Noise2Signal

Mehul Revankar

A cybersecurity podcast. Cyber conversations with more signal, less Noise.

Noise2Signal is the antidote to the cybersecurity echo chamber: unfiltered conversations with the people who actually built the field — no buzzword bingo, no vendor pitches.

Play

Open in

21 episodes
weekly
Avg 58 min
English

Episodes 21

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Yesterday · 56 min
Ep. 21 Seven Samurai's of VulnOps & Dead Men (SaaS?) Walking w/ Nico Popp
Nico Popp, operating partner at Crosspoint Capital Partners and former Chief Product Officer at Tenable, joins Mehul to explain why he came back from Black Hat saying there were "dead men walking everywhere." He argues that putting AI on top of a legacy product doesn't make it AI-native. The real shift is a new architecture: sensors feed a context graph, the graph feeds a reasoning layer, and agents sit on top where the console used to be. They cover what makes a durable moat now ("the three musketeers": agentic architecture, captured agent trajectories, and your own reinforcement-learned models), why wiring in frontier models is a strategic blunder, and Nico's "Seven Samurai" framework for VulnOps. That framework describes how vulnerability management has to change when attackers are agentic, and why it ends up absorbed into the agentic SOC. Along the way they discuss the Cisco–Kenna and ServiceNow–Armis deals, the future of the console UI and what happens to entry-level security jobs. Chapters 00:00 Welcome and introductions 01:17 Black Hat, "dead men walking," and why every company is now legacy 03:24 What AI-native really means: sensors → context → reasoning → agents 07:20 SaaSpocalypse or SaaS renaissance? The case against building on frontier models 12:54 Building moats in the age of AI: the three musketeers 19:09 "Agentic" everything, platformization, and where CTEM goes 23:46 VulnOps and the Seven Samurai: shift left, appliances and continuous scanning 38:21 Validation, prioritization, and the Kenna and Armis acquisitions 50:36 Agentic patching, virtual patching and the federated agentic SOC 1:00:02 Hot takes: the death of the console, AI labs vs. cyber vendors, and CTEM's future
- Transcript
S2 · E8
September 22 · 57 min
Ep. 20 The Economics of Cyber Offense & Defense w/ Fernando Montenegro
Fernando Montenegro argued his way into the analyst world on Twitter. After thirty years in security, including fifteen as a sales engineer, a nudge from Adrian Sanabria landed him at 451 Research, then Omdia, and now The Futurum Group, where he leads cybersecurity. His one condition for coming on the show came from The West Wing: raise the level of debate. What follows is closer to an economics seminar. Fernando explains why the cost of verifiability tilts AI toward attackers, and why defenders don't have to be right every time. He also covers security as a latent construct, the market for lemons, signaling and screening, and the principal-agent problem in the age of AI agents. When Mehul presents $3 exploits, Fernando reaches for the theory of constraints: fix one bottleneck and it moves. He closes with Moneyball advice: stop buying players, start buying runs.
- Transcript
S2 · E7
September 15 · 46 min
Ep. 19 Building A Vulnerability Discovery Harness w/ Dan Jones
Dan Jones didn't set out to build a vulnerability factory—he set out to hack Cloudflare more effectively. Late last year, sitting on the red team, he and a few colleagues clocked what was coming: They were about to be receive hundreds of thousands of LLM-generated bug reports, and the only sane response was to get there first. They started building six months before Mythos existed, with no best practice to copy and everyone quietly trying a different approach. Then Cloudflare became one of the first enterprises inside Project Glasswing, the classifiers came down, and the harness went to scale. In this episode, Dan tells Mehul the full arc: the 450-line security skill he open sourced, why you tell a model what to do and never what not to do, how a hunting model will happily stand up a fake web server to earn a green check mark, and why his validators never get to see the hunter's exploit code. He also gets specific about the machinery—four models hunting in parallel, mini-Cloudflare’s built on demand, every turn and emission written to a database so nothing is ever lost to a dead SSH session, 21,000 harness emissions boiled down to roughly 7,000 real bugs with over half already fixed—and closes on the uncomfortable half of the problem that most enterprises haven't thought about yet: finding bugs is the easy part. "It's not worth finding the bugs unless you can fix them."
