partners in Operation Magnus, against the RedLine and META infostealers (Justice Department). It didn’t come up on the tape, but it’s the same work at the scale of a country.
Both extremes, nothing in the middle
Sasha raised the imbalance every defender feels. Criminals share data freely, and defenders don’t.
“The point is, the criminals have been sharing data between the groups, between each other, but on the defense side, we’re not always as proactive in sharing that information.”
Sasha Sinkevich, at 13:15
Sasha’s example was the vulnerability database. A CVE usually becomes public after the patch, which leaves a gap between when the flaw is found and when everyone else hears about it. Damon said SpyCloud is a big fan of sharing, and listed what it does: research programs that give community researchers access to its data, sharing circles built around specific causes, and people on the Ransomware Task Force.
“We have many members that are on the Ransomware Task Force.”
Damon Fleury, at 14:13
The Ransomware Task Force is a cross-sector group convened by the Institute for Security and Technology, with members from government, industry and civil society. Days before the Colonial Pipeline attack in May 2021, it published a report with 48 recommendations for governments and industry (Institute for Security and Technology). Damon also described the part of SpyCloud’s work that isn’t for sale.
“But when we see a crime that happens, we also have a significant responsible disclosure program, and we’ll reach out as much as we possibly can to organizations that are the victims and probably are not yet aware that something has happened.”
Damon Fleury, at 14:23
Then he named the harder problem. The issue isn’t too little data. It’s that nobody has a good way to share the part that matters.
“Because I think we can all say we feel like we share nothing, but you can get plenty of feeds of IP addresses and email addresses. You can be inundated with data in a moment.”
Damon Fleury, at 15:06
“we have both extremes, but nothing in the middle.”
Damon Fleury, at 15:29
He said he didn’t have a great answer, only that it’s worth working on. The middle he described is specific and actionable: enough to act on, sent to the people who can act, without burying them. A coordinated vulnerability disclosure is one version of it for software flaws. A notice that a named employee’s laptop was infected, with the list of apps it exposed, is the version for stolen identities.
Spoiler alert
Jon brought up the report SpyCloud had just published. Damon explained how it’s built, from two directions at once.
“One, we survey CISOs and gather their feedback about what’s happening with malware in your world, and what’s happening with ransomware in your world, and are you still impacted by these things? Spoiler alert, yes, they’re very impacted by these things.”
Damon Fleury, at 16:17
The second direction is SpyCloud’s own recaptured data, cross-referenced with the same organizations. The headline number came from the survey.
“Some of the key takeaways that we’ve gotten from the data is that 75% of all organizations are impacted by ransomware in the last 12 months. That’s up from about 60% the prior year.”
Damon Fleury, at 16:50
The published report is more precise. 75 percent of organizations were affected by ransomware more than once in the previous 12 months, up from 61 percent, and 92 percent were affected at least once, up from 81 percent. “Affected” means the team spent resources responding to an attempt or an attack, which is the distinction Damon drew on the tape. Only 8 percent weren’t hit at all, down from 19 percent (SpyCloud).
The report also found a gap between leaders and the people doing the work. 91 percent of leaders were confident they could prevent a full-blown ransomware attack, against 54 percent of security operators, analysts and incident responders, and stolen cookies that enabled session hijacking ranked third among the ways ransomware got in, behind phishing and third-party access (SpyCloud).
Predicting the ransomware
The cross-reference is what lets SpyCloud say something useful before an attack. Damon described models that connect a particular theft to a likely ransom.
“And then there’s a variety of other stats at this program that start to show that we’ve been able to build predictive models looking at this massive amount of data that show if we see certain things happen in the criminal underground, a certain malware infection that happened to get access to an administrator credential or to an SSO portal or something along those lines, then we can actually predict the ransomware gangs will choose that information to try to attack that business.”
Damon Fleury, at 17:12
The report gives the pattern a number. Nearly one-third of the companies that had a ransomware event in the previous year had at least one infostealer infection in the 16 weeks before the attack (SpyCloud). An infected admin’s laptop is a warning with a deadline.
