Hands-On Defense: Markus Schober on DFIR, Labs, and Building Better Blue Teamers

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Markus Schober, founder of Blue Cape Security, to talk all things digital forensics, incident response (DFIR), and why hands-on training beats theory every time.

We dig into:

🔹 The hidden value of building your own cyber range

🔹 How IR pros train using real attacks (and why they need red team skills)

🔹 Eric Zimmerman's forensics tools and practical lab setups

🔹 Ransomware war stories from Fortune 100 response

🔹 The role (and limitations) of AI in forensics

🔹 How to break into DFIR as a practitioner — not just a paper tiger

Whether you’re building detections, teaching DFIR, or just figuring out where to start, this one’s for you.

👇 Timestamps https://www.bluecapesecurity.com/& Resources

0:00 Intro & ThreatLocker sponsorship

2:00 Markus' journey from responder to trainer