Latest / Cybersecurity Perspectives / S1:E3 - 130 Vulnerabilities Disclosed A Day in 2025 & 29 Minute Average Breakout Time in 2026

Transcript

S1:E3 - 130 Vulnerabilities Disclosed A Day in 2025 & 29 Minute Average Breakout Time in 2026 · Cybersecurity Perspectives

• 0:00
  SPEAKER_01: All right.
• 0:01
  SPEAKER_01: Well, here we are.
• 0:02
  SPEAKER_01: I guess welcome back.
• 0:04
  SPEAKER_01: Welcome.
• 0:04
  SPEAKER_01: I guess it is welcome back.
• 0:06
  SPEAKER_01: I mean, we've done we've done bonus content.
• 0:08
  SPEAKER_01: You know, that's been cool to release that.
• 0:10
  SPEAKER_01: And we've put that on our socials a bit.
• 0:11
  SPEAKER_01: Got some decent feedback from that.
• 0:13
  SPEAKER_01: But I guess, yeah, this is welcome back, but first inaugural, like we're going to eat our own dog food, do the show and the proper structure kind of thing.
• 0:20
  SPEAKER_00: Yeah.
• 0:21
  SPEAKER_00: I mean, we have to mess it up first, right?
• 0:22
  SPEAKER_01: So, you know what?
• 0:25
  SPEAKER_01: I feel like this entire thing is going to be a train wreck, but we're going to have fun doing it, right?
• 0:29
  SPEAKER_01: It's going to be a good opportunity, build some community, talk with some folks, meet some people from outside industries we've never met before.
• 0:35
  SPEAKER_01: So yeah, man, I'm I'm looking forward to this thing.
• 0:37
  SPEAKER_01: I'm really psyched about it.
• 0:39
  SPEAKER_01: 110%.
• 0:40
  SPEAKER_01: Um definitely looking forward to trying to give it a go this first one.
• 0:43
  SPEAKER_01: Absolutely.
• 0:44
  SPEAKER_01: Any so any wild stuff this week?
• 0:46
  SPEAKER_01: Anything crazy happening to you this week or anything that you kind of read about or saw in the news?
• 0:50
  SPEAKER_00: Um, not necessarily particularly that trying to get caught back up on the real world um coming off of Black Hat and Vacation.
• 0:56
  SPEAKER_00: It really stifles kind of uh daily output, if you will.
• 0:59
  SPEAKER_01: Dude, I was compressed for two weeks.
• 1:01
  SPEAKER_01: Like meetings were backed up, like work had to get done.
• 1:04
  SPEAKER_01: But it's important.
• 1:05
  SPEAKER_01: It's important to get out there and see what's in the industry and see what's happening.
• 1:08
  SPEAKER_01: 110%.
• 1:09
  SPEAKER_01: Yeah, man.
• 1:10
  SPEAKER_01: So I did see this wild article this week.
• 1:12
  SPEAKER_01: And apparently Anthropic is going to start like watermarking content that they're producing, right?
• 1:18
  SPEAKER_01: So like people can understand now like what's being produced by AI and what's not.
• 1:22
  SPEAKER_01: Uh what do you think about that?
• 1:24
  SPEAKER_00: Um I think it's what the industry's been asking for, at least the common user, to say, how do I know things are driven via AI or not?
• 1:32
  SPEAKER_00: Um I think this is the world of copyright, right?
• 1:35
  SPEAKER_00: It's nothing that new.
• 1:36
  SPEAKER_00: Um I'm appreciative that some of the AI content is moving towards this.
• 1:41
  SPEAKER_00: Um, but again, I I think it's also a band aid on a larger issue or a problem, right?
• 1:46
  SPEAKER_00: And that's just uh the fidelity on how this has been done, right?
• 1:49
  SPEAKER_00: Or how often will happen, how what's the quality of it, right?
• 1:52
  SPEAKER_01: Um, so again, I think it's a new bells and whistles in the industry, but I mean, like, I I'll I'll definitely like I'll admit to you and the audience, it caught me off guard.
• 2:01
  SPEAKER_01: Like, I knew this was coming.
• 2:02
  SPEAKER_01: I knew in my art of hearts, like generative AI had gotten so good that it's getting really, really hard to figure out like what is actually real, what is not.
• 2:11
  SPEAKER_01: And then of course we see article after article, this this big accounting firm use AI, this big consulting firm used AI, and the reports were wrong.
• 2:19
  SPEAKER_01: We're starting to see things where people are using them in litigation and like it's producing like, you know, poor citations for case law.