“And so all of that together, we can start to paint a picture of: malware infections can be directly connected to these follow-on attacks.”
Damon Fleury, at 17:41
Healthcare and insurance
Jon asked whether attackers go after particular industries, perhaps because they share the same software.
“Do you see attacks being targeted by specific verticals, for example, like healthcare or insurance?”
Jon McLachlan, at 17:51
“So when we connect it to industry, I think the two you called out are the most targeted, by a pretty wide margin.”
Damon Fleury, at 18:15
The data shows the targeting, Damon said, but not the reason. His theory was that these are critical industries that pay when they’re hit. Jon put it more plainly.
“But I imagine that most of those larger ones, the ones that scale, the ones that present, like, a clear and persistent threat, are just businesses.”
Jon McLachlan, at 18:55
That’s the layered economy again, from the attacker’s side of the ledger. A crew that scales picks the targets with the best return. For a startup selling into a hospital, it’s also why the buyer’s security review is so long, and our post on the health system security review your BAA won’t pass walks through what that team asks.
Mods, skins and a free virus scan
Sasha asked the question every defender wants answered. How does the malware get on the computer in the first place?
“What is the most successful entry point for a malware injection?”
Sasha Sinkevich, at 19:21
“Yeah, that’s a great question, and unfortunately, not one that our data shows the answer to.”
Damon Fleury, at 19:26
A stolen log shows what was taken, Damon explained, not how the malware arrived. Anecdotally, SpyCloud sees vulnerabilities and phishing links, and something many people wouldn’t guess.
“Very commonly, you see them in mod packages for video games, or skins, when you’re trying to get that new skin for Call of Duty that maybe wasn’t a great, great choice.”
Damon Fleury, at 20:05
He said a lot of that activity targets universities. Then he described the delivery method that surprised the hosts, ordinary pop-ups paid to install stealers.
“They pretty much will, like, put these pop-up ads, like, hey, we’ll do a free virus scan. When they do that, they literally run malware, steal everything they can off the computer, and then delete that.”
Damon Fleury, at 20:38
His example was LummaC2, one of the most popular stealers of the previous year or two, spread through affiliates who push gray software and get paid per install.
“Like, nobody really wants these ads, but people click on them all the time. They still work.”
Damon Fleury, at 21:08
The industry calls that gray software a potentially unwanted program, and the ads that carry it malvertising. Lumma Stealer itself is malware as a service, distributed by affiliates through phishing emails, malicious ads posing as legitimate downloads and compromised websites, and first seen on cybercrime forums in 2022. What it steals is marketable on its own, Damon said, so the point is the data, not the computer.
A chain attack
Sasha put the pieces together.
“Yeah, in general, the most successful attack is a chain attack.”
Sasha Sinkevich, at 21:41
Sasha’s point was that one stolen log does the attacker’s reconnaissance for them.
“And it sounds like what you guys help with specifically is to prevent the initial scoping, because by stealing all of the information from the system, you would perform the initial scoping of what it is that I can then dig deeper into.”
Sasha Sinkevich, at 21:57
Damon agreed. A stealer log tells the next criminal in the chain which apps the person uses, where they log in and what they can reach, which is exactly what an initial access broker sells.
Four to 500 breaches a week
Malware was the focus because of the report, Damon said, but it’s only one source.
“We don’t talk about it as much as we used to, because we’re tired of the topic, but we discover upwards of four to 500 new breaches every single week and ingest all of that data, billions and billions of identities every month that get stolen, identity information.”
Damon Fleury, at 22:34
Phishing is the third source, and SpyCloud collects the back end of those too.
“We collect data when people click on that email and accidentally give their Netflix credentials and credit card number to the bad guys.”
Damon Fleury, at 22:50
Breaches, stealer logs and phishing kits all end up in the same economy, which is why SpyCloud’s report says the scale of identity exposure keeps growing even as companies add defenses. 61 percent of the breaches it tracked in the previous year were malware-related, responsible for 343.78 million stolen credentials (SpyCloud).
Eighty million infected computers
Sasha said the statistics point the wrong way.
“If you look at all of the statistics, the number of successful attacks is on the rise. It’s not on the downtrend.”
Sasha Sinkevich, at 23:23
Damon agreed and gave SpyCloud’s own count for the year.
“This year, just talking about malware, we will process ourselves 80 million infected computers this year, we’re on track for, which is almost 2x our largest year prior to this.”
Damon Fleury, at 23:31
“And we deploy all these defenses and they help, but then more bad actors engage, and more attempts and more workarounds get deployed.”
Damon Fleury, at 23:54
That’s an honest description of an arms race, and it’s why the episode keeps returning to speed. The defenses work, and the economy adapts, so the advantage goes to whoever acts on the stolen data first.
The worst day they can imagine
Jon asked about the hardest day. Damon said he hadn’t had one at SpyCloud. The hardest days came before, at the managed security provider.
“I spent about five years running an MSSP. And in the early days of that, I did a lot of incident response and was the incident response commander.”
Damon Fleury, at 24:39
“And you are literally living through an individual or team’s worst day they can possibly imagine, when you see an entire hospital, one of the largest hospitals in the world, you’re not able to provide care, right?”
Damon Fleury, at 24:50
He described leaders scared for their jobs and for the people involved, and a team trying only to get them through the day. It was, he said, the hardest work of his life and among the most rewarding.
“And some of the most stressful, psychologically challenging, and most rewarding things I have ever done in my life.”
Damon Fleury, at 25:19
The first hours of an incident like that go better with a plan someone has already rehearsed, a point our blast radius playbook makes with real cases. A named incident commander, decided before the bad day, is one of the cheapest controls a company can have.
No backup for that
Jon said a hospital carries an emotional weight technology doesn’t. Sasha took it toward engineering.
“We don’t really talk often about the availability component of the CIA triad.”
Sasha Sinkevich, at 26:18
An airplane has redundant systems, Sasha said, and most critical software doesn’t. Damon agreed, then said attackers know redundancy is the wrong place to look. They go after the things nobody thinks of as critical. Damon’s example came from the pandemic, during his incident response years.
“But at that moment, if they attacked an organization whose sole job was moving equipment between hospitals in certain regions, they had no choice but to pay that ransom, because you’re not just hurting one hospital, you have the side effect.”
Damon Fleury, at 27:20
“There’s no backup for that. It’s not a machine that needs a backup. It’s communication that needed to happen to enable things that did save lives.”
Damon Fleury, at 27:35
Damon said the organization had no strong security until his team helped it stand back up and build some. Availability is one leg of the CIA triad, and the lesson generalizes. The dependency nobody lists as critical is the one an attacker can hold for ransom.
Where elections are vulnerable
Damon also spent years on election security at the same company, and he said the same logic applies there.
“And I actually spent quite a few years doing election security, and you spend the same, you do the same thing there, where the real threat in election security has very little to do with the voting machines.”
Damon Fleury, at 28:00
“And changing one voting machine does not change an outcome in the United States, but change the distribution of votes, or change how those things get moved from one place to the other.”
Damon Fleury, at 28:10
Sasha described why it’s so hard to protect.
“Every state, every county has its own machines. It runs its own software, and there is no really unified way you could necessarily control it.”
Sasha Sinkevich, at 28:41
Damon’s point and Sasha’s point are the same one from two directions. The vulnerable part of a system is usually the connections between its parts, and the more parts a system has, the more connections there are to protect.
Eye-opening, not frightening
Sasha asked how SpyCloud gets past the oldest objection in the business, that security is overhead.
“But going back to the importance of the work that you guys do in general, security and cybersecurity solutions are seen as an overhead.”
Sasha Sinkevich, at 29:00
Damon’s answer was to show people their own data. Almost every company already has some in the criminal underground.
