Tabletops are something we all agree we should be doing, and few organizations do them well. The typical version is an annual event built around a slide deck in a conference room, and it rarely resembles how the team will actually respond. Matt makes the case for smaller, more frequent exercises, including ones that run in the background over a week and close with a thirty-minute hot wash, run inside the same tooling the team will use during a real incident.

We also get into the regulatory clocks that now sit on top of every incident, with Matt pointing to more than 200 notification laws worldwide, and how privilege and discoverability should shape the way teams document both exercises and incidents. His warning that privileging everything leaves nothing privileged is one that security and legal teams should hear together.

Looking ahead, we discuss why Matt expects concurrent incidents to become the new floor as AI raises attacker capability, and what regulators and plaintiffs will ask for when they want proof of continuous readiness.

Prefer to listen?

Spotify

Apple Podcasts

We discuss:

• Matt’s path from offensive security and threat intel to Mandiant, and what he saw in organizations that were compromised and unprepared

• What a micro tabletop looks like, from a one-hour session with the comms team to an exercise that runs asynchronously over a week

• “Train like you fight,” and the value of exercising in the same platform you’ll use during a real incident

• Feeding lessons learned back into procedures and keeping a defensible record that exercises happened

• Notification timelines across jurisdictions, from DORA’s four-hour clock to the much shorter windows Matt cites in China and India

• Separating the factual record from privileged conversations, and the risk of dozens of Slack and Teams channels spinning up around a single incident

• Keeping frequent exercises from turning into checkbox compliance by rotating threats pulled from the news

• Running two incidents at once, and why Matt sees AI pushing that from edge case to baseline

• Where AI agents help in incident response, including scenario generation, procedure building, and incident reporting

• How a CISO with an annual tabletop already on the calendar can run a first micro tabletop next month

• What “do you have a process, do you follow it, and can you prove it” means for regulators reviewing years of incidents

Matt Hartley on LinkedIn

BreachRx Website

-> Check out BreachRX <-

Timestamps

0:00 Intro

0:42 Matt’s background in offensive security, iSight, and Mandiant

1:03 What pushed Matt toward incident response

3:07 What an AI-accelerated micro tabletop looks like

7:15 Exercising in the platform you’ll respond in

9:47 Regulatory notification clocks

12:02 Privilege and discoverability in exercises

15:37 Keeping frequent exercises from becoming checkbox compliance

17:48 Concurrent incidents and AI-driven attacks

20:56 AI agents in incident response

23:00 Running your first micro tabletop

25:45 Proof of continuous readiness

28:36 Where to find Matt

Subscribe now

This year the report calls the endpoint the second era of AI security, and we spend most of the conversation on why.

James's read is that the first era amounted to "security tools in search of a use case," mostly built around aliasing sensitive data before it reached a model provider.

Agents changed that.

Once Claude Code and its peers started taking actions with every credential sitting on a developer's laptop, the developer endpoint went from a long-standing blind spot to the center of the category.

He borrows a line from GitHub's CTO that we are in the pre-HTTPS era of AI security, doing risky things we will later find hard to believe.

The numbers back the shift.

Per the report, dedicated AI security budget went from 8% of organizations last year to 37% this year, with another 24% undecided. James says most of that money is coming from AI governance budgets, which explains why nearly every vendor is pivoting toward the category and why roughly 400 AI security startups are competing for the same buyers.

Where James and I diverge is runtime. I argued the category sprinted to AIDR and runtime enforcement faster than AppSec ever did because autonomy and tool calls make runtime where the risk shows up.

James calls runtime "the patchwork thing" and pushes posture and blast radius instead. His framing is that his agent should not be able to take down the prod database because he should not be able to take down the prod database. He also thinks the category's runtime orientation owes a lot to which company CrowdStrike happened to acquire.

We close on buying advice. James's core recommendation is to rank the specific AI tools you are worried about, whether that is Claude Code, Copilot, Agentforce, or desktop apps, and let that shape the vendor shortlist. A demo will not tell you what you should care about.

We discuss:

• Why the first era of AI security was model-centric and what agents changed

• The "pre-HTTPS era" framing and why developer endpoints carry the highest risk

• Platform versus endpoint specialist, and why the answer depends on your existing stack and which team owns the problem

• AI security budgets jumping from 8% to 37% and where that money is coming from

• How to cut through 400 vendors and test runtime detection claims during a POC

• Runtime versus posture, blast radius, and why the Hugging Face incident was a misconfiguration story

• What 2025's proxy and browser acquisitions bought the incumbents, and why the endpoint is the next M&A wave

• Intent-based detection and the worker privacy problem it creates

• Whether frontier labs absorb the vendor market, and what Anthropic's inference hooks signal

• MCPs and skills as a software supply chain problem, with ADR as the natural answer

• James's buying advice for CISOs and IT teams

  ---

  ---

  Check out James’ 2026 AI Security Market Report!

  

  -> Check Out The Report! <-

  ---

  Prefer to listen?

  Spotify

  Apple Podcasts

  Please be sure to leave the show a rating/review, as it truly helps!

  ---

  Links

• James Berthoty on LinkedIn

• Latio Tech

• The AI Security Market Report

  ---

  Timestamps

  0:00 Intro

  0:31 How Latio Tech started

  2:05 The endpoint as the second era of AI security

  2:51 "Security tools in search of a use case" and the pre-HTTPS era

  5:37 Platform versus endpoint specialist

  8:16 Do you need a purpose-built AI security platform?

  11:16 AI security budget from 8% to 37%

  14:24 400 startups and real differentiation

  15:41 The commoditized feature list and testing intent-based detection

  17:32 Posture, blast radius, and the Hugging Face example

  20:14 Runtime versus posture debate

  23:35 What acquirers got for their money

  26:27 The fight over laptop protection

  29:02 Intent-based detection and worker privacy

  30:26 The next M&A wave and the hosted agent prediction

  33:55 Frontier labs, inference hooks, and the vendor market

  36:32 MCPs and skills as supply chain

  39:30 Buying advice for security leaders

  44:08 Wrap

  Subscribe now

I first found Zack during the fake SOC 2 report saga on X, and his videos on effective altruism and on the METR and Redwood Research review of the incident have been among the sharper practitioner critiques I’ve read. That’s why I wanted him on live.

We start with where the extinction narrative actually comes from. Zack traces it through effective altruism and longtermism, and argues that many of the people warning that AI will kill eight billion people held that belief before they ever learned the technology. His point is not that they’re lying. True belief does not make someone right, and it makes them a poor guide to which risks deserve attention. From there we get into Dario’s Pacing the Frontier essay and the call for METR to serve as an independent evaluator. Zack walks through the funding and personal relationships linking METR, Redwood Research, Coefficient Giving, and the labs, and lands on a line I keep thinking about. It would be convenient if your SOC 2 auditor was also your best friend who agreed with every security decision you’ve ever made. We usually call that fraud.

The back half is the part every security practitioner should hear. Zack reads the METR and Redwood report the way an incident responder would, and finds amateur mistakes, a context-drop problem in how they used AI to analyze a ten million token transcript, and a habit of leaving facts “unknown” that server logs and syscalls would have settled in an afternoon. We go through the control failures OpenAI itself disclosed, including a single package proxy as the only isolation, an evaluation environment that was supposed to have no external network access, chain of thought monitoring that wasn’t running, and no automated shutdown. Any one of those controls would have stopped it. We close on why alignment is one control among many rather than the whole plan, what the real enterprise risks look like when most corporate environments are in worse shape than OpenAI’s, and why cybersecurity’s slowness may be the biggest risk of all.

Prefer to listen?

Apple Podcasts

Spotify

Please be sure to subscribe and leave a rating/review, as it truly helps the show!

We discuss:

• Why Zack spends his weekends taking apart AI safety reports, and what four years as a CTO taught him about the industry’s problems

• Effective altruism, longtermism, and Sam Bankman-Fried as the through line from FTX to Anthropic’s Series B to today’s extinction discourse

• Why “why not be careful” is the wrong question, because there is no safe path, only trade-offs

• Pacing the Frontier and whether METR counts as independent oversight when reviewers, funders, and labs share one ideology

• The funding and family ties between METR, Redwood Research, Coefficient Giving, and OpenAI’s board

• Why the labs’ behavior doesn’t map to greed, and why Washington models Silicon Valley wrong

• True believers are not necessarily right, and why prior ideology should discount current evidence claims

• How the METR and Redwood review compares to what Unit 42 or Mandiant would have demanded before signing a report

• The AI context-drop problem behind the finding that the analysis model “sided with” the agent

• The eight layers of failure in the incident, from network egress to chain of thought monitoring to kill switches

• Why Zack calls it a preventable human and organizational failure and an alignment failure at the same time

• Whether doomer writing in the training data is producing models that cosplay as doomers

• Alignment as one control in defense in depth, never the org chart

• The tangible enterprise risks, including threat actors, customer deployments with worse sandboxing than OpenAI’s, and AI-discovered attack chains

• Why cybersecurity’s laggard culture is the biggest risk in the room

Zack Korman

• LinkedIn: https://www.linkedin.com/in/zacharyakorman/

• X: https://x.com/ZackKorman

• YouTube: https://www.youtube.com/@ZackKorman

Timestamps

00:00 Introduction
01:00 Anger as a career path, and how Zack ended up here
02:40 Effective altruism and the extinction narrative
05:59 Risk management, not risk elimination
06:29 Pacing the Frontier and the METR independence problem
10:06 True believers, hype, and how DC misreads Silicon Valley
14:45 Taking AI risk seriously when the alarm is ideological
17:20 AI safety doing cybersecurity’s job
21:24 The eight layers of failure and which control would have stopped it
23:50 Alignment failure versus containment failure
28:08 The tangible risks for enterprises adopting agents
31:14 Cybersecurity is too slow

Subscribe now

Jonathan worked in software quality and developer tooling before coming back to security, going back to the Fortify and SPI Dynamics days. He has seen a few platform shifts up close and thinks this one is bigger.

