Your Adversary Within Adam Mashinchi and Bryson Bort

Bryson Bort (founder of SCYTHE) and Adam Mashinchi present a strategic analysis of insider threat modeling and modern endpoint adversary emulation in the Red Team Village [00:00]. The speakers address how the sudden shift to widespread remote work accelerated endpoint sprawl and rendered traditional corporate network perimeters obsolete, creating a "golden age" for insider risks [06:11, 12:30].

The presentation examines the operational differences between external penetration testing and internal adversary simulation. Bort and Mashinchi explain that modeling an insider threat requires assuming existing user privileges, authorized endpoint access, and knowledge of internal documentation [18:50]. They walk through breach and attack simulation (BAS) methodologies, demonstrating how red teams can programmatically simulate insider behaviors—including anomalous data exfiltration, stealthy lateral movement, and randomized command-and-control heartbeat jitter—to validate whether corporate Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) systems generate timely alerts [24:48, 30:58].

The speakers advocate for collaborative purple teaming, urging organizations to continuously measure defensive visibility, identify blind spots in telework monitoring, and test specific adversarial behaviors rather than relying on check-box compliance [30:58, 37:13].

(AI summary — Gemini Flash)