“It is, unless you’re brand new to the internet, you’ve only been out there six months, we have way more data than you can possibly imagine about your employees, maybe about your business.”
Damon Fleury, at 29:30
What he said next is the tone he wants the whole product to carry.
“And we hate the idea that we know this is frightening, but we don’t want it to be frightening. We want it to be eye-opening.”
Damon Fleury, at 29:56
“you get past the overhead conversation when you’re faced with the real data about your business.”
Damon Fleury, at 30:19
“When you are a painkiller versus a vitamin, you have a viable solution in your hand.”
Sasha Sinkevich, at 30:35
Sasha added that a company is a collection of people with lives of their own, which is what the data is really about. The same approach works for a founder making the case to a board. A slide that shows what’s already out there gets a different reception from a slide about what might happen, and our post on the security slide your board deck is missing shows how to build one.
A tricorder
Damon reached for Star Trek to describe what SpyCloud does for a company.
“Agree. I think of us like the tricorder on Star Trek, to use a brand I shouldn’t probably be using.”
Damon Fleury, at 30:52
A tricorder is the handheld scanner the crew points at a patient to find what’s wrong. In Damon’s version, the patient is the company, and the scan finds the stolen data it didn’t know about.
“And then we say, hey, this thing is out there. This is, your B12 is too low.”
Damon Fleury, at 31:07
The findings are usually significant enough, he said, that a company decides it needs to know. A scan that only frightens people doesn’t help. A scan that ends with a list of fixes does.
Check your exposure
Jon asked the founder’s version of the question. If he had just closed a Series C and was starting to get attention, how would he find out what’s out there about his company?
“Let’s just say it’s xyz.com.”
Jon McLachlan, at 31:39
“Go to spycloud.com. There’s a link right there on the top of the page for Check Your Exposure.”
Damon Fleury, at 31:57
You enter a company name for a little data, Damon said, then verify an email address for a lot more, and SpyCloud will walk through the specifics with you. The tool is still there, at Check Your Exposure on SpyCloud’s site. Trevor Hilligoss gave the same advice on episode 86, and recommended checking personal email addresses too.
Jon closed the exchange with a compliment for how Damon talks about all this, calm and positive without shrinking the problem. It’s a fair description of the whole episode.
Big glasses and architecture school
Jon asked the show’s usual question. Would Damon meet his younger self, and what would he say?
“I can see how young and silly I used to look, and make fun of my glasses.”
Damon Fleury, at 33:14
He’d take the meeting, he said, but he wasn’t sure he’d give any advice. He doesn’t regret the choices he’s made, and he’s watched too much science fiction to want to change them.
“I’ve watched, again, probably too many Star Trek episodes, where you say something, you change the ripples of time, right?”
Damon Fleury, at 33:35
Jon asked whether he’d studied computer science. He had, eventually.
“I was in an architecture school, and I switched after about a year and a half, when my professor said, yeah, you’re not so good at this art thing. Maybe you should go do something else.”
Damon Fleury, at 33:57
His LinkedIn lists the University of Texas at Austin (LinkedIn). The architecture school gave up a student, and the network security industry got thirty years of one.
This stupid password problem
Jon asked what Damon wished someone would build. He started with science fiction, teleporters, perpetual energy and time travel, and then got serious.
“But I would love it if we could solve this stupid password problem. And I would love it if we could have secure logins that could not be compromised.”
Damon Fleury, at 34:53
He said the ways to do it exist, but they require so many things to change that he didn’t expect it to happen. Meanwhile he watches the same failure every day.
“And I just watch all day long criminals just taking advantage of this same stupid problem over and over again.”
Damon Fleury, at 35:06
“Same. I’m a firm believer that you are not a password.”
Jon McLachlan, at 35:25
Then Damon admitted he checks his own history.
“So, funny thing is, well, I’ll search myself in our database all the time, and I’ll look back at my own history of passwords.”