• 2:25
  SPEAKER_01: So like I knew that this stuff was coming.
• 2:27
  SPEAKER_01: Um, but it's kind of interesting to like have it be real now, you know?
• 2:31
  SPEAKER_00: Yeah, I don't know.
• 2:32
  SPEAKER_00: I mean, I think it's the application of how people use it, right?
• 2:35
  SPEAKER_00: Um, I know internally with us, um, we use it as a tool, just like Microsoft Excel or Word or anything else that's out there, right?
• 2:42
  SPEAKER_00: Yeah.
• 2:42
  SPEAKER_00: Um, some people already think are using this too much and they're looking to have final output of a product to be solely AI driven.
• 2:49
  SPEAKER_00: Um again, I think from a service-based perspective, right?
• 2:53
  SPEAKER_00: Um CPA firms or law firms that use that to do end-to-end, I think they're making a mistake on that.
• 2:59
  SPEAKER_00: Um, but I'm not as concerned with a watermark or use of AI within helping to be more efficient to get to my end product, right?
• 3:07
  SPEAKER_00: And if I need citation for that, fine, I guess.
• 3:10
  SPEAKER_00: Um, but again, I'm not seeing other places say that, hey, I use SPSS when I was there to crunch out numbers, right?
• 3:16
  SPEAKER_00: They don't advertise that internally.
• 3:18
  SPEAKER_00: Right.
• 3:18
  SPEAKER_00: So it's like, what are we advertising here for, right?
• 3:21
  SPEAKER_00: If we can't trust our product or cite our product properly, I don't know what watermark's gonna do for it.
• 3:26
  SPEAKER_01: Yeah, definitely interesting.
• 3:28
  SPEAKER_01: And and definitely interesting to see like how it's actually applied, who leans into it, who doesn't lean into it.
• 3:33
  SPEAKER_01: Like it's definitely gonna be, and the thing I still don't understand is like how they're gonna do it from a text perspective.
• 3:37
  SPEAKER_01: I gotta do some more research from that perspective.
• 3:39
  SPEAKER_01: I get the I get the image stuff.
• 3:40
  SPEAKER_01: They'll be able to lay the the watermark within the image, within the image pixels itself.
• 3:44
  SPEAKER_01: But like the text, I don't know.
• 3:46
  SPEAKER_01: Is it gonna be a sequence thing?
• 3:47
  SPEAKER_01: Whatever.
• 3:48
  SPEAKER_01: We'll let them solve those problems.
• 3:49
  SPEAKER_01: I'll also be curious to see who follows suit, right?
• 3:51
  SPEAKER_01: If anthropic is the first one out of the gate, who's next?
• 3:54
  SPEAKER_01: Is it Gemini?
• 3:55
  SPEAKER_01: Is it Chappy GPT?
• 3:56
  SPEAKER_01: Have they already been doing these things?
• 3:57
  SPEAKER_01: We just don't know.
• 3:58
  SPEAKER_00: Uh we'll see.
• 3:59
  SPEAKER_00: We'll kind of see how it goes.
• 4:00
  SPEAKER_00: Yeah, it'll be interesting too to see how you it works from a licensing perspective as well, right?
• 4:04
  SPEAKER_00: If I'm a paid client, do I actually have to have that watermark?
• 4:06
  SPEAKER_00: Do I not?
• 4:08
  SPEAKER_00: Good point.
• 4:08
  SPEAKER_00: Um again, right?
• 4:09
  SPEAKER_00: A lot of this is for mass public consumption.
• 4:12
  SPEAKER_00: Um, and that's I think a fair opportunity to use that, right?
• 4:15
  SPEAKER_00: Teachers are gonna love this.
• 4:16
  SPEAKER_00: I'll try.
• 4:17
  SPEAKER_00: Okay, now I get to see where this has been used or generated by AI.
• 4:20
  SPEAKER_00: Um, so yeah, we'll we'll see.
• 4:22
  SPEAKER_00: But again, for I think the the heavy power users of this, um, not much has changed.
• 4:26
  SPEAKER_00: Um, potentially reputation play with your clients, but that's the same thing as anything else that you do uh an output of product, right?
• 4:32
  SPEAKER_01: Yeah, pretty interesting.
• 4:34
  SPEAKER_01: All right.
• 4:34
  SPEAKER_01: I think it's time to get into it.
• 4:36
  SPEAKER_01: I think it's time to lean into to how we've designed, you know, kind of this podcast.
• 4:41
  SPEAKER_01: In fact, Owen, like this is one of the things that you had brought up.
• 4:43
  SPEAKER_01: You this format that we're gonna lean into here, