Security Confidential E5 E8 Brandon Keath

Manoj Tandon:
Hello everyone. This is Manoj Tandon, and welcome to another episode of Dark Rhino Security Confidential. Today, we are honored to have Brandon Keath join us. Brandon is with Appalachia Technologies. He helps customers develop strategic cybersecurity plans that align with business goals to increase profit and growth while reducing overall risk—very noble.

He holds a Master’s degree in cybersecurity and information assurance, as well as an MBA in IT management from Western Governors University. And to top it off, he is currently pursuing a PhD with a focus on cybersecurity. Well, you’re really going all the way, Brandon. That’s fantastic. Welcome to the show.

Brandon Keath:
So happy to be here. Thank you for having me.

Manoj Tandon:
It’s great that you would take a little bit of time on your Friday and join us. So, one of the things where I thought we would really start is with gaming. That’s a place where a lot of cybersecurity conversations don’t start, but I believe in your pathway into cyber, gaming was involved in some way, shape, or form.

Give us a little bit of a primer here on what happened.

Brandon Keath:
Absolutely. I graduated high school in 2008 and wasn’t quite sure what I wanted to do. Everyone was saying, “Go to college,” so I enrolled—but I got really into gaming and wanted to create my own MMORPG.

So I invested a bunch of money, built a forum, got it up to tens of thousands of users, and created several game prototypes—but never a full game. I probably sunk a few thousand dollars into it, which, at a minimum wage job, was basically everything I made. I even dropped out of college to pursue it.

Unfortunately, it failed miserably.

The gaming industry is very cutthroat, and back then there weren’t indie platforms like today. No Steam, no greenlight—just self-advertising. But I learned a lot: MySQL, programming, systems. That led me into freelance Java development, which became my entry into IT.

But during that time, I also had my first cybersecurity experience—my forum got hacked via SQL injection. The attacker shut it down and ransomed it back to me over MSN Messenger. This was before ransomware was really a thing.

Manoj Tandon:
How much was the ransom for?

Brandon Keath:
I was a teenager—I basically cried and said, “Give me back my website.” They felt bad and eventually gave me the backup.

That whole experience was pivotal. I never thought I’d end up on the “good guy” side learning how hacking works, but that’s exactly what happened.

Manoj Tandon:
That’s passion, man. You really pursued the dream. Let me ask you this: were you happier doing that than a normal job?

Brandon Keath:
Absolutely. Even though it failed, I had ups and downs afterward, took whatever jobs I could, and eventually went back to college for IT. I used what I learned to build a career.

I realized I still loved technology. If I couldn’t do gaming, I could still work with systems, databases, and development.

Manoj Tandon:
We have a lot of young listeners, and one of the greatest teachers in life is failure. Is there advice you’d give people who are afraid to take a chance?

Brandon Keath:
The only real failure is the chances you never take.

You can be afraid of failing, but I’ve learned more from failure than success. Success often requires failure first. I hit rock bottom early—dropped out, lost money, straight Fs—but that didn’t mean I couldn’t come back.

Sometimes you have to be broken to be rebuilt.

Manoj Tandon:
That is sage advice. As an entrepreneur, I’ve made plenty of mistakes, but each one became an opportunity to improve.

Let me shift gears a bit. For parents listening—are there cybersecurity risks with gaming consoles?

Brandon Keath:
Consoles are generally locked down unless people modify them. There’s a big community around console hacking—like with the Wii or PlayStation—but most risks today come from online interaction.

Consoles are basically computers now. Kids are chatting with strangers, joining communities—so parents should treat them like any internet-connected device.

The biggest risk is phishing—people trying to get account credentials. Once they have one password, they often have access to many other accounts due to password reuse.

Manoj Tandon:
That makes sense. So how did you transition from IT into cybersecurity?

Brandon Keath:
Honestly, it wasn’t planned. I was just trying to get into IT. I got my CompTIA A+, applied everywhere, and worked multiple jobs while freelancing.

I eventually got a job at Staples as an EasyTech associate—then got laid off for not meeting sales quotas.

Manoj Tandon:
As a tech?!

Brandon Keath:
Yes—and I got in trouble for recommending free antivirus instead of selling paid software.

But after that, I got a help desk job at a university, then moved to another company where I experienced a cybersecurity incident. My boss walked up and said, “Brandon, you’re the new cybersecurity person.”

I said, “Does it come with a raise?” He said no.

That’s how I got into cybersecurity—completely by accident.

Manoj Tandon:
I’d say you created the conditions for that opportunity.

Brandon Keath:
Exactly. And it worked out. Over the years, I’ve worked in SOCs, done penetration testing, and now provide vCISO services and strategic guidance.

Manoj Tandon:
Let’s talk about risk. Many companies still don’t understand defense-in-depth. What’s your advice?

Brandon Keath:
It depends on your audience. With executives, I avoid technical jargon and use analogies—like a house.

Do you lock your door? Yes. Will that stop a determined attacker? No—but it’s a deterrent and early warning system.

Cybersecurity works the same way. Most companies invest after an incident—it’s reactive instead of proactive.

Manoj Tandon:
That’s what we see too—people come after something happens.

Brandon Keath:
Exactly. So we evaluate risk by thinking about what’s valuable. Your data is like valuables in a safe. Access control is like keys—would you give everyone access to your house? That’s what excessive privileges are.

Risk is different for every organization—there’s no one-size-fits-all.

Manoj Tandon:
Are executives becoming more open to cybersecurity spending?

Brandon Keath:
Somewhat, but it’s still seen as a cost center. That’s where technical debt comes in—short-term decisions that create long-term risk.

Outdated systems are a major issue. Many breaches happen because of unpatched vulnerabilities or legacy systems.

If you modernize systems, you not only improve security—you improve performance and competitiveness.

Manoj Tandon:
That’s a great way to frame it.

Brandon Keath:
But legacy systems are tough—especially in manufacturing or infrastructure. In those cases, you use compensating controls like segmentation and isolation.

Long-term, though, those systems need replacement. Otherwise, they become a ticking time bomb.

Manoj Tandon:
Let’s touch on cyber insurance.

Brandon Keath:
Insurance is tricky. Most people have bad experiences with claims. And cybersecurity losses include intangibles—like reputation—that insurance doesn’t fully cover.

Also, policies now require strong security controls. And I strongly advise against paying ransoms—it fuels the criminal ecosystem.

Manoj Tandon:
Recovery is often under-implemented too.

Brandon Keath:
Exactly. Disaster recovery plans are rarely tested. Just like fire drills—we don’t practice until something happens.

Manoj Tandon:
This has been a fantastic conversation. Anything you’d like to share?

Brandon Keath:
Yes—if you want to connect, find me on LinkedIn or check out my content at thehackinglab.com.

Manoj Tandon:
Fantastic. We’ll include that in the show notes. Brandon, really appreciate you joining us.

Brandon Keath:
Thank you for having me.

Manoj Tandon:
Thank you. Have a great day.