Damon Fleury, at 35:39
He said there was a period he’d rather pretend didn’t exist, when he reused passwords like everyone else. Jon pointed out that before password managers, everyone came up with patterns. Passkeys are the closest thing yet to the secure login Damon asked for, and our post on device-bound credentials covers what they fix, and the stolen session they still leave open.
Not if, but when
Sasha closed the episode by thanking Damon for aligning SpyCloud’s roadmap with the problems organizations actually have, and stated the premise the whole conversation shares.
“It’s a matter of when you will be exposed to it, or when you are compromised.”
Sasha Sinkevich, at 37:14
The premise isn’t fatalism. It’s the reason the work Damon described is worth doing. If exposure is coming either way, the advantage goes to the company that hears about it first and closes the doors fastest.
What happened after the tape
The arms race Damon described kept going in both directions.
LummaC2. On May 21, 2025, the Justice Department announced it had seized five domains that served as LummaC2’s user panels, the stealer Damon named on the tape. The FBI had identified at least 1.7 million instances where LummaC2 was used to steal information, and Microsoft took a parallel civil action against 2,300 domains (Justice Department). Microsoft had counted 394,000 infected computers from March to May. The operators kept going anyway, and activity rebounded in June and July (Wikipedia). That’s the work-around Damon predicted, in public.
Third parties. On January 14, 2026, SpyCloud launched Supply Chain Threat Protection, which extends its monitoring to the employees of a customer’s vendors (SpyCloud). It’s the product answer to the question customers asked Damon on the tape, about the partner company and the law firm.
Sessions over passwords. In May 2026, Damon wrote on LinkedIn that stronger authentication is pushing criminals toward what comes after the login.
"While authentication is hardening, attackers are adapting."
In July, SpyCloud said its recaptured data had passed 1.01 trillion identity assets, 130 times what it held at its founding in 2016, and that stolen session cookies and authentication tokens now make up nearly half of everything it recaptures (SpyCloud). The password problem Damon wanted solved is being solved, slowly, and the economy is moving to the session. Trevor Hilligoss explains that shift on episode 86.
Machine identities. SpyCloud’s 2026 Identity Threat Report, published September 9, surveyed 750 security leaders and found compromised non-human identities, the service accounts, API keys, tokens and AI agents that connect to internal systems, were the most common primary entry point at 31 percent, nearly twice phishing and social engineering at 17 percent. 95 percent of organizations believed they had adequate visibility into AI and non-human identity exposures, and only 36 percent actually monitored them. Damon’s comment in the announcement was that measuring whether an exposure happened is “the wrong scoreboard” (SpyCloud).
"Company size doesn't predict identity security outcomes."
For startups shipping agents, that’s the newest set of doors. Our posts on agents that share one API key and least privilege for agents take it from there. SpyCloud marked its tenth anniversary in August 2026, with its founding mission restated as turning criminals’ own data against them (SpyCloud).
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each question, then check your score.
-
How many families of malware did Damon say SpyCloud monitors?
- 16
- 61
- 600
b. "We monitor and track the data that's stolen by 61 families of malware right now." Transcript, 6:29.
-
What did Damon say about paying a ransom to keep stolen data private?
- It usually works for small companies
- It works if you pay within the first day
- It's a lie, and the data gets shared anyway
c. "And they often say if you pay the ransom, they won't share it. That's a lie." Transcript, 5:22.
-
How long did Damon say a stealer takes to empty a computer?
- Less than a minute
- About an hour
- Several days of quiet work
a. "It steals everything in less than a minute and shoves it up to the darknet, to the command and control, or often called the panel." Transcript, 6:50.
-
Which two industries did Damon say are the most targeted, by a wide margin?
- Retail and manufacturing
- Healthcare and insurance
- Education and government
b. "So when we connect it to industry, I think the two you called out are the most targeted, by a pretty wide margin." Transcript, 18:15.
-
Which disguise did Damon describe for stealers spread through pop-ups?
- A free virus scan
- A browser update
- A shipping notice
a. "They pretty much will, like, put these pop-up ads, like, hey, we'll do a free virus scan." Transcript, 20:38.
-
What did Damon say he'd love someone to build?
- A better darknet search engine
- A way to share every feed with everyone
- Secure logins that can't be compromised
c. "And I would love it if we could have secure logins that could not be compromised." Transcript, 34:56.
Are your doors still open?
Eight questions on what happens after someone’s data is stolen, from the infected laptop to the vendor whose people log in to your systems. Each one links the part of the episode it comes from.
Scorecard · eight questions
Are your doors still open?
Answer for everyone who signs in to your company's apps, contractors and vendors included. If two answers fit, pick the lower one.
-
If a stealer infected a laptop that signs in to your apps tonight, when would you find out?
- When something breaks
- Eventually, if a tool flags the laptop
- Within a day, from a feed of stolen data tied to our domains
"It steals everything in less than a minute and shoves it up to the darknet, to the command and control, or often called the panel." See Sixty-one families.
-
After an infection, what gets reset?
- Nothing, we wipe the laptop
- The person's main password
- Every app login the stolen log exposed, and the sessions with them
"So let's go close those doors before they can get there." See Close those doors.
-
Would you know if an admin's or a single sign-on account's credentials were in a stealer log?
- No
- Only if we went looking
- Yes, and those accounts get the fastest response
"And so all of that together, we can start to paint a picture of: malware infections can be directly connected to these follow-on attacks." See Predicting the ransomware.
-
When a partner, a law firm or another vendor with access to your systems is breached, what do you do?
- We find out from the news, if at all
- We ask them what happened
- We check what of ours was exposed and close those accounts
"Are you watching these types of criminals?" See What did the criminals get?.
-
How does a finding about stolen data turn into a fix?
- Someone reads an email, maybe
- A ticket that someone works by hand
- Automatically, through the directory, email and our response tools
"Is it something that can directly integrate with your email systems?" See What did the criminals get?.
-
If ransomware hit and the crew offered to delete your data for a payment, what would you plan for?
- Paying, so the data stays private
- We haven't decided
- The data being shared either way, with notifications and a tested restore
"That's a lie." See That's a lie.
-
Who runs your worst day?
- We'd figure it out at the time
- A written plan nobody has practiced
- A named incident commander and a plan we've rehearsed this year
"It's a very crazy time." See The worst day they can imagine.
-
Which of your dependencies would leave you no choice but to pay if they went down?
- We haven't looked
- We know the obvious ones
- We've listed them, including the ones nobody calls critical, and each has a fallback
"There's no backup for that." See No backup for that.
The data is probably already out there, and today you'd hear about it last. Start with the two fixes that close the most doors: a feed that tells you when your people's logins show up in stolen data, and a rule that an infection means resetting every exposed app, not wiping the laptop.
You act on what you find, mostly by hand. The next gains are speed and reach: automate the resets through your directory and email, and extend the same watch to the vendors and partners whose people log in to your systems.
You hear about stolen data early and close the doors fast. Keep it that way as the targets move, from passwords to sessions to the service accounts and agents that now make up a growing share of every company's identities.
How many doors does a year of infections open?
A stealer takes every login on the computer it infects, so one infection exposes many apps, not one. Put in your own numbers to see how many logins a year of infections puts in criminal hands, and how many a main-password reset alone leaves working.
Calculator
How many doors does a year of infections open?
Three estimates: how many people sign in to your company's apps, the share of them a stealer infects in a year, and how many company app logins each infection exposes.
That's about 4 infected people a year and 60 app logins in criminal hands, about 5 a month. Resetting only each person's main password would leave about 56 of those doors open. Resetting every exposed login and ending its sessions is what closes them.
2 percent is a placeholder, not a measurement. SpyCloud's 2024 report says as many as one in five people have been infected by an infostealer, and that each infection exposes 10 to 25 or more business application logins on average. Your own stolen-data feed is the number to use.
From TippingPoint to the trillionth record
Everything on this page sits on one timeline, from Damon’s first job to SpyCloud’s 2026 report. Filter it by thread.
Timeline · 1995 to 2026
From TippingPoint to the trillionth record
Filter by thread. Dates are from the public record except where marked as part of this show.
- Dialogic
Damon's first job, as an associate applications engineer, followed by Windows CE work at Eclipse International from 1997 (LinkedIn).
- Surgient Networks
An embedded TCP/IP stack and Linux drivers, as network software manager, to 2002 (LinkedIn, on this show).
- Mirage Networks
The security rules engine of a network access control product, rising to director of engineering, to February 2007. Trustwave bought the company in 2009 (LinkedIn).
- 3Com buys TippingPoint
For $442 million (Wikipedia).
- TippingPoint
Product manager for the flagship intrusion prevention system, then architect and product owner, to February 2012 (LinkedIn).
- Hewlett-Packard buys 3Com
For about $2.7 billion, TippingPoint included (Wikipedia).
- Cache IQ and NetApp
Director of engineering at Cache IQ, which NetApp acquired that November, growing the team from 7 engineers to 40, to October 2015 (LinkedIn).
- Trend Micro buys TippingPoint
For about $300 million (Wikipedia).
- SpyCloud is founded
The Austin company later described its founding mission as turning criminals' own data against them (SpyCloud).
- CyberDefenses
Chief technology officer and vice president of cybersecurity services at the Texas managed security provider, to 2021, with a team of more than 50 by 2020 (LinkedIn, on this show).
- Ransomware Task Force report
48 recommendations, published days before the Colonial Pipeline attack (IST, on this show).
- SpyCloud
Damon joins as vice president of strategy, and becomes chief product officer in November (LinkedIn).
- Infostealer research
SpyCloud reports that 61 percent of the previous year's breaches were malware-related, and Damon calls infostealers the go-to tool for cybercriminals (SpyCloud).
- SpyCloud Connect
Hosted automation that connects SpyCloud's data to the tools a security team already runs (SpyCloud, on this show).
- Operation Magnus
The Justice Department joins the Netherlands, Belgium, Eurojust and others against the RedLine and META infostealers (Justice Department).
- The recording
Damon talks with Jon and Sasha a few weeks after the 2024 Malware and Ransomware Defense Report (on this show).
- Episode 60
The episode airs (transcript).
- LummaC2 disrupted
The Justice Department seizes the stealer's user panels, and Microsoft goes after 2,300 domains (Justice Department, on this show).
- Episode 86
Trevor Hilligoss of SpyCloud on the human behind the keyboard (episode 86).
- Supply Chain Threat Protection
SpyCloud extends its monitoring to customers' vendors (SpyCloud).
- Authentication is hardening
Damon writes that criminals are moving to session cookies and tokens (LinkedIn).
- One trillion
SpyCloud passes 1.01 trillion recaptured identity assets, with sessions and tokens nearly half (SpyCloud).
- Ten years
SpyCloud marks its tenth anniversary (SpyCloud).
- 2026 Identity Threat Report
Compromised non-human identities top the list of entry points, at 31 percent (SpyCloud).
What to do this week
Five things, in the order Damon’s argument suggests.
- Find out what’s already out there. Check your company’s exposure, starting with the people who have the most access, and treat what you find as a list of fixes rather than a scare. The scorecard above is a quick first pass.
- Change what an infection means. Write down that a stealer infection on any device that signs in to your apps means resetting every exposed login and ending its sessions, not wiping the laptop. The calculator shows how many doors the difference leaves open.
- Automate the response. Route findings about stolen data into the systems that can act on them, your directory, your email and your response tools, so the fix happens in minutes instead of whenever someone reads an alert.
- Ask your vendors the partner question. For each vendor whose people log in to your systems, ask how they’d know if one of their laptops were infected, and what they’d tell you. Our post on the security exhibit your startup signed covers what those contracts usually promise.
- Name your incident commander. Pick the person who runs the worst day before it happens, list the dependencies nobody calls critical, and practice once this year. If you’d like a second pair of eyes on any of it, book 15 minutes with us.