We chatted about:

• Why Jonathan sees the first half of 2026 as an inflection point for AI code security

• The two waves of enterprise AI adoption, from “run fast” to rethinking program and posture

• Functional AI-generated code versus secure AI-generated code

• Checkmarx Zero’s benchmarking of deterministic and AI-driven scanning, and how little the findings overlap

• Why enterprises still need an independent control plane as frontier models ship stronger guardrails

• Shadow AI, AI inventory and the models and MCP servers security teams don’t know about

• Where agents take on the rote AppSec work, and why Jonathan says this “isn’t completely the dark factory for AppSec”

• What a CISO or AppSec lead should change first when coding agents arrive

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to leave a rating and review, as it helps the show!

The pendulum is swinging back toward security

Jonathan put AppSec somewhere between eight and twelve on the priority list of most CEOs and boards as of eighteen months ago. Then came the first wave of AI adoption, where CEOs told engineering leaders to get AI coding tools in-house regardless of cost. Everyone else took a back seat. He said Checkmarx did much the same internally and standardized on Claude.

In the last three to four months he has seen a second wave. Customers are asking what a program and posture should look like, and they are poking at vendor marketing claims. That matches what I see in the community. Security seems to be leaning into this shift earlier than we did with cloud and SaaS.

Rules-based and AI scanning find different bugs

Checkmarx’s research team, Checkmarx Zero, ran a hybrid of deterministic and AI-driven scanning against dozens of open source projects. Jonathan described the results as a Venn diagram with very little in the middle. “What we found over and over and over again was the overlap is like less than ten percent consistently.” Each approach surfaces a class of issues the other misses.

That undercuts both camps I saw form earlier this year. One said LLMs are too non-deterministic to trust for code scanning, and the other said rules-based tools are obsolete. Jonathan also pushed on fidelity. His team measures against an F1 score to balance precision and recall, since noise is what created the friction with developers under shift left.

The model generating the code shouldn’t validate it

I asked Jonathan why the model itself can’t be the control, given the frontier labs keep shipping stronger guardrails. He called it a separation of church and state. “You have an independent control plane for security and the model that you’re using for productivity and for generation, there’s a conflict of interest if that’s also doing the validation for security.”

He added an incentive argument. “In our industry, we should hopefully be focused on value and reducing risk, not selling tokens.” He was careful to say the model providers will care about cost effectiveness eventually, and that it isn’t their business model today. This is something I have been harping on as well.

Shadow AI is showing up in the scans

Jonathan sees threat exposure split by how fast an organization moves. Tech and semiconductor customers building models and agents into customer-facing products are hitting new threat vectors first. More regulated shops with stated AI policies are mostly seeing issues at the level of generated code.

Visibility is where he starts. Checkmarx released an AI inventory capability, and he said early access customers ran roughly 50,000 scans. About half turned up AI building blocks such as models and MCP servers “that the security team had no idea even existed.” My advice to the regulated crowd was to learn from the mistakes of the early movers, because many of them share those lessons publicly.

What to change first in your AppSec program

I closed by asking what a CISO or AppSec lead should change first when coding agents arrive. Jonathan said to get clear on metrics up front. He also said to give the vulnerability backlog the same attention as incoming code, because AI makes it easier to chain low priority vulnerabilities into something with much bigger impact. He wants security inside the developer’s existing workflow so nobody has to change how they work.

His last point was about communicating upward. One executive told him, “We used to get called in for a security review once a year. Now it’s monthly.” Risk is changing fast enough that how you report it to the executive team and board has to scale with it.

Subscribe now

I recently wrote a piece on the new publication called It Was Never the Model, and this conversation goes deeper on that theme, from where the LLM and Agentic lists are converging to why Rock argues that agency is not authorization.

We chatted about:

• Why the LLM Top 10 and the Agentic Top 10 are merging in practice, with excessive agency as the biggest mover driven by connector, tool, and MCP usage

• The letter from the project leads, and why the security side of the industry was slow to say plainly that the model was never the thing to secure

• Prompt injection, which the incident data alone would have ranked around twelfth, and why the community vote carried it to number one

• Misinformation, where voters put it near the bottom and the incident record put it near the top

• Hidden Context Exposure, soft guardrails, and why instructions and data sharing one context window is the core problem

• Context rot and why agents doing critical work need disciplined context window management

• Using AI to govern AI, and the dual-layer model in the Agentic Control Standard

• Agency versus authorization, and what the flood of agentic identity drafts at IETF signals about OAuth

Prefer to listen?

Find the episode on Spotify and Apple Podcasts.

Please be sure to subscribe and leave the show a rating/review, as it truly helps!

Takeaways

The lists are converging whether we like it or not

Rock came to the LLM Top 10 co-lead role after spending most of his time on the agentic side of the OWASP GenAI project, and his read is that the two lists are merging. Agents call a model underneath, so the LLM work is the foundation for the agentic work. The 2026 list draws a boundary where the LLM list owns the model as a component and the Agentic list picks up once the model is handed capabilities and downstream consequences, but Rock admits tool calls had to be pulled back into the LLM side. Excessive agency was one of the biggest movers on the list this year, and he attributes that directly to connector, tool, and MCP usage. As he put it, when you are sitting at a desktop AI client with tools connected, “there’s effectively not a difference.” The only distinction left is whether another task keeps running after you walk away.

I see the same convergence, and the v2 State of Agentic AI Security and Governance report makes a related point about safety and security blurring. A model or agent that gets compromised and a model or agent that simply behaves in a way you did not anticipate both land on the same security and governance risk register.

Prompt injection nearly fell out of the top 10, and why it did not

This is the first year the list was tested against incident data rather than practitioner judgment alone, and the headline result is that prompt injection would have fallen out of the top 10 if the ranking followed the data. Rock gave two reasons. Vendors and organizations have invested in prompt injection guardrails, so fewer clean exploits surface. And incidents get reported by their outcome, whether that is misinformation or hidden context exposure, rather than by the initial vector that caused them. He also cautioned against reading too much into the point estimate. “On the surface, it looks like prompt injection would have been number twelve, if we went just based on the data. But the confidence interval on that would have had it anywhere from four to eighteen.”

Rock’s underlying position is that “it is mathematically impossible to solve prompt injection,” which is why the letter from the project leads tells people to assume the model will be fooled and build the system around it. He was careful to say that does not mean stop investing in input validation. It means treating prompt injection the way we have treated breaches for the last decade, as a when rather than an if. The working group still landed on number one, and Rock said “it would almost be negligent if it wasn’t,” because prompt injection is the mechanism through which most of the rest of the list gets realized. My own read is that this matches what I see in the research community, where almost every new finding against AI and agent systems traces back to a direct or indirect injection as the initial vector.

The data is noisy, and its biggest value was the argument it started

Rock was candid about the limits of the incident corpus. It was one year of data pulled from five or six sources, reported inconsistently, and the working group weighted it at 25 percent against a 75 percent community vote for exactly that reason. Three entries could not be matched between the vote and the data at all. Misinformation ran the other direction from prompt injection, with voters placing it near the bottom and the record near the top, and Rock’s explanation is simple. Nobody files an incident report when they spot a hallucination. It gets reported when the hallucination led to something harmful downstream.

His honest assessment was that “if nothing else, what the data did is just drive conversation.” Dropping the finding that prompt injection was not in the top 10 into the working group Slack produced a real debate, and the group still had to argue its way to a ranking. I think that is the right way to hold this. The data did not validate the list, and Rock did not claim it did. It gave practitioners something concrete to argue against, and he expects the model to improve as the corpus grows and as the same process gets applied to the Agentic Top 10.

Soft guardrails and the context window problem

I asked Rock how much of what the market is selling, from prompt firewalls to guardrail models to LLM-as-a-judge, is still soft guardrail territory, and his answer was that we are still seeing a ton of it. The deeper issue is architectural. A firewall can allow or deny traffic on a port and inspect the application layer. In an AI system, instructions and data are bundled together into one context window, and while there are papers on separating the instruction layer from the data layer, “by and large, it’s still just a big mesh of information.” He is not convinced the transformer architecture will ever be able to distinguish instruction from data with full certainty.

That leads to context rot. The first token carries more weight than the 250,000th, and fidelity degrades as the window balloons. For a casual conversation that is fine. For an agent performing a critical action, Rock’s advice is to keep the context window as small as possible while still giving the agent what it needs to do the job, or you start seeing hallucinations and misinformation surface. The Hidden Context Exposure entry in the 2026 list, which says privilege separation and authorization checks must not be delegated to the LLM, follows directly from this.

Agency is not authorization

When I asked what security leaders should keep in mind about excessive agency, Rock led with “Agency’s not authorization. Period.” Authorization tells you whether the agent can do the thing. Agency tells you whether the thing it is doing is appropriate and allowed. Agents need to make decisions by definition, and if a workload does not need to make decisions, it does not need to be an agent. That is automation, and we have been doing it for decades.

He pointed to the more than one hundred agentic identity drafts sitting at IETF right now, many authored by the creators of OAuth, as a signal. His read is that they are telling us OAuth is what we have rather than the solution, and that organizations will need to layer on mechanisms that detect in near real time when agents execute beyond their scope and then stop or steer them. That is what the Agentic Control Standard, which is moving back into OWASP, is trying to provide as a middleware layer, so a security leader does not need a separate control set for every platform their developers and citizen developers are building on. Given how many platforms and configurations are already in play, some kind of uniform standard is the only path I see that does not end in a mess.

Getting involved

Rock also addressed the circular logic in our space, where the answer to AI risk keeps being more AI.

His position is that a multi-layered approach is the only thing that scales. The Agentic Control Standard uses a dual-layer model, with deterministic policy as code in tools like Rego and Cedar first, and an LLM-as-a-judge only when the deterministic rule’s outcome is in question. He was clear that classifiers are limited by the quality and volume of the data behind them, including the one he built for this year’s Top 10 update. As he summed it up, “the only way to scale this is to use AI to govern AI and to secure AI.”

If you want to contribute to any of this work, Rock’s directions were simple.

Go to genai.owasp.org/contributing, follow the instructions at the bottom of the page to join the OWASP Slack, and DM him once you are in. OWASP has become, in my view, the definitive source of authority on securing and governing AI and agents while formal compliance frameworks catch up, and the groups Rock is leading are writing the standards the industry will be working from.

Thanks again to Rock for joining me. You can follow his work on LinkedIn and through the OWASP GenAI Security Project.

Subscribe now

Ondrej spent roughly 30 years in this industry, starting as employee number six or seven at Avast doing kernel-mode driver work on Windows 95, and eventually taking the company public and selling it to NortonLifeLock in a nearly $9 billion transaction. He co-founded AISLE in the fall of 2024, and his team has since disclosed more than 350 CVEs across projects like OpenSSL and curl.

I have been beating the remediation drum for a while now, so this was a conversation I wanted to have with someone who is actually shipping accepted patches upstream rather than just posting finding counts.

We chatted about:

• Going from Avast intern to CEO, and why vulnerability management became the next problem worth solving

• The jagged frontier, and why a bigger or more expensive model does not reliably mean better results

• Which bug classes genuinely got cheap to find, and which subtle ones still lead to XZ Utils and Log4j style outcomes

• Why the gray market price of vulnerabilities has gone up rather than collapsed

• Building a model-agnostic system, and the bespoke benchmarks AISLE uses to move workloads between models

• Sovereign AI, on-prem and air-gapped deployment, and why your findings are more sensitive than your source code

• Triage, reachability, and why most findings are not actually exploitable in your environment

• Patch verification in bespoke Docker environments, and mitigations for systems that cannot be redeployed

• How AISLE earned trust from curl after Daniel Stenberg shut down a seven year bug bounty

• Whether a CVE count is a vanity metric, and what makes it a real signal

• Build versus buy as the underlying model capability keeps getting cheaper

• What breaks first across maintainers, CNAs, and the CVE ecosystem

Prefer to listen?

Find the episode on Spotify and Apple Podcasts

Please be sure to leave a rating and review, as it truly helps the show!

Takeaways

Bigger models are not reliably better models

The phrase “jagged frontier” has escaped AISLE’s blog and entered the general discourse at this point, and Ondrej’s explanation of it is the most practical version I have heard. As he put it, “more expensive or bigger or more robust model doesn’t necessarily mean better results.” Large models struggle with certain vulnerability classes while smaller ones, given a harness that supplies prior knowledge of what good looks like, do better on discovery and triage.

The second half of that argument is the one buyers underweight. Cheaper and faster models mean you can run far more of them. “Because of those gains that you get in terms of speed and in terms of cost, you can run many, many more agents at the same time,” Ondrej said, describing swarms of specialized agents that chunk code and coordinate with each other. That is what people mean when they say the system beats the model, and it is why AISLE built its own benchmark to move workloads between models as new versions ship. Anyone building this internally should be asking whether they have that evaluation layer, because without it you are married to whichever model you picked last quarter.

Discovery is cheaper, but it is not solved

I pushed on whether finding bugs is now commoditized, and Ondrej’s answer used the market rather than the models. Vulnerability prices in the gray market have gone up, not down, despite all the model progress. The floor moved, so memory safety bugs and off-by-one errors are much easier and cheaper to find today. The subtle bugs that produce XZ Utils and Log4j outcomes are still hard.

This lines up with the token maxing backlash we saw earlier this year. The industry briefly confused spending more compute with getting better results, and the pricing data suggests the market never believed it.

Remediation is more than generating a patch

This was the heart of the episode for me. Ondrej broke remediation into pieces most vendors collapse into one. Triage comes first, and it matters because “the vast majority of findings may actually not be related or are not directly exploitable in your environment,” which requires data flow context rather than just function reachability. Then comes patch generation, and then the part nobody demos, which is automated verification. AISLE spins up bespoke Docker images to compile the code, run unit tests, and confirm the fix neither reintroduces the vulnerability nor breaks something else.

Then there is the category where a patch cannot be deployed at all. Cars, industrial robots, ATMs. Ondrej’s answer there was compensating controls and network level mitigations rather than pretending a code patch closes the loop. This maps almost exactly to the empirical work Keith Hoodlitt and the team at 1Password published on AI-generated patches, where fixes frequently failed, broke functionality, or introduced new vulnerabilities. Anyone selling you autonomous remediation without a verification story is selling you the easy half.

Quality is what earned curl’s trust

Daniel Stenberg shut down a seven year bug bounty over what he called death by a thousand slops, and a few months later curl was running AISLE internally. Ondrej’s explanation was not clever technology. It was standards. “We would be professionally ashamed to actually send reports that we don’t stand behind,” he said, describing reports that arrive pre-triaged with a working proof of vulnerability, repro steps, and a pre-tested proposed fix. Roughly 15 to 20 reports went into curl, all of them high quality.

That is the whole lesson for anyone pointing AI at open source right now. Maintainers are unpaid volunteers, and the currency you are spending is their attention. Ondrej called it white glove service for maintainers, and it is the reason a vocal skeptic reversed his position.

Ondrej is more optimistic than I expected on what breaks next

I asked what cracks first over the next 18 months, whether it is maintainer capacity or the CVE and CNA institutions. He acknowledged the pressure, citing roughly 47,000 CVEs in 2025 and a single recent month approaching 10,000, and he was direct that “these maintainers have no chance whatsoever to withstand the incoming load of new vulnerabilities that is just starting to come.” But he declined to predict a break, pointing instead at the wave of vendors and labs standing up open source support programs over the last several months. AISLE itself became a CNA under the ENISA route only a few weeks ago.

His read on the moment was my favorite line of the conversation. “If 2025 was mostly about naysayers, 2026 is people are realizing, my gosh, this actually works.” His advice to AppSec leaders followed from that, which was to stop leaning on legacy pattern matching tools when adversaries have unrestricted access to both frontier and open weight models, and to spend real time experimenting rather than waiting for the category to settle.

Thanks to Ondrej for coming on. Keep an eye on AISLE’s research at aisle.com/blog, since they are publishing some of the more useful empirical work on AI-driven vulnerability discovery right now.

Subscribe now

I had been chasing Igor down on LinkedIn since February, so I was glad to finally get him on the show. Lovable sits in an unusual spot. Igor has to run security for a company that went from roughly 40 people to 400 laptops in MDM inside a year, and at the same time the product he is securing hands software creation to people who are not developers and have never thought about security at all. Those two problems pull in different directions, and the conversation gets into how his team handles both.

We chatted about:

• Building a security program for a 15x company when you already know you are going to be 10x, and what breaks along the way

• Soft guardrails versus hard guardrails, why hard blocks get routed around by AI-assisted workflows, and how to tell which problems deserve which

• Anchoring guardrail decisions in business goals, risks, and threats instead of tool defaults

• The gap between democratized development and democratized security, and what a platform owes the 99 percent

• Lovable’s auto-fix toggle, the per-app threat model built behind the scenes, and the goal of shipping an app with no security tab at all

• Whether frontier models will ever produce secure code by default, and why defense in depth still does most of the work

• Governing the reality that every employee vibe coding an app starts to look like a new vendor

• GRC engineering as the discipline for measuring control efficiency layer by layer

• CRA, NIS2, and the EU AI Act landing on citizen developers who never considered themselves software manufacturers

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to leave a rating and review, as it truly helps the show!

Takeaways

Build the security program for the company you are about to be

Igor joined Lovable as the first security hire when it was around 40 people. Today his team is 20 plus and covers product security, GRC, IT, and platform safety, and the company is managing about 400 laptops in MDM. He described the security team itself as growing roughly 25x in that stretch, from one person to around 25 with offers out.

What I found useful was how he framed the planning problem. He and the team could see the revenue numbers before anyone else could, which meant they could see the trajectory. “As a CISO you just need to build your security program to cater for probably 15x company. If you expect to be 10x, if you add extra on top for extra resilience, then you’ll be fine.” He also made the point that the threat model changes as you scale, because a 40 person company and a company on the front page of every tech publication do not attract the same adversaries. That is a very different exercise than budgeting off last year’s headcount, and it is one most security leaders in high growth environments should be doing more deliberately.

Soft guardrails are coming for most of your controls, but not all of them

Igor’s argument is that deterministic controls were an artifact of a deterministic world. Static analysis was called static for a reason. Rules matched or they did not. What AI enables is a control that can look at intent, at a person’s role, at what they are actually trying to accomplish, and make a judgment. He compared it to onboarding an intern and sitting next to them, which is a much better analogy for adaptive policy than anything I have heard from a vendor.

He is not arguing hard blocks go away. He explicitly wants some. “We take human creativity and we multiply it by agent creativity,” and sometimes the result is an agent with no judgment about what it should never do. His example of a genuine hard boundary is an agent never escaping a sandbox, or never being handed a powerful admin-level CLI with developer credentials. The part that matters for practitioners is that he derives those hard boundaries from business risk rather than from a tool’s default policy set. If your risk model is done deeply enough, the things that should never happen are already written down somewhere.

The platform owes the 99 percent more than a fix button

This was the thread I came in most curious about. Lovable’s stated goal is empowering the 99 percent to build, and I have made the argument for a while that we democratized development without democratizing security. Igor’s answer is that they tried the obvious thing first and it did not work. They surfaced security bugs in a project with a button to have AI fix it, and very few people clicked it. Their research found two reasons. People were scared of breaking something that already worked, and security felt complicated and unfamiliar.

So they pushed the responsibility further onto the platform. In June they shipped an auto-fix toggle in settings, and behind the scenes every application gets scanned and a security model built for it, which is functionally a threat model. The direction he described is a platform that fixes the obvious issues silently and reserves the human interaction for questions only the builder can answer, like whether a given table should be private or public. “Ideally, there should be no security tab whatsoever in the app.” That is secure by design applied to an audience that will never read a secure coding guide, and it is only possible because Lovable owns the whole loop from generation to deployment to runtime. Most vendors cannot make that claim, which is exactly why platform providers have systemic leverage that individual security teams do not.

Good enough changed, and that is what makes GRC engineering interesting

Igor’s take on AI-powered attackers is the part of this conversation I keep thinking about. Defense in depth historically worked on a good enough standard. You layered controls, accepted that each layer had gaps, and trusted that the aggregate would slow an attacker down long enough to detect and eject them. His argument is that standard no longer holds when someone with no offensive security background can point a capable model at a target and let it work. As he put it, that is “hacking at the cost of electricity.” A relentless attacker will find the gap in layer one, then the gap in layer two, and it will do it fast.

