Episode: Security Boulevard Podcast – Ep. 55, “The Billion-Dollar Blind Spot: Why Gaming Cybersecurity Is Broken”
Guest: Corey Dirrig, Podcast Producer and Co-founder, Boss Rush Media
Hosts: Tom Hollingsworth, Event Lead, Tech Field Day, and Analyst, The Futurum Group · Fernando Montenegro, VP and Practice Lead, Cybersecurity, The Futurum Group · Kate Scarcella, Cybersecurity Architect
Published: October 27, 2026
Listen: YouTube | Podbean | Techstrong TV
The Take
AAA game budgets now rival blockbuster films, and a single gaming account can hold two decades of purchases and a stored card. Yet the industry rarely comes up in enterprise security conversations, often seen as a consumer market apart from “real” security.
The panel works through PlayStation 5 jailbreaks, account takeovers on console networks, and Valve pulling physical Steam gift cards over fraud. The conclusion is not that gaming security is weak. Studios and platforms run serious, specialized security, from distributed denial-of-service (DDoS) engineering with Cloudflare, Akamai, and Fastly to anti-cheat.
What enterprise security lacks is awareness of what gaming already does well, starting with how it gets users to opt in.
What You’ll Hear
- Why your Office access could hinge on your Xbox Live account standing.
- The phone call that can undo two-factor authentication on PlayStation Network.
- The “money hose” rule one platform’s back end is built around, and what it means for any control that slows it down.
- What a field engineer’s kids playing Angry Birds had to do with a power substation.
- Why selling security to a game company looks more like selling to a telecom than to corporate IT.
The Insights
Gaming Security Is a Specialist Market With Two Different Buyers
Game companies cannot ship a successful title without deep in-house security on the product side: anti-cheat, anti-fraud, and DDoS architecture. That team buys specialized tools built for the product. The corporate IT side buys like anyone else.
The implication: as with telecom, where network engineering and corporate IT are separate markets, vendors and buyers should treat the game and the enterprise as two different security problems.
“You cannot have a successful gaming company if you don’t understand security of your games to some level.” — Fernando Montenegro, VP and Practice Lead, Cybersecurity, The Futurum Group
Account Recovery Is the Real Second Factor
Console accounts have become identity anchors that hold libraries, payment methods, and in some ecosystems access to productivity apps. As platforms move toward all-digital, losing the account means losing the purchases. The panel describes PlayStation Network support calls that unlock accounts without the second factor.
The implication: multi-factor authentication (MFA) is only as strong as the recovery path behind it, a lesson that applies directly to enterprise help desks.
“You can bypass the two-factor authentication. You don’t need a password.” — Corey Dirrig, Podcast Producer and Co-founder, Boss Rush Media
Incentives Beat Mandates
Games reward players for turning on MFA with an extra skin or in-game currency. That aligns what the player wants with what the platform needs, without a policy memo. Platforms are also ruthless about friction, because every second of downtime or failed login costs money.
The implication: enterprise security can borrow both habits, rewarding secure behavior and measuring controls by the friction they add.
“They are aligning the incentives, right? Here’s the economics.” — Fernando Montenegro, VP and Practice Lead, Cybersecurity, The Futurum Group
The Big Picture
Gaming is a useful mirror for enterprise security. It has every hard problem the enterprise has: identity sprawl, fraud, supply chain leaks, availability attacks, and an adversary community that treats breaking protections as a hobby. It faces them with a user base that will not read a policy and will leave if security gets in the way.
Our view is that this pressure produces answers on incentives and user experience that corporate programs can borrow. It also illustrates a market dynamic we track closely: security is a race with no finish line, and the jailbreak scene shows how each new protection creates the motivation for the next bypass.
The lesson for security leaders is not to buy gaming tools. It is to study how an industry that cannot afford friction still gets users to opt in, and to apply the same discipline to account recovery and help desk verification at home.
Listen & Resources
Listen to the full conversation: YouTube · Podbean · Techstrong TV
Mentioned in This Episode
- Console accounts: PlayStation 5 jailbreak, PlayStation Network support-call takeovers, Xbox and Office account linking, Epic Games age verification
- Fraud and breaches: Steam gift card scams, The Last of Us Part II leak, Sony Pictures hack and PlayStation Network outage
- Platform defenses: Cloudflare, Akamai, Fastly, and NETSCOUT for DDoS; anti-cheat and Steam Deck; Unreal Engine and id Tech
- Incentives and economics: MFA rewards (skins, in-game currency), AAA budgets, Microsoft’s Activision Blizzard acquisition
- Further reading: “Programming Satan’s Computer” (Anderson and Needham, 1995), humanzeroday.com (Kate Scarcella), Security Field Day
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other Insights From Futurum:
SentinelOne’s Identity Catch-Up Tests Its Endpoint-Led Story
NETSCOUT Q1 FY 2027: Service Assurance and DDoS Capacity Expand
Akamai’s New Security Framework: A Major Shift for AI-Driven Commerce?
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
