Unpatched Ep.03: Passing the Audit vs. Surviving the Attack – with Mike Crandall & AJ Nawani

In this episode of Unpatched by SharkStriker, host AJ Nawani sits down with Mike Crandall, CEO of Digital Beachhead, to break down the real gap between passing a compliance audit and actually surviving a cyberattack. They cover the difference between CMMC Level 1 and Level 2, why 6 in 10 defense contractors still get hit by ransomware despite passing audits, and real assessment stories that expose the difference between what’s written on paper and what actually holds up under pressure from a router that could only log 3 days of activity to a backup strategy that failed the moment someone tried to restore a file.

They also dig into how AI is changing the threat landscape, including real-world voice-cloning attacks impersonating company executives, and why every employee needs to function as the first line of defense not just a policy follower.

In this episode:

1. Why CMMC Phase 2 has triggered a compliance rush among small and mid-sized defense contractors
2. Level 1 (FCI) vs. Level 2 (CUI) — and why companies keep confusing the two
3. The difference between being compliant and being secure
4. Real assessment stories: the CUI binder problem, the 3-day log gap, the backup that didn’t restore
5. How AI is being used by both attackers and defenders
6. Fake CEO voice and video scams — and how to train employees to spot them
7. Conflict of interest rules between compliance consultants and third-party assessors
8. The single most important first step if you haven’t started CMMC prep yet: scoping

ABOUT UNPATCHED BY SHARKSTRIKERS

Unpatched is the official podcast by SharkStriker where we have real, unfiltered conversations about the vulnerabilities that matter most.

Not just in your systems, but in how the entire industry thinks about cybersecurity.

No buzzwords. No vendor pitches. Just honest insights from the people on the front lines of cyber defense.