His conclusion is that each layer now needs measured, near-complete coverage rather than good enough coverage. If you have MFA and EDR, they need to be everywhere, not on most employees and not on that one contractor group. And measuring control efficiency layer by layer is a GRC problem, because GRC already holds the risks, the vendors, the controls, and the mapping between them. Build the eval, or the KPI if you prefer the old word, get coverage from 80 to 85 to 90, and keep going. I have spent years pushing back on the compliance does not equal security line, and this is a good articulation of why. Used this way, GRC is how you prove your controls actually work in near real time rather than how you generate a report.

Regulation is coming for people who do not know they are software manufacturers

The last thread was one I did not expect to get a fully formed answer on. When a citizen developer ships an app that touches PII or PHI, they have produced software and put it into the world, even though nobody would call them a vendor. Igor’s view is that the platform’s job is to make the obligations visible early, before someone publishes. Lovable already draws some hard lines, and he mentioned taking down apps in regulated spaces where they needed to see evidence of a license first. The vision he laid out goes further, with the platform telling a builder up front what publishing will require of them, and pointing them at where to go get it.

He also mentioned a recently released opt-in trust center for apps built on the platform, which generates a compliance posture page automatically from the app and its data. That is GRC engineering aimed at customer apps rather than at the platform’s own audit, and it is a genuinely interesting model for reducing regulatory overhead on people who never signed up to carry it. As Igor put it, the shared responsibility does not sit only with the platform. The moment a builder starts putting real people’s data into what they built, things change quickly for what they need to comply with.

Igor closed with something worth repeating for anyone in this space. If one vibe coding platform fails badly, every other platform gets the same questions the next morning. The whole category is judged together, which is a decent argument for building the security bar high early rather than after the first bad headline.

You can follow Igor on LinkedIn at https://www.linkedin.com/in/igor-andriushchenko and find Lovable at https://lovable.dev

Subscribe now

In this episode I sit down with Mike Armistead, co-founder and CEO of Pulse Security, to discuss why the CISO has spent decades running a security program without a system built to run it, including the silos that created the problem, what a system of truth actually looks like, and where AI does the heavy lifting versus where the human stays in the seat.

Mike has been through this movie before as the co-founder of Fortify and of Respond Software, so his view on the AI wave is measured rather than breathless. We also get into the reporting gap between what CISOs say and what boards actually need, and the research findings that put real numbers on it.

We chatted about:

• Mike’s path through two exits and why the AI wave pulled him back to build a third company

• Why security grew up as a set of technical silos, each speaking a slightly different language, with no system to run the program as a whole

• What a system of truth for the CISO means, and how an agentic layer reads across both structured and unstructured data like policies and assessments

• Where agents take over the toilsome work of regulatory monitoring, vendor and vulnerability intelligence, and status reporting

• Governing the guardrails rather than the keystrokes, and why closing the loop still involves people and their judgment

• What corporate directors actually want to hear from a CISO in a 15 to 20 minute quarterly slot

• The research findings, including that 55% of boards have never defined the cyber risk they are willing to accept and only 12.5% of CISOs are very confident the board leaves with a true picture of the risk

• Bringing Joanna Burkey’s dual perspective as a former CISO and current corporate director into the product

Prefer to listen?

Spotify

Apple Podcasts

Be sure to subscribe and leave a review as it truly helps the show!

A few takeaways from the conversation:

The CISO is the last executive without a system of record

Mike frames the gap in terms every leader will recognize. The CFO manages financial risk from an ERP with a general ledger at its core, and the CRO runs the pipeline from a CRM. The CISO manages cyber risk from a scattering of spreadsheets, assessment documents, and point-in-time audits. His argument is that security grew up at the practitioner level, one technical silo at a time, and never developed the layer that answers questions about the program itself rather than about a single threat or vulnerability. I have lived this in programs I have supported, where the leader has to walk over to the deputy, the cloud team, the endpoint team, and the SOC to assemble a picture that should already exist in one place.

Agents for the toil, humans for the judgment

Mike is careful about where autonomy fits, and I appreciated that he did not oversell it. Agents are good at scouring the landscape and pulling the right signals for a specific company’s stack, which turns a board member’s “are we affected by that thing I read about” into a grounded answer instead of a scramble. But he is clear that “closing the loop involves people.” His quarterly access review example lands well. An agent can pull from cloud, identity, GitHub, and HR, but the calls on how broad the review goes and whether to grant exceptions stay with the security professional. What the system adds is memory of those decisions, so the exception you granted last time does not get relitigated from scratch.

The board reporting gap is about ground truth, not delivery

The numbers from the research are the part that should make people sit up. Mike cited that 55% of boards have never defined the level of cyber risk they are willing to accept, and that only 12.5% of CISOs are very confident the board walks away with a true picture of the risk. He does not think this is mainly a storytelling problem. As he put it, “we often, I think, the trees are presented instead of the forest.” The CISO gets 15 to 20 minutes a quarter and tends to fall back on the SOC metrics that feel comfortable, while the director wants to know what changed in the landscape and what the program’s posture is against it. Closing that gap means better ground truth underneath the narrative, not just a better narrative.

Institutionalizing the tribal knowledge

The thread that ties it together is one every practitioner knows. Programs run on tribal knowledge, the contract clauses a leader has ruled on before, the exceptions, the context that lives in a few people’s heads. Mike brought in Joanna Burkey, former CISO at HP and Siemens and now a corporate director, as an advisor precisely because she has seen both sides, and her point is that this knowledge “needs to be institutionalized in a way.” Capturing it saves time and money and headache, and it is the difference between a program that resets every time someone leaves and one that compounds what it learns.

Thanks to Mike for a sharp conversation on a problem the industry has mostly ignored while it chased AI for AppSec and the SOC. You can follow his work at Pulse Security AI and connect with him on LinkedIn.

-> Check Out Pulse Security! <-

If you missed it, I did a deep dive blog into the report titled “The Real Price Tag on Breaches”.

I’ve spent a lot of time pushing back on the fear-based statistics that dominate this industry, so a study built on roughly 70,000 real cyber insurance claims is exactly the kind of grounding the conversation has been missing. Alex and his team put concrete numbers behind questions we usually answer with anecdotes, and they were careful about what those numbers can and cannot say.

We chatted about:

• How the Breach Impact Study came together and why the DBIR team finally landed a cyber insurance claims dataset through CyberAcuView

• Why insurable loss is a floor and not a ceiling, and why reputational damage barely moved the numbers

• The decision to report medians instead of averages, including the footnote about not publishing the average so LLMs don’t spread it around

• The rise of business interruption and contingent business interruption, and the sub-limits that hid the real damage

• Whether an $83,000 median breach impact hands the wrong argument to a skeptical CFO

• The SMB paradox, where small companies can lose up to 7% of revenue while large enterprises rarely cross 2%

• Where AI actually shows up in the data, and why offense is running ahead of defense

• Third-party risk as the industry’s persistent blind spot

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to leave a rating and review, as it truly helps the show!

A few takeaways:

Insurable loss is a floor, and business interruption is what moves the needle

The study only counts dollars paid through real policies, which Alex is upfront about calling a floor rather than a ceiling of the true economic impact. The team tried to measure reputational damage a few years back by cross-referencing known breaches against stock movements and found almost nothing.

As Alex put it, from the consumer side “nobody cares anymore,” and he probably has a couple lifetimes of credit monitoring to prove it. What actually changes behavior is downtime. “The thing that will move decision making is business interruption,” he said, and the data backs him up, with business interruption landing at roughly a third of all known losses in 2024. That is the number that gets an organization to treat this as a real problem.

The average is meaningless, the distribution is the point

Alex is blunt about why the team reports medians and refuses to publish an average. “It’s just that the information is meaningless for decision making,” he said. A five million dollar average headline, like the one making the rounds from another report, tells a company nothing about the risk it is actually accepting.

The percentiles do. For companies above $250 million in revenue, the top 2.5% of cases exceeded $22 million, which is the kind of figure an operational risk team can take to a board and decide how much of the distribution they want to be covered against. The single number is comfortable. The distribution is useful.

An $83K median does not mean breaches are cheap

I raised a concern I have heard from others, that dropping a median of around $83,000 in front of an executive invites the response that breaches are survivable and it might be cheaper to just eat the cost.

Alex did not hedge. “I think that’s a bad CFO,” he said, and made the point that the person reading that figure should be someone who understands what a distribution like that means. Any large company that looks at the median and ignores that its size alone puts it in the extreme tail is not doing operational risk properly. The report’s whole argument is to plan against the extreme cases, not the midpoint.

Small companies take the hardest proportional hit

The most uncomfortable finding for me is that SMBs can lose up to 7% of revenue in the extreme cases while large enterprises rarely cross 2%. The median SMB loss is a modest $38,000, but measured against revenue and thin cash flow it becomes existential, especially since an insurance payout is not automatic and you have to survive long enough to receive it.

Alex connected this to Wendy Nather’s cybersecurity poverty line and made a point I care about deeply. Ransomware crews moved down market a long time ago and industrialized the work, so being small is no longer a defense. It just changes the size of the ask.

AI is real, but offense is ahead of defense

I told Alex I could not find AI as an obvious fingerprint anywhere in the loss numbers, and he agreed the claims data simply does not carry that detail yet. The bigger problem is structural, since the DBIR anonymizes each dataset independently and cannot cross-correlate AI-assisted attacks with claims. What he is confident about is the direction.

“Offensive AI augmentation is way, way ahead of the curve than the defensive one,” he said, and everyone assuming a tidy AI versus AI showdown is ignoring that one fighter has a mean left hook and the other has not found its footing. His practical read is to stop waiting and rethink architecture. On taking flat networks and internet-exposed edge devices seriously, his line stuck with me. “The best time to do that was fifteen years ago. Maybe the second best time is now.”

If there is one thing to do on Monday, Alex pointed at third-party risk. Supply chain incidents are the single most likely to fully exhaust a policy, which means the recorded loss is a coverage cap and not the real number. His takeaway was direct. “Do not underestimate the impact that your third party can have.” Even the insurers, who understand risk better than most of us, have been caught off guard by it.

Thanks to Alex for coming on and for putting real numbers behind a conversation the industry usually runs on vibes. Follow his work through the Verizon DBIR and the new Breach Impact Study, and find him on LinkedIn.

Subscribe now

Chenxi has seen this industry from the professor’s podium at Carnegie Mellon, the analyst seat at Forrester, the operator chair at Intel Security and Twistlock, and now the cap table, which makes her one of the most technical investors in security. She closed out my July run of conversations with security investors, and this one went deep on how AI is rewriting both the attacker’s economics and the investor’s.

We chatted about:

• Her path from professor to analyst to operator to founding Rain Capital

• The AI Exploit Age, where vulnerability discovery moves from scarce to continuous and exploitation windows compress from weeks to hours

• The Guardian Agent thesis and whether it really takes an AI to govern an AI

• How AI agent identity differs from the traditional non-human identity bucket of service accounts and API keys

• The signals that tell an early-stage investor enterprises will actually buy

• Capital concentrating at the extremes while Series B and C funding stays constrained

• What security leaders should be doing differently over the next twelve months

Prefer to listen?

Apple Podcasts

Spotify

Please be sure to leave a rating and review, as it truly helps the show!

A big thanks to Chenxi for coming back on the show. You can follow her work through Rain Capital Insights, where she writes some of the sharpest monthly commentary on where AI and security are colliding.

Subscribe now

We chatted about:

• Casey’s path from 13 years building Bugcrowd to advising, investing, and policy work

• Why more practitioners need to get involved in policy, and Casey’s framing of law as code and policy as a trailing indicator of technology

• The “slopdemic” vs. the “vulnpocalypse,” and what actually changed in the submissions hitting bounty and disclosure programs

• AI lowering the bar for a broader and less predictable pool of threat actors

• Daniel Stenberg’s arc with cURL, and what sustainable vulnerability handling looks like for maintainers below the security poverty line

• The lightning rod vs. rockets distinction between a VDP and a bug bounty, and how leaders know which one they’re ready for

• The pentest market correction underway from AI pricing pressure

• Collapsing OODA loops, planning to fail, hack-back, CFAA reform, SRLDF, and disclose.io

The vulnpocalypse was already here

Casey pushed back on the idea that AI created a vulnerability crisis. As he put it, “the vulnpocalypse was already here, it just sort of wasn’t evenly distributed.” What AI changed is the economics. The cost of discovering vulnerabilities dropped, and the cost of reporting them dropped at the same time, so both signal and noise went up roughly 10x and the delta between them got wider. That gap is the slopdemic.

I think the nuance matters here. CVE volume is on track for somewhere between 66,000 and 100,000 this year, while exploitation has stayed relatively flat. Discovery and exploitation are not the same thing, and Casey noted the cost of chaining bugs into an actual campaign has trailed the discovery work, but not by much. Vulnerability management spent years as the tedious activity nobody wanted to own, and suddenly it is at the center of the conversation again.

Everyone has a VDP, whether they like it or not

We spent a while on Daniel Stenberg and curl, which has gone from drowning in AI slop to drowning in legitimate findings. Casey gave curl full credit for running an incentivized intake program for as long as it did, and pointed out that attaching rewards was already a 10x multiplier on attention before AI arrived. His baseline is blunt. “The reality is that everyone has a VDP, whether they like it or not, they’re just maybe not getting the report.”

He was empathetic toward projects that respond by shutting everything off, but he called it what it is, “ostrich risk management.” That resonates with me. The security technical debt doesn’t go away because we put blinders on, and the maintainers carrying this load are often below what Casey calls the security poverty line, with no triage team behind them.

A lightning rod is not a rocket into a thundercloud

Casey’s readiness test for the VDP versus bug bounty question is simple. A VDP is putting up a lightning rod, anticipating the strike and routing it around damage. A bounty is proactively firing rockets with wires attached into the thundercloud. If your organization can honestly say yes to 10xing your intake, triage, remediation, and patch deployment overnight, you may be ready for a bounty. Most organizations are still struggling with the lightning rod.

He also made a point I appreciated, which is that what a bug is worth to a researcher is a separate conversation from whether a vendor is prepared to receive and act on a report. Being able to take security feedback is, in his words, part of the core social responsibility of being on the internet.

The pentest correction and our value problem

Casey said a correction is already underway in the pentest market, with AI as a big part of the downward pricing pressure because it forces buyers to ask whether they are getting value for money. His less popular theory cuts deeper. “We’ve built a lot of the cybersecurity industry on this idea of selling to people that actually don’t really care.” Buyers with a real risk reduction mandate will pay for value they can see. Everyone else is compression waiting to happen.

This hits on something I’ve long felt about our field. We struggle to communicate the value security provides because we are often trying to prove a negative. The segments of the industry that can’t defend their value are the ones most exposed to this correction.

Policy is where this all lands

We closed on the legal layer. The 2022 DOJ charging policy changes to the CFAA were real progress, but Casey noted that “intent is really difficult to discern at wire speed,” and that problem gets worse as agentic systems and even good-faith hack bots do things that look like exceeding authorized access. The Security Research Legal Defense Fund exists for the cases where a company sues good-faith researchers simply to intimidate them, and disclose.io is building the rules of the road to normalize disclosure at internet scale. Casey even went somewhere uncomfortable, saying that given our current trajectory he doesn’t see us avoiding ideas like hack-back and non-cooperative defense forever.

This is exactly why I wanted Casey on. These look like technical topics, but they carry policy, legal, and economic implications, and we need more practitioners in those rooms.

Big thanks to Casey Ellis for coming back on.

You can follow his work at cje.io, at disclose.io, and on LinkedIn.

Subscribe now

Jon founded IMlogic in the early 2000s, sold it to Symantec, and spent over a decade at NEA working with companies like Cloudflare, MongoDB, and HackerOne before starting Decibel. I’ve followed his writing on venture funding and dry powder for years, and this conversation was a chance to get outside the practitioner echo chamber and look at our industry through the investor’s lens.

We chatted about:

• Why Decibel positions itself as the Navy SEALs next to the big platform funds

• The founders-helping-founders community model and finding the CISOs who want their fingers in the clay

• What separates the founders who finish the race now that AI lets anyone start one

• Decibel’s $100M seed into Ent and why Jon calls endpoint the Super Bowl of cyber

• Separating genuinely AI-native companies from AI washing

• AI eating venture capital and why Jon thinks cyber’s best years are ahead

• The agentic SOC’s move from driver assistance to self-driving

• How buyers and prospective startup employees should evaluate young vendors

• Where Decibel places its next bets, including resilience and cyber insurance

  ---

  Thanks for reading the Resilient Cyber Newsletter! Subscribe for FREE and join 20,000+ readers to receive weekly updates with the latest news across AppSec, Leadership, AI, Supply Chain, and more for Cybersecurity.

  ---

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to subscribe and leave a review, it makes a big difference for the show!

AI is only magical if you have a magic power

Jon’s take on AI lowering the barrier to entry was one of my favorite parts of the conversation. Yes, anyone can start a company now, but that means everyone can. His marathon has gone from ten thousand runners to a million. As he put it, “AI is really only magical to the extent you have a magic power.” Founders with bespoke domain expertise will find AI amplifies it, while tourists entering cyber because it looks like a big market are in for a rough time. This squares with what I see across the vendor landscape. The AI layer is increasingly table stakes, and the differentiation still comes from hard-won security knowledge underneath it.

The Super Bowl of cyber

I asked Jon to walk me through Decibel leading a $100M seed round into Ent, founded by the team behind RiskIQ and Microsoft Security Copilot. His answer reframed the round size as commitment sizing rather than froth. Endpoint is a massive market with formidable incumbents, and Jon argues no customer should take a bet on a startup there unless the company is resourced to endure. He calls endpoint the Super Bowl of cyber, and Ent’s approach uses small AI models similar to how computer vision works in autonomous driving. In his words, it is the self-driving moment for the endpoint. Whether prevention-first endpoint security can unseat the giants is an open question, but the logic of going big or not going at all in that category makes sense to me.

AI is eating venture capital, and cyber wins anyway

Jon has tracked VC dry powder for years, and his recent writing argues AI is consuming most of the new capital through foundation model labs and infrastructure. The surprise was how bullish he is on what that means for us. One of the killer apps of AI is hacking, and that reality has pushed what once looked like a niche industry onto the global stage. He argues the market for security products has gone up dramatically almost overnight, that investment is following, and that neither shows up yet because the numbers get reported in arrears. After years of writing about markets shrugging off breaches, I think he’s right that AI risk is finally getting security the attention practitioners have begged for.

The SOC’s self-driving moment

Decibel was early into Dropzone AI, where Edward Wu started building an autonomous SOC product in the first quarter of 2023, only a few months after the ChatGPT moment. Jon’s analogy here is worth stealing. Tools like Claude Code are driver assistance for the SOC, powerful but human in the loop, while a truly autonomous product is a self-driving car that has to log a lot of miles before customers should trust it. After three-plus years and the recent leaps in foundation models, he believes we’ve hit the self-driving moment and only a small handful of companies can do autonomous end-to-end work. Given how much tedium and data overload burns out SOC teams, this is one category where I welcome the change.

From detection and response to resilience

Jon’s answer on Decibel’s next bets resonated with me for obvious reasons. Beyond novel AI models and new data sources, the bigger shift he wants is bringing business context into cybersecurity, so the industry stops feeling like a pure threat detection and response business and starts being about keeping the bank and the lights on. He sees cyber insurance and resilience as much bigger businesses than detection and response alone. You won’t hear me argue against that case on a show called Resilient Cyber. The economic framing is exactly what security has needed to earn sustained investment from the business.

Jon and Decibel are also partnering with me on Game Day at Black Hat on Tuesday, an all-day expansion of their Founders Helping Founders event with founders and early adopters on a college game day style stage. Registration link below, and if you’re in town, come hang out.

If you don’t already follow Jon, fix that. He shares some of the sharpest insights out there on the intersection of venture capital, software, and cybersecurity.

Jon on LinkedIn | Decibel

Subscribe now

I first heard Josh speak at Unprompted earlier this year and have been following his Substack ever since. He’s been writing some of the most cited pieces on the collision of AI, cybersecurity, and national security policy, and this conversation digs into the core of his diffuse or lose argument.

We chatted about:

• Josh’s path from teenage blackhat to high school teacher, defense and intelligence work, Sophos, Meta, and now his own startup

• Why restricting access to the best American frontier models harms defenders more than attackers

• How monitored closed models put threat actors at a disadvantage, and why pushing them to self-hosted open weights blinds defenders

• The jagged frontier, and why bug finding is a small slice of what attackers actually use AI for

• The national security and supply chain risks of the world running on Chinese open weights models

• Why exploits don’t cause cyberattacks, and the gap between CVE volume and actual exploitation

• The dual use ceiling on classifiers and guardrails

• Where defenders get the most from AI adoption right now, and using agents to burn down security technical debt

Prefer to listen? The episode is also available on:

Spotify and Apple Podcasts

Attackers in the panopticon

Josh’s core argument starts with how the closed labs actually operate.

Every major lab runs inline guardrails plus detection and response teams monitoring traffic, and those are the same teams publishing the threat intel reports we’ve all read from Anthropic, Microsoft, and OpenAI.

That monitoring changes the calculus for any serious threat actor weighing a frontier model against an open weights alternative. As Josh put it, “You use Fable and some team in Anthropic might catch you in your tradecraft and then send that directly to the NSA.” A rational attacker organization stands up its own GLM 5.2 inference instead, fine-tunes away the guardrails, and trains on its own trajectories.

Restriction doesn’t take the capability away from attackers. It just moves their usage somewhere we can’t see it, while defenders lose access to the best tooling. That maps to a lesson enterprise IT learned the hard way with shadow IT, and we’re now repeating it at the national policy level.

Bug finding is maybe five percent of the story

Josh thinks the policy conversation is dramatically over-indexed on frontier models finding subtle bugs somewhat faster under specific harnesses and inference budgets. The killer app for attackers so far has been social engineering, which older and open models have handled for years, alongside target research and malware coding.

“The idea that we would block American companies and American leadership over this one capability, which is maybe five percent of what the models are useful for attackers, just seems very strange to me.”

I raised the Jagged Frontier work and research showing smaller and older models finding zero days, and Josh agreed the restriction argument falls apart once you look at what attackers actually do rather than what capability just shipped. His piece on exploits not causing cyberattacks makes the same case.

We’ve had Turing test passing chat models since 2022, and the predicted social engineering apocalypse never showed up at scale. I noted the FIRST mid-year data showing CVE volume climbing toward 70,000 while exploitation stays roughly flat. The bottleneck for most attacker constituencies was never finding bugs.

The dual use ceiling on guardrails

Given his time building safety classifiers at Meta, including the open sourced Purple Llama work, I asked Josh about the classifier-heavy approach we saw in the Fable redeployment. His answer was blunt.

Security is an inherently dual use domain, so there’s a very low theoretical ceiling on blocking attackers without also blocking the researchers and defenders doing legitimate work.

“If you’re gonna block attackers, you’re gonna block defenders with these guardrails.”

His own startup builds vulnerability discovery tooling and can’t fully use frontier models for exactly this reason. That’s the self-inflicted wound in a nutshell. The people most reliably stopped by these guardrails are the ones we most need to be helping.

Burning down the mountain of security tech debt

On where defenders should actually apply AI, Josh pointed to access management and over-permissioning, SOC automation, and above all the security technical debt every large organization carries.

Open admin portals without MFA, dangling dev servers, and known vulnerabilities that never got closed. Pre-AI, security orgs were maybe three percent of the company, reduced to nagging engineering and IT to fix what they found.

His startup is building agents that own discovery, triage, comms with issue owners, and verification of the fix, including agent-to-agent communication with the engineer’s own coding agent over MCP. Having spent much of my career in AppSec and vuln management, this resonated.

So much of the job has been relationship building and chasing people rather than technical security work, and agents may finally change that equation.

Reasons for optimism

Josh closed with the structural advantages defenders hold. AI that can surveil every log line an enterprise emits, the ability to find and fix bugs before software ever ships, and sheer numbers.

“There’s a thousand times more people interested in finding and fixing the bugs than there are in finding and exploiting them.”

If it’s just a question of tokens, the remaining problem is inter-organizational politics and community structure, not capability. I share that optimism, with the caveat that incentives, bureaucracy, and speed to market pressures will make the transition bumpy before the net positive shows up.

A big thanks to Josh for coming on.

Go follow his Substack for some of the sharpest writing on AI and cyber policy, and keep an eye on what he and his co-founders are building.

Subscribe now

Sid invests at the earliest stages, seed and Series A, with a focus on cybersecurity and IT infrastructure, so he has a front-row seat to the teams building the future of this field. A lot has moved since we last spoke, from massive M&A closing to record-setting rounds in categories like the AI SOC, and I wanted to pressure test how much of it is grounded in reality.

We chatted about:

• What has actually changed a year into the AI wave, and what hasn’t, in how Foundation Capital backs formation-stage founders

• Services-as-software, the $4.6 trillion market thesis, and automating cybersecurity workflows across product security, detection and response, IR, pen testing, and threat intel

• What AI means for cybersecurity jobs, and why Sid thinks the jobs change rather than disappear

• Consolidation vs. best-of-breed after Palo Alto’s $25B CyberArk acquisition and Alphabet’s $32B Wiz deal

• AI SOC valuations, including Seven AI’s record cyber Series A, Torq crossing a $1B valuation, and Exaforce’s massive raise

• The double-edged sword of big raises, and why you can’t simply spend your way to growth in cybersecurity

• Moats and defensibility when frontier labs can replicate a chunk of your product

• The Black Hat Innovator Investor Summit and the Startup Spotlight competition

Prefer to listen?

Catch the episode on Spotify or Apple Podcasts.

Be sure to subscribe and leave a review!

Takeaways

Services-as-software is playing out, and the jobs question hangs over it

Sid’s colleagues at Foundation Capital wrote about services-as-software years ago, sizing it as a $4.6 trillion market, and he believes it is largely playing out as expected. Last year we talked about AI MDR and how managed detection would change with humans plus AI agents.

This year the aperture is wider. Sid framed it as looking at every task and team in cybersecurity, whether that’s product security, the SOC, incident response, pen testing, threat intel, or security strategy, and asking what portions of that work can be automated. That covers both external services from MSPs, MSSPs, and large consulting firms and the internal workflows of security teams themselves.

On the jobs question, Sid was direct. “I don’t worry that long term people will lose the ability to work. I think the jobs themselves will change.” I’ve been advocating the same thing for practitioners. Lean into these tools in your daily workflows now, because the adaptation is the job security.

Consolidation and best-of-breed will keep coexisting

Since our last conversation, Palo Alto closed its $25 billion acquisition of CyberArk and Alphabet finalized its $32 billion acquisition of Wiz, while players like ServiceNow keep expanding their security platforms through acquisition. I made the point that the convergence is bi-directional, with IT players moving into security and security players moving into IT, and you even see it in the workforce with leaders like Jamil at Equifax moving from CISO into broader IT leadership.

My view is that the platformization vs. best-of-breed debate never actually ends. There will always be innovative startups covering niche capabilities faster than incumbents can build them, and many of those startups will eventually get absorbed into the platforms. That cycle is the market working, not a contradiction.

Big valuations cut both ways for founders

The AI SOC category alone has produced Seven AI raising the largest cyber Series A on record, Torq crossing a billion-dollar valuation, and a massive raise from Exaforce. I pressed Sid on whether these numbers are grounded in what customers actually pay or whether the market is pricing a story ahead of the numbers, and on what happens to founders and teams who don’t grow into the valuations they accept.

The part I wanted practitioners and aspiring founders to sit with is that growth in cybersecurity is more nuanced than deploying capital. Buyers in this market behave differently, and there’s an implicit level of trust involved in procurement decisions, so you can’t simply spend your way to revenue, market share, and customers.

More capital raised means more expectation to grow into, and the congratulatory posts on social media rarely mention that side of it.

Moats in the frontier-lab era

We dug into the question every early-stage founder is wrestling with right now. If a frontier model can replicate a chunk of your product quickly, given the labs’ size, capacity, and distribution, what are investors actually underwriting, and what no longer counts as defensible? We touched on the trend of headless software, which some cyber companies are starting to move toward, and the viral rant from one of the largest defense tech companies about proprietary data as a moat, which has spurred a broader open source vs. closed source AI debate worth following.

See you at Black Hat

Sid is heavily involved in the Innovator Investor Summit at Black Hat, which brings together investors, founders, and the people building the future of this domain, and

I’m excited to be MCing it this year following Mike Privette and others who came before me. We also talked about the Startup Spotlight competition, which I’d call the World Cup of cybersecurity startups.

Thanks again to Sid for coming back on. You can follow his work at Foundation Capital and connect with him on LinkedIn.

Subscribe now

Why this conversation matters

This conversation sits right on the fault line running through AppSec today, where cheap AI discovery is burying teams in findings while the context needed to prioritize them keeps getting harder to assemble.

JJ makes the technical case for reasoning across code, architecture, and runtime at once, and Ryan Knisley grounds it in the messy reality of enterprise security, from broken metrics to tool sprawl to the uncomfortable speed at which CISOs are now being asked to trust automation.

If you build or lead an application security program, this is a clear-eyed look at what is about to consolidate and what still needs a human.

Key takeaways

• An AI security engineer beats another scanner. Gecko reasons across code, infrastructure, and documentation so a finding arrives already tied to whether it is reachable in production and what data it would expose, which is the context legacy SAST never had.

• Exploitability is decided outside the code. The product logic, architecture, and runtime that determine whether a bug matters live in design docs and Slack threads, not in the file a scanner reads, so context-free findings are mostly noise.

• Business logic will not fall to a bigger model. JJ’s example is an endpoint with no auth check, which is critical in a document store and normal in a social app, and no LLM staring at the code alone can tell the two apart without the surrounding system of truth.

• Chaining flips the priority list. As Ryan puts it, nobody attacks the lows, but the real question was always which low can get us, and connecting issues into an attack path finally answers it, sometimes demoting a paper critical and promoting ten chained lows.

• The old severity list is breaking under commoditized offense. With exploit development getting cheap and agents running campaign-level attacks, defenders working down a flat list of misaligned severities are structurally behind.

• Recurrence rate should replace MTTR. JJ argues MTTR rewards closing the same bug over and over with a fresh clock, so Gecko measures how many findings are variants of a class you already fixed and treats the class, not the ticket, as the unit of work.

• You can buy time with a one-line mitigation. When properly fixing a chain would take three teams and weeks, Gecko can identify the single link to sever and stand up something like a Lambda to kill the attack path today, borrowing decades-old SecOps thinking for vulnerabilities.

• Cal.com is the canary for open source in the AI era. AI coding tripled its pull request volume against a one-person security team, and once attackers could cheaply read every public change, openness became a liability, so it went closed source and consolidated four tools into one.

• Consolidation is about risk and people, not just cost. Ryan’s shiny object problem leaves teams unable to take vacation because one person owns a tool, and collapsing the stack buys depth, cross-training, and less complexity to defend.

• Judgment is the job that survives. As finding and fixing get automated, both guests land in the same place, that the scarce human work becomes deciding what correct looks like in your system and owning the risk you accept on purpose.

Notable quotes

“a fake metric that makes teams look good”

Ryan Knisley, on why MTTR rewards the wrong behavior.

“we’re gonna get dusted, we’re gonna get left behind, we’re gonna get absolutely owned”

Ryan Knisley, on the teams that are slow to adopt AI.

“the scarce thing left is the judgment”

JJ, on what stays human once finding and fixing get cheap.

Listen and watch

YouTube

Spotify

Apple Podcasts

Resources

Gecko Security

-> Check Out Gecko Security! <-

Subscribe

If this kind of practitioner-first take on AppSec and AI is useful to you, subscribe to Resilient Cyber for more conversations and writing on cybersecurity, AI, and the forces that shape both.

Subscribe now

Eric Doerr, the Chief Product Officer at Tenable a Resilient Cyber Partner, is not so sure.

After running security response at Microsoft and leading security products at Google Cloud, he came on to separate the genuine transformation from the noise, and his read is refreshingly grounded.

The tools changed, but the fundamentals did not, and the teams that win are the ones who finally act on that.

-> Check Out Tenable's Hexa AI <-

Why this conversation matters

Eric sits at a rare intersection, having lived the post-breach world of the SOC and now building the pre-breach world of exposure management. That vantage makes him a sharp guide to what AI actually shifts for defenders, from why cheaper discovery makes prioritization more valuable to how AI becomes its own attack surface once agents start touching your data. If you own vulnerability or exposure management and you are trying to spend your next dollar well, this conversation is a practical map of where the real risk lives and what to automate first.

Key takeaways

• Attackers are ruthlessly economical. Eric calls bad actors the perfect capitalists, spending the least effort needed to hit their goal, which is why so many still get in through unpatched basics rather than anything AI-powered.

• AI has not rewritten the offense-defense balance. The attacker only ever had to be right once, layered defense and zero trust still hold, and the real lever is accelerating your program with fewer human loops rather than lamenting the asymmetry.

• Cheaper discovery makes context more valuable, not less. Reachability and exploitability mean most findings are not worth chasing, so as AI floods teams with more of them, telling the truly scary hundred from the theoretical ten thousand becomes the whole game.

• Being too small to target is a strategy on borrowed time. As automation drives the cost of attacks toward zero, the quiet bet that adversaries will hit weaker neighbors stops paying off, and Eric would move off that mentality now.

• Humans should not be the bottleneck on every fix. Getting the workflow and tooling right is most of the work, and the rest is the organizational willingness to let validated automation act, even when a business partner would feel better with a human in the loop.

• AI is special and not special at the same time. It is mostly just another attack surface, and Eric estimates 80 to 90 percent of securing it maps to patterns the industry already learned during the move to cloud.

• Shadow AI is the first surprise in almost every environment. When teams scan the endpoints they already interrogate for AI artifacts, nearly all of them find something they never sanctioned, which is why discovery has to come before control.

• The real AI risk is interconnection. A misconfigured database was a needle in a haystack until you wire it to an agent, and then a harmless question about the budget quietly returns data the asker should never see.

• Most breaches are not even CVEs. Citing the Verizon DBIR, Eric notes roughly two-thirds of breaches trace to misconfigurations, and since about a third of Tenable’s findings are non-CVE, a third of your findings can carry two-thirds of your risk.

• Agentic automation is finally killing the toil. Early users are automating drudgery like asset tagging and full remediation workflows, with one manufacturing customer letting automation handle 80 to 90 percent and scheduling the rest for change windows with a human notified.

Notable quotes

“Bad actors are the most perfect representation of capitalism”

Eric Doerr, on why attackers do the least work necessary and often skip AI entirely.

“a third of their findings are two-thirds of their risk”

Eric Doerr, on why misconfigurations, not CVEs, drive most breaches.

“you’re on the wrong side of history”

Eric Doerr, on insisting a human eyeball every automated fix.

Listen and Watch

YouTube

Spotify

Apple Podcasts

Resources

Eric Doerr on LinkedIn

Tenable AI Exposure and Hexa AI, part of Tenable One

Subscribe

If this kind of grounded, signal-over-noise take on exposure management is useful to you, subscribe to Resilient Cyber for more conversations and writing on cybersecurity, AI, and the forces that shape both.

Subscribe now

He was the first investor in Protect AI, which sold to Palo Alto Networks in a reported ~$700M exit roughly a year before ChatGPT launched, and he is early in companies like Keycard, Surf AI, and June.

I read a lot of Ed’s content because he sits outside the security echo chamber and looks at this market through a CTO, CIO, and investor lens. That perspective made for one of my favorite conversations in a while.

We chatted about:

• Why a day-one partnership looks different now that anyone can vibe code an MVP

• The Protect AI acquisition and what the first exit in AI security signaled to the market

• Competing as an inception fund against mega-funds writing giant seed rounds

• What founders should actually look for in a venture partner beyond the check

• The shift from building intelligence to controlling it, with routing, post-training, and on-prem deployment

• Why enterprise data, workflows, and private evals are becoming the crown jewels

• Vulnerability chaining, attack path reasoning, and how tools like Mythos are reshaping the security budget conversation

• Agentic identity and why Keycard treats agents as short-lived problem solvers rather than digital twins

• The Surf AI thesis on automated security hygiene and tying every asset back to an owner

• The real bottleneck slowing agent adoption in the enterprise

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to subscribe and leave a review, it makes a big difference for the show!

The bar for a cybersecurity startup just went way up

Ed was blunt about the state of the market. “The world needs more cybersecurity, but we don’t need all the cybersecurity companies that we have right now.” Anyone can build now, and a moat that used to last twelve or eighteen months can get copied in a fraction of that time. So a good cyber idea is table stakes, not a differentiator.

What he looks for underneath the idea is depth on the AI side. He wants to know whether a founder is going to build or post-train their own model, how deep the moat and the flywheel go, and how deep the product gets into customer environments. That is a real shift in what earns a day-one check, and it is worth internalizing if you are a practitioner trying to read which startups will still be here in a few years.

From building intelligence to controlling it

The through line of the whole conversation was Ed’s argument that the first era of AI was about building intelligence and the next one is about controlling it. Once the frontier labs filed to go public, the tokenomics stopped being a rounding error, and enterprises started routing queries so they are not paying for state-of-the-art on every request. From there it is a short hop to post-training open models and asking why you would hand your data to a third party at all.

He put the incentive problem in memorable terms. “I think the biggest heist ever happening right now is that OpenAI and Anthropic created their own forward deployed engineering companies.” His point is that the data leaving your company is not just data, it is a map of how your company works, and your private evals are the thing you least want a competitor’s model to learn from. This is where I think a brand new set of security problems opens up around model hosting, lineage, and the security of running these things in your own environment.

Vulnerability chaining makes reasoning the whole game

We spent real time on what reasoning models do to vulnerability management, which is squarely in my wheelhouse. For years we prioritized the top criticals and highs by severity score and largely ignored the mediums and lows. Ed’s framing is that these models change that math. “Take 10 vulnerabilities that might have been on the backlog and you staple them together and create an attack path. When you create an attack path and these things can reason, that’s crazy.”

That is the industrialization of vulnerability discovery and exploitation, and it cuts both ways. The same capability that lets a defender do continuous attack path reasoning is available to the attacker, and the tooling we built to manage all of this, from CVE databases on down, is already straining under the volume. Ed also tied it to the budget conversation, noting that the worry is not whether continuous reasoning works, it is what it costs when you run it against all of your code, cloud configs, identities, and network state.

Agentic identity is becoming its own category

Ed funded Keycard two years ago and made a strong case that agent identity is not a feature that gets absorbed, it is a category. His description of the primitive is the clearest I have heard. “If you believe that every agent should have its own identity, that it shouldn’t go through Chris or Ed, if you believe they should be ephemeral and dynamic, and you believe that there should be an audit trail, and then if you can cryptographically prove that the agent is not hacked in the whole process, that’s what we’re building.”

What I appreciated is that he does not think one vendor wins the whole thing. Large incumbents will take share, and a few companies that treat this holistically rather than as a single point product will win alongside them. He also credited the community-building work here, specifically Keycard bringing in Ali Howe and the Insecure Agents podcast, which is on my own go-to list for learning about agentic IAM.

The bottleneck is not tooling, it is knowing where to start

I closed by asking Ed what actually holds back agent adoption when only a small percentage of organizations have agents in production. His answer was refreshingly human. “Most people don’t even know where to get started.” Coding works and gets most of the token spend, but the business workflows are largely untouched, and the whole landscape is confusing about which model, which platform, and which first workflow to automate.

That is why the easy-button players like Palantir have pull, and why Ed thinks there is room for many easy buttons rather than one lab dominating everything. It also lands on a theme he and I share. There will be people who look at this moment and feel overwhelmed, and people who look at it and feel invigorated, and it is the second group that ends up thriving. As Ed put it, security now needs hardcore AI people, the ones who build models, to come into the field, and we are already seeing it happen.

Thanks to Ed for coming back on the show. Follow his newsletter, What’s Hot in Enterprise IT/VC, and connect with him on LinkedIn for some of the sharpest content on enterprise infrastructure, AI, and security investing.

Subscribe now

Why this conversation matters

Jerry runs RogoLabs, built CVE.ICU, and co-authored the FIRST mid-year forecast, which makes him one of the few people who can explain what is really driving the surge instead of just reacting to it.

He walks through why a single source, GitHub, is responsible for so much of the growth, why most of these findings are old debt rather than new danger, and why the NVD breaking down is forcing a long-overdue reckoning for the CNAs. If you own vulnerability management, this is a practical guide to tuning out the noise and triaging what counts.

Key takeaways

• The 70,000 number is real, but one source is inflating it. CVEs are up more than 40 percent year over year, and GitHub alone now publishes one in five of them after scaling up its advisory team.

• Three very different forces get lumped into one scary figure. AI-assisted discovery that no CVE record actually flags, a 449 percent jump in GitHub security advisories where a script downloaded ten times can earn the same CVE as a Windows flaw on a billion devices, and VulnCheck operating as a CNA of last resort are each driving volume for different reasons.

• Rain versus flood is the whole point. Total CVE volume is climbing fast, but once you filter for CISA KEV and EPSS, the genuinely exploitable risk has stayed essentially flat, so it is raining without flooding.

• Most of the surge is 25 years of human debt finally getting found. The OWASP Top 10 has barely changed since it was first published, and AI tooling is simply surfacing the same old mistakes at scale rather than inventing new danger.

• The AI panic is being put to good use. Jerry’s optimistic read is that teams are using the hype to win budget and cycles to patch long-known issues, and a finding from a shiny AI tool tends to get fixed faster than the same finding from last year’s pentest.

• The NVD was the dam that fell. It was never reasonable to expect one small organization to enrich every CVE for the whole world, so the burden now returns to the CNAs and the large vendors that quietly relied on it to clean up their records.

• Treat CVE data as a product you pay for. Jerry’s most actionable advice is to use procurement leverage, since demanding better CVE records before renewing a contract is one of the only forcing functions that reliably moves vendors.

• What actually gets exploited has not changed. VPN concentrators and the same familiar vulnerability classes still dominate, the NSA’s annual top 10 exploited bugs are reliably old, and there is no sign yet of AI driving widespread attacks.

• The unsolved problem is still asset inventory. You cannot triage what you cannot see, and most organizations still cannot say with confidence whether they even run the software behind a given pile of CVEs.

• AI-accelerated exploitation will look like patience, not mass exploits. The real shift is a tireless attacker that loops on your network for days until it finds a way in, which is precisely what agents are good at.

Notable quotes

“GitHub is now publishing one in five CVEs”

Jerry Gamblin, on what is really behind the record numbers.

“the NVD was the dam that fell”

Jerry Gamblin, on why responsibility now shifts back to the CNAs.

“we really need to start having people see CVE data as a product that they’re paying for”

Jerry Gamblin, on the one forcing function that actually moves vendors.

Listen and watch

YouTube

Spotify

Apple Podcasts

Resources

CVE.ICU

RogoLabs

FIRST 2026 mid-year vulnerability forecast

CISA KEV Catalog

EPSS

Subscribe

If this kind of signal-over-noise take on vulnerability management is useful to you, subscribe to Resilient Cyber for more conversations and writing on cybersecurity, AI, and the forces that shape both.

Subscribe now

He has spent twenty-five years in this field, from writing bcrypt to running security at Google and Stripe, and he came on to make a calmer and more uncomfortable argument, that the panic misses the point and the real fix is one we have understood for decades.

Why this conversation matters

Niels is about as technical as guests get, which is what makes his conclusion striking, because he keeps landing on incentives rather than technology.

He showed that finding zero days does not require a frontier model, then argued that this changes far less than the headlines suggest, because companies already drown in vulnerabilities and the answer was never to find or patch faster.

If you are a security leader deciding where to spend in the AI era, this conversation reframes the problem from a discovery race into a question of structural guarantees and the incentives that decide whether anyone actually builds them.

Key takeaways

• Finding zero days is an orchestration problem, not a frontier-model problem. Niels built a finite state machine workflow on his Iron Curtain runtime, pointed an open-weight model at it, and surfaced net-new zero days, which shows the alarming capability was already here six months before Anthropic’s Mythos report made headlines.

• The harness is what makes weaker models dangerous. Models lose the plot over long tasks and take shortcuts because they are trained to please and to finish, so decomposing the work into bounded stages, each with a fresh context and a tight prompt, gets reliable results that a single sprawling prompt never would.

• The Vulnpocalypse is overstated. Companies already hold more vulnerabilities than they can manage, so a flood of new ones does not change the strategic picture, and Niels is blunt that the hyperbole mostly exists because it drives engagement.

• Security invariants make whole classes of bugs irrelevant. Rather than patching individual flaws, an invariant is an infrastructure guarantee that is systematically enforced without ongoing human judgment, an old idea that Google executed well and most organizations still skip.

• Egress control is the invariant to start with. When a production service can only reach a few known domains, most vulnerabilities cannot fetch a second-stage payload, so the exploit chain breaks before it does real damage.

• The log4j weekend is the proof. As head of security at Stripe, Niels took a full three-day weekend during log4j because egress control meant the malicious Java class could not be downloaded, turning a five-alarm fire into something his team could patch on its own schedule.

• Remediation is the bottleneck AI has not cracked. The hard part of fixing is not writing the patch, it is knowing you have not broken working code in production, and that quality bar keeps remediation slow even as discovery gets cheap.

• AI coding tools quietly route around your security. Asked to add an endpoint to a carefully structured project, the model ignored Niels’s authenticated-route abstractions and wrote raw code, which is why he wants frameworks that are secure by default rather than dependent on the model behaving.

• Open source maintainers are the highest-leverage place to invest. They power the largest companies in the world for free yet often cannot afford the tokens to use modern AI tooling, so empowering them to fix vulnerabilities benefits everyone downstream at once.

• It comes down to incentives, not technology. Companies do just enough to avoid looking negligent because they are built to maximize profit, so Niels argues that accountability regulation like Europe’s NIS2, not better tooling alone, is what actually shifts behavior.

Notable quotes

“you don’t need the latest and greatest models to find vulnerabilities very, very quickly”

Niels Provos, on why this is an orchestration problem rather than a frontier-model problem.

“it’s not the technology, it’s the incentives.”

Niels Provos, on what actually has to change for security to improve.

“technology isn’t really the solution. We know how to solve all of these problems.”

Subscribe

If this kind of structural, incentives-first take on security is useful to you, subscribe to Resilient Cyber for more conversations and writing on cybersecurity, AI, and the forces that shape both.

Subscribe now

Now it is one of the hottest topics in security, and not for flattering reasons. Attackers turned exploitation into the number one path into organizations, and AI has poured complexity on top of an ecosystem whose public infrastructure was already buckling.

Patrick Garrity has been tracking all of it from inside VulnCheck, and he came back on the show to separate what is real from what is marketing.

Why this conversation matters

Patrick is one of the few people who digs to the bottom of the vulnerability data instead of reacting to the headline. In this conversation he walks through the real state of the NIST National Vulnerability Database, audits the transparency behind one of the loudest AI vulnerability programs, and explains why the flood of AI-discovered bugs does not solve the problem most teams actually have.

If you own vulnerability management, or you are trying to size how much of the AI security wave is signal, this is a grounded reality check from someone who shows his work.

Key takeaways

• Vulnerability management got hot because the attackers moved. Exploitation is now the leading initial-access vector, and as Patrick notes, attention follows the attacker, which is why a discipline everyone once dreaded is suddenly the center of the conversation.

• The NVD did not just fall behind, it lost its footing. A recent report quietly confirmed that CISA stopped funding the NIST NVD and that NIST lost roughly half its funding, with no real plan to clear the backlog, and the duplicated enrichment effort between agencies left defenders absorbing the damage.

• Calling the NVD a government-only resource rewrites history. It ran as a public good for everyone for about twenty-five years, so telling smaller organizations they are now on their own lands hard, especially as a new AI executive order proposes yet another clearinghouse without resolving the coordination failures that broke the last system.

• The first AI disclosure wave is measurable and real. CVE volumes jumped 563 percent for Chrome and GitHub advisories climbed 470 percent year to date, and Patrick did the unglamorous work of separating genuine AI-assisted discovery from AI slop and from bugs that simply live inside AI products.

• The Glasswing ledger is where the marketing met the receipts. Patrick found roughly 80 related vulnerabilities in his own tracking while the public ledger showed 27, several had passed their own 90-day disclosure deadline, and nothing had been updated in two weeks, which is why he is pushing for follow-through rather than disputing the underlying work.

• Finding bugs is cheap now, and that is exactly the problem. Discovery was never the real constraint, and AI makes it cheaper, so the bottleneck moves downstream to the human-heavy coordinated disclosure and remediation process that AI does almost nothing to speed up.

• Exploitation is sustaining, not exploding. CISA KEV and VulnCheck KEV track similar volumes year over year, in part because attackers already have a surplus of targets and in part because the world can only count the exploitation it has the capacity to detect.

• AI is pushing the security poverty line up before it pushes it down. The most capable discovery tooling is gated behind cost and access, so well-funded teams pull ahead while smaller organizations, who cannot staff the expertise to weaponize open-weight models defensively, fall further behind.

• The economics are a loop, and the loop is the business model. AI accelerates the findings and the attacker velocity, then gets sold back as the remediation, so organizations pay to create the demand and pay again to satisfy it, all on consumption pricing that collides with finite budgets.

• It probably gets worse before it gets better. Patrick’s read is that real change waits on more pain, clearer market incentives, or regulation, because responsibility ultimately sits with the vendors and maintainers shipping the defects, and some products simply need to be deprecated.

Notable Quotes

“the attention flows to wherever the attacker goes”

Patrick Garrity, on why vulnerability management is suddenly everywhere.

“That’s not where the bottleneck is. The reality is the bottleneck is downstream.”

Patrick Garrity, on why cheap AI discovery does not fix the core problem.

“I don’t dispute these numbers. I don’t dispute that this is real.”

Patrick Garrity, on auditing the Glasswing ledger and the gap between the claims and the follow-through.

Listen and Watch

YouTube

Spotify

Apple Podcasts

Please be sure to like and subscribe!

If this kind of receipts-first take on vulnerability management and AI is useful to you, subscribe to Resilient Cyber for more conversations and writing on cybersecurity, AI, and the incentives that shape both.

Subscribe now