This week, Zac sits down with Matt Shirley. Matt is the VP of Technical Services at Fortalice Solutions. Fortalice Solutions is a boutique cyber security services firm based in Charlotte NC, founded by Theresa Payton, former CIO to the White House. Zac and Matt discuss the importance of turning technical pentest findings into actionable strategy, RFID badge cloning and the hilarious situations that come from physical assessments.
Episode Summary
In Episode 13 of War Stories, host Zac Davis sits down with longtime friend Matt Shirley, VP of Technical Services at Fortalice Solutions. They talk about the RFID badge cloners Matt built, why human error is the one vulnerability technology never fully patches, and physical penetration tests that swung from laughing hysterically to genuinely nervous moments.
Matt and Zac worked together in their early consulting days, and Zac later recruited Matt to Fortalice, where he still works. His favorite tool is the RFID badge cloner. Matt built several of the long-range cloners the team has used on engagements, and improved the clunky process of opening the device and pulling an SD card to check whether a badge had been captured.
The stories come from years of physical security testing. On one office test, a can of compressed air helped him get through a door, and inside he found notebooks full of passwords and more taped under keyboards. Bank and credit union tests turned up vault keys sitting in unlocked desk drawers and written on sticky notes at teller stations. One night ended with a branch manager called in from the gym to verify the team's authorization letter, and another with the team watching from the car, cracking up as employee after employee puzzled over a badge reader that was not there the day before.
In This Episode
- Matt Shirley's path to VP of Technical Services at Fortalice Solutions
- Building long-range RFID badge cloners for physical penetration testing
- Why human error remains the hardest vulnerability to patch
- Passwords in notebooks, under keyboards, and on sticky notes
- Bank and credit union physical tests, vault keys, and authorization letters
Would Your Branch Pass a Physical Test?
Banks and credit unions trust thick vault doors, but testers keep finding the keys nearby. SEVN-X runs physical security assessments and penetration tests for financial institutions and other regulated organizations. Talk with our team about scoping a test for your organization.
