Here’s what you missed on Office Hours: December 2025

This post aggregates three Red Canary Office Hours episodes covering defense-in-depth strategies (e.g., layered controls, SSL inspection, network segmentation), methods for distinguishing normal vs. anomalous behavior through user baselining and structured threat hunts (including tools like Surveyor), and December threat highlights such as the Shai Hulud npm supply-chain activity, increased malicious ScreenConnect RMM use, and a new macOS stealer (MacSync).