- Transcript
S2 · E6
September 9 · 1 hr 3 min
Ep 18. The CISO before CISO's w/ Scott Crawford
Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone. 00:00:00 Cold open 00:02:40 Pilot, physicist, analyst 00:06:57 Security before the CISO 00:12:49 Platformization and the data puddles 00:23:25 Confidently incomplete 00:34:19 Offense in the age of AI 00:40:06 The price of poor hygiene 00:44:27 Placing bets, and the token bill 00:47:48 Open weights, and who vets the vetters 00:56:28 Retirement, and the human on the loop
- Transcript
S2 · E6
September 1 · 51 min
Ep 17. 0 to 1 on EPSS w/ Jay Jacobs. Chief Data Scientist at Empirical Security
Jay Jacobs didn't set out to rewrite vulnerability prioritization—he set out to keep working on data he loved. After helping build Verizon's DBIR alongside Wade Baker, the two spun up Cyentia Institute to do the same kind of research without Verizon attached to it. Two of Cyentia's earliest customers happened to be holding opposite halves of the same puzzle: Kenna had scan data and vulnerability sightings across hundreds of companies, and Fortinet had detections of what attackers were actually exploiting. "What if we bring this together?" turned into a side experiment, then a Black Hat paper, then EPSS—and eventually into Empirical Security, where Jay is Chief Data Scientist to give the score a permanent home. In this episode, Jay tells Mehul the full arc: why only two to five percent of vulnerabilities ever get exploited and what broke his "food supply" theory of attacker behavior, why CVSS is really measuring a practitioner's perception of how bad a vector string looks, the delicate conversations at Kenna about giving away a proprietary score, and the naming theory behind making "EPSS" rhyme with the thing it was replacing. He also gets specific about the machinery—why Metasploit is a strong signal and Exploit-DB is a weak one, why nobody hand-assigns weights, where the "23% more accurate" stat in v5 actually comes from—and closes with the gun-to-the-head threshold answer that surprises almost everyone who hears it: not 0.9, but 0.03. In our in-depth discussion, Jay shares: 00:03:19 — Jay Jacobs, Cyentia, and the Side Project That Became EPSS 00:06:53 — The 2–5% Number and What CVSS Actually Measures 00:13:11 — Why EPSS Had to Be Given Away 00:18:01 — Building the Model 00:24:07 — Grading the Model in Public 00:29:45 — EPSS v5 and Where "23% More Accurate" Comes From 00:35:27 — Who Funds It and Who's Using It 00:41:13 — AI-Written Exploits 00:46:37 — The Number for the Frustrated CISO
- Transcript
S2 · E4
August 25 · 35 min
Ep 16. The Accidental Entreprenuer w/ Alan Shimel. CEO Techstrong Group
Alan Shimel didn't plan on becoming cybersecurity media's kingmaker—he planned on being a lawyer. He passed the bar at 23, and the only thing that made him "tech savvy" in a New York law office was knowing WordPerfect better than anyone else in the building. But a home lab, a pair of 386 machines that needed to talk to each other, and a front-row seat to the birth of the web pulled him sideways into hosting, then into StillSecure as a founding executive going head-to-head with the people who would build Qualys and Tenable, and eventually into building the media empire behind DevOps.com, Security Boulevard, and TechStrong TV. In this episode, Alan—founder and CEO of TechStrong Group—tells Mehul the unfiltered version of that path: the $49.95-a-month hosting hustle that grew to 5,000 sites in 18 months, the dinner where Gene Kim first pitched him The Phoenix Project, the FeedBurner sale that accidentally handed him the Security Bloggers Network, and why he thinks the entire "open source vs. closed source AI" fight is really an argument about open weights. He also gets refreshingly blunt about Google's zero-click AI Overviews breaking the deal that funded the open web, and why the future of IT and journalism alike comes down to imagination—the one thing he doesn't think AI has.
- Transcript
S2 · E3
August 18 · 45 min
Ep 15. The Don of Security Ratings Mafia w/ Aleksandr Yampolskiy
Alexander Yampolsky didn't set out to invent a category—he just didn't want to get fired for someone else's mistake. As CISO at Gilt Groupe, he watched a fraud-prevention vendor hand over a gorgeous SOC 2 report and then discovered unencrypted credit card data belonging to other customers sitting in their systems. That moment became SecurityScorecard, the company that now scans every IP address on the planet multiple times a day and quietly underwrites a huge chunk of the cyber insurance market. In this episode, Alex—known around the industry as the Don of the security ratings mafia—walks through the unglamorous version of the origin story: the investors who told him security couldn't be measured, the MongoDB decision that haunted his engineers for eight years, the five hours of a stranger's divorce story it took to buy the .com. He also gets refreshingly blunt about why compliance isn't security, why rating pushback is often legitimate, and what happens to the entire discipline when the time-to-exploit window collapses from two years to seconds.
- Transcript
S2 · E2
August 11 · 56 min
EP 14. Inside the Verizon DBIR w/ Alex Pinto
Alex Pinto leads the team behind the Verizon Data Breach Investigations Report—the one publication the entire security industry stops and reads every single year. What almost nobody realizes is that the DBIR, now nineteen years old and built on data from over a hundred contributing partners, is written by exactly four people. In this episode, Alex pulls back the curtain on how the sausage actually gets made: the Verizon marketing team that fought tooth and nail to kill the very first edition, the Secret Service handshake that unlocked everyone else's data, and why the team flatly refuses to tell you which vendor supplied which number. He also walks us through the 2026 findings—vulnerability exploitation finally claiming the top spot after a four-year climb, a CISA KEV remediation rate that somehow went down, and shadow AI rocketing into the top three ways confidential data walks out of your building. Plus, the hunt for objective proof that attackers are using AI, why he thinks all of this will sound like business as usual by next year, and a genuinely excellent argument for why ransomware is the yoga pants of cybersecurity.
- Transcript
S1 · E11
August 11 · 48 min
EP 11. Building Future of AI-Native Cyber Defense w/ Sasan Padidar
Sasan is a veteran product builder with over 20 years of cybersecurity experience. In this episode, Sasan shares his journey from creating an early container security startup, navigating an acquisition by Tenable, and eventually building CrowdStrike's cloud security module into a $100M ARR business. We explore the early misconceptions surrounding Docker security, the architectural hurdles of moving legacy on-prem software to the cloud, and a harrowing tale of a $100K crypto-mining AWS bill. Sasan also details his recent pivot to the world of AI, explaining why human hype is often worse than AI hallucinations, how AI is fundamentally changing the speed of cyber attacks, and why defenders must rebuild their architectures to survive the next generation of threats.
- Transcript
S2 · E1
August 5 · 56 min
EP 13. Vulnerability Research is Not Cooked w/ Thomas Dullien (Halvar Flake)
Thomas Dullien—better known to the cybersecurity world as the legendary Halvar Flake—didn't just participate in the early cracking scene; he helped define it. As a computing mathematician and the mastermind behind BinDiff, Thomas revolutionized how we understand silent patches and reverse engineering. He eventually sold his pioneering company, Zynamics, to Google, but the journey was anything but smooth. In this episode, we get a no-holds-barred look at his origin story, why building a business around reverse engineering is a massive headache, and the excruciating reality of early tech M&As. Plus, Thomas delivers a sobering, provocative take on how agentic AI and infinite compute are about to rewrite the rules of vulnerability research—and why the human element isn't going anywhere anytime soon.
- Transcript
S1 · E12
July 1 · 1 hr 6 min
EP 12. Building Companies, Culture, & Cyber Offense and Defense in the Age of AI w/ Ron Gula'
Ron Gula is a cybersecurity pioneer, venture capitalist, and the visionary founder behind Tenable. Having bootstrapped his way to a $50 million Series A and scaled one of the industry's most recognizable brands, Ron has witnessed the highs and lows of company building. In this episode, we explore the authentic culture he established during Tenable's early days, the critical mistakes founders make when pitching venture capital, and the shifting landscape of building startups in the AI era. Ron details the strict rules of his famous "five-slide pitch deck," explains why AI wrappers are simply integrators rather than innovators, and warns that CISOs must take charge of AI operations before they are replaced by automated platforms. In our in-depth discussion, Ron shares: [00:04:21] Shaping Tenable's early culture with Cyndi Gula and Renaud Deraison. [00:08:10] Offering a junior employee a 4-day workweek during the 2008 crisis. [00:09:55] Talking a customer out of buying unneeded vulnerability scanners. [00:17:05] Creating "V-Ron," an unfiltered 3D avatar for controversial opinions. [00:22:44] Secondary sales that enrich employees versus traditional VC rounds. [00:24:51] Why sub-$1M ARR startups raising $30M rounds is a major red flag. [00:27:15] The strict "five-slide pitch deck" methodology to secure funding. [00:35:08] Pitching mistakes: leading with advisor names instead of solutions. [00:37:51] The danger of AI wrappers: becoming an integrator, not an innovator. [00:45:56] The impending platformization and consolidation of cybersecurity. [00:52:34] Predicting the replacement of CISOs by AI operations and MSSPs. [00:52:58] Why CISOs must aggressively lobby to run internal AI operations. [00:57:40] Why cyber hygiene fails against nation-states, requiring air gaps. [00:59:25] The economic realities of rising ransomware costs and falling payouts. [01:04:23] The future of AI-Native offense and Defense
- Transcript
S1 · E10
June 15 · 56 min
EP 10. The Creation of Exposure Management Category w/ Jennifer Johnson
JJ is an elite marketing visionary and category creator, shaping the narrative for cybersecurity giants like Tanium, Tenable, and CrowdStrike. In this episode, we pull back the curtain on the birth of the "Exposure Management" category at Tenable, exploring the strategic shift from legacy vulnerability management to holistic risk framing pre-IPO. JJ breaks down the "magic triangle" of category creation, the delicate dance of gaining executive and sales alignment, and the critical role industry analysts like Gartner play. We also dive into the future of marketing, the massive disruption of agentic AI, and how emerging technologies are spawning entirely new cybersecurity categories like AIDR. In our in-depth discussion, JJ shares: 00:02:57 - Earning a reputation as an elite CMO at Tanium, Tenable, and CrowdStrike. 00:04:05 - Identifying as a CMO first and a category creator second. 00:08:24 - Utilizing the "magic triangle" from Play Bigger for category design. 00:10:09 - Expanding Tenable's vision beyond the traditional vulnerability management market. 00:13:46 - Shifting the conversation from point-in-time compliance to continuous risk. 00:15:00 - The internal naming debate between "Cyber Exposure" and "Exposure Management". 00:16:29 - The tension between vendor innovation and analyst-defined categories. 00:22:40 - Unveiling Tenable's new identity with a dramatic, sensory presentation. 00:25:01 - Securing executive alignment by finding the correct problem narrative. 00:30:55 - Overcoming sales team friction when introducing a multi-year category vision. 00:34:10 - Validating the new exposure narrative with forward-leaning advisory customers. 00:35:29 - Driving M&A product strategy to cover the entire IT and OT attack surface. 00:40:43 - The milestone moment when Gartner officially adopted the Exposure Management category. 00:41:42 - The future convergence of threat and exposure management in the era of Frontier AI. 00:44:47 - Debating if Agentic AI represents a new category or just an existing feature. 00:45:22 - How AI expands attack surfaces and spawns new categories like AIDR. 00:48:33 - Why human judgment and the "human in the loop" remain strictly essential. 00:50:23 - Orchestrating cross-functional marketing workflows with AI agents. 00:55:01 - Embracing an AI-assisted interior design hobby outside of cybersecurity.
- Transcript
S1 · E9
June 7 · 54 min
EP 9. Do AI or Be Replaced by AI w/ Craig Adams. AI-Native Future of Cyber Offense, Defense & PM
Craig Adams is a seasoned cybersecurity product leader with over 20 years of experience building and scaling industry-defining tools. Having served as the Chief Product Officer at Rapid7 and Chief Product and Engineering Officer at Recorded Future, Craig has steered some of the most prominent teams in enterprise tech through massive evolutionary shifts. In this episode, we unpack how the age of AI has fundamentally rewritten the roles of product management, user experience, and software engineering. Craig challenges the "SaaS apocalypse" narrative, explains why AI-generated code will cause an exponential explosion of vulnerabilities, and argues why human information security teams will actually grow in size to handle the complex, agentic future of tech. In our in-depth discussion, Craig shares: 00:04:01 - Why the traditional waterfall requirements document is dead in the age of AI. 00:05:40 - How the role of the software engineer is transitioning to architectural oversight. 00:06:19 - The core strategy differences between running B2B and B2C product management. 00:07:28 - The merging lines between PM and UX design systems. 00:08:58 - Why the role of the prompt engineer has already gone out of fashion. 00:10:06 - Walking the floor at RSA and the problem with copycat cybersecurity marketing. 00:12:03 - The shift from SEO to AEO (AI Engine Optimization) for scraping agents. 00:13:12 - The rise of sandbox-driven trial loops and the death of human-led software demos. 00:14:46 - Buying enterprise AI subscriptions purely on self-serve product value. 00:16:13 - Facing the "Mythos" vulnerability hype and how AI disrupts raw discovery. 00:19:23 - Why putting 5x more findings into a discovery bucket is an unsustainable model. 00:21:52 - Reframing the cybersecurity dilemma as an implementation problem. 00:22:59 - How AI is binarily decreasing the time to exploitation for attackers. 00:25:00 - A religious-level conviction that the number of human defenders will grow, not shrink. 00:27:35 - Why entry-level information security roles are in the center of the AI bullseye. 00:29:48 - The new reality of writing functional exploits using simple natural language prompts. 00:32:31 - Debunking the idea that AI-generated code will plateau software exposures. 00:33:32 - Shifting defender terminology to focus on "toxic combinations" rather than simple patching. 00:35:13 - Redefining SaaS software: Either you embed AI or you get replaced by it. 00:36:06 - Navigating the inequality between well-funded banks and under-budgeted municipalities. 00:39:49 - Why security teams who block AI usage will ultimately hinder their enterprise. 00:40:14 - Moving past the chatbot era of 2023 into true automated agency. 00:41:57 - The dramatic leapfrog analogy: Treating the adoption of AI like switching from mail to email. 00:44:23 - Dismantling the platformization myth of "one security platform to rule them all." 00:45:47 - The thesis behind why the next trillion-dollar tech giant will be a services organization. 00:48:00 - Predicting a renaissance of software-like margins inside the IT services industry. 00:49:56 - Automating lower-value tier-one analyst tasks to focus on higher maturity journeys.
- Transcript
S1 · E8
June 1 · 1 hr 21 min
EP 8. The Buyer's Seat w/ Aysha Khan. Inside the Mind of CISOs Buying in AI Era
Aysha is a technology executive with over 25 years in cybersecurity, most recently serving as CISO and CIO at Treasure Data. Known for her "spiritual CISO" persona, she blends deep operational experience with a monk-like clarity — cutting through vendor noise with equal parts wisdom and candor. In this episode, we explore the frustrations behind her Buyer's Seat series, the chronic delivery problem plaguing the cybersecurity industry, and a no-holds-barred look at how buyers actually evaluate, adopt, and renew software. Aysha shares her structured vendor evaluation process, what "fantasy math" ROI really signals, and how AI is fundamentally reshaping how she leads her team.
- Transcript
S1 · E7
May 20 · 1 hr 42 min
EP 7. The History Of Vulnerabilities w/ Brian Martin. From 1993 to Current Era.
In this episode, we sit down with Brian Martin — 33-year vulnerability historian and longtime OSVDB maintainer — to trace the chasm between what CVE actually tracks and what's really out there. Brian explains why VulnCheck's KEV is 3.5x bigger than CISA's, why the real public vulnerability count is missing somewhere between 500K and several million entries, and how he personally mined 105,000 vulns out of changelogs and bug trackers. The conversation digs into the manufactured 2024 funding crisis, NVD's quiet abandonment of a 30,000-vuln backlog, why CVSS V4 is a "train wreck," and the LLM-driven vulnerability spike about to dwarf the fuzzer era. They close on the 1903 Marconi wireless telegraph hack — the first documented exploit-in-the-wild.
- Transcript
S1 · E6
May 13 · 1 hr 3 min
EP 6. Meme King. Covering AI, Cybersecurity, Acquisitions & everything in between w/ Pramod Gosavi
In this episode, we sit down with investor Pramod to break down the deals, valuations, and strategic plays reshaping cybersecurity and AI. Pramod unpacks Nikesh Arora's "sell-to-me-or-I-build-it" M&A playbook, the dirty economics behind AI darlings like Cursor and Claude Code, and the looming SaaSpocalypse pitting AI startups against legacy vendors for the same IT budget. The conversation digs into Nvidia's circular money flow with OpenAI, Anthropic, and CoreWeave, why this AI cycle is the inverse of dot-com, and a sharp take on why Cloudflare commands the highest multiple in security while Okta leaves money on the table.
- Transcript
S1 · E5
May 11 · 59 min
EP 5. Past, Present & Future of CISA KEV w/ Patrick Garrity
In this episode, Mehul sits down with vulnerability management influencer Patrick Garrity to unpack the rapidly shifting landscape of vulnerability exploitation. Patrick discusses how his unique data visualizations put CISA KEV on the map, but reveals the hidden limitations of the federal catalog today. He breaks down the recent geopolitical and funding crises paralyzing NIST’s NVD, highlighting how the private sector and projects like CISA's Vulnrichment are stepping up to fill the data void. The conversation also explores how MFA pushed threat actors toward network edge exploitation, the alarming reality of shrinking zero-day timelines, and why "exploitable by AI" might soon become the ultimate threat metric. Finally, they cover the looming impact of frontier AI models on mass bug discovery and how incoming European regulations will force companies to disclose active exploits within 24 hours. In this episode, Patrick shares: [00:01:48] How his unique data visualizations ultimately put CISA KEV on the map. [00:02:37] His journey from sales engineering at Duo to becoming a vulnerability data storyteller. [00:06:24] The early struggles of trying to contribute real-world exploit evidence to CISA KEV. [00:08:38] What the pre-CISA KEV era looked like, including scraping Twitter feeds for intel. [00:10:09] How SOC teams literally used a journalist's tweets as their primary exploitation feed. [00:11:48] Why the federal CISA KEV catalog only tracks ~1,500 exploits. [00:15:09] Why ENISA KEV's tiny catalog of 15 matters more than the label. [00:14:12] When VulnCheck’s CEO decided to give away their valuable commercial KEV data. [00:16:42] The death of Flash, IE, and Word macro exploits—and the rise of edge attacks. [00:18:25] An analysis of the Progress MOVEit attacks and the rise of "smash-and-grab" extortion. [00:23:24] Getting mocked for joining VM in 2022 because the industry thought it was "solved." [00:27:56] The funding crises that brought global CVE enrichment at NIST NVD to a halt. [00:34:05] The night the CVE program almost lost its funding entirely. [00:36:05] How 32K unenriched vulns were reclassified as "not scheduled" to clear their backlog. [00:41:40] The terrifying metric showing 26% of exploited vulns see action before a patch exists. [00:43:10] The rapid evolution of AI-generated bug reports from "slop" to legitimate. [00:48:02] Why "exploitable by AI" might replace CVSS and CISA KEV as the ultimate metric. [00:50:58] How Anthropic's Glasswing successfully found 300 real vulns in Firefox. [00:53:12] The possibility of attackers stealing proprietary source code specifically to feed into AI. [00:53:31] Why AI tools shipping without security in mind will become the next leakage problem. [00:54:38] War stories from the ProxyLogon exploits and the FBI's unprecedented interventions. [00:56:30] The time CrushFTP got mad at VulnCheck just for assigning a CVE ID to a vuln.
- Transcript
S1 · E4
April 30 · 54 min
EP 4. Past, Present & Future of Risk Based Vulnerability Management with Ed Bellis
Ed Bellis is the visionary who essentially created the Risk-Based Vulnerability Management (RBVM) category in 2010. From his days as CISO at Orbitz to founding Kenna Security in a market that didn't yet know it needed prioritization, Ed has consistently pushed the boundaries of cybersecurity. In this episode, Ed unpacks the grueling reality of convincing early investors and customers to put their vulnerability data in the cloud, the game-changing pivot that gave Kenna true product-market fit, and the candid truth behind what went wrong after the massive Cisco acquisition. He also dives into his new venture, Empirical Security, the role of AI in "eating the scanner," and why the industry needs to finally ditch the fear-mongering.
- Transcript
S1 · E3
April 30 · 48 min
EP 3. The Face of New Media for Cybersecurity with Cole Grolmus, Founder Strategy Of Security
Cole Grolmus is the ultimate "N of one" in cybersecurity media. After a decade at PwC and a failed startup, he hit reset, writing a 65,000-word reflection that birthed Strategy of Security. Today, he cuts through the industry noise with brutally honest, deeply researched strategy analysis. In this episode, Cole breaks down his viral cybersecurity ecosystem map, the dangerous reality of blitzscaling, and why the AI revolution won't wipe out heavyweights like CrowdStrike. We also get an inside look at how he completely reinvented his independent media empire using advanced AI agents.
- Transcript
S1 · E2
April 30 · 44 min
EP 2. Past, Present and Future of Offensive Security w/ HD Moore
HD Moore started the Metasploit framework project in 2003, forever changing the game on offensive security. Today, he serves as the CEO of runZero, mapping out global networks from behind the firewall. In this episode, we dive into the scrappy early days of internet security and dumpster diving for computer parts, why the AI revolution might make traditional vulnerability research and CVEs obsolete, and the brute-force reality of modern cybersecurity venture capital. We also explore how HD's deep technical roots helped him build runZero to $1M ARR as a solo operation, plus he shares the hilarious history of how the Blaster worm broke the internet using Metasploit's default port.
- Transcript

Showing 1–20 of 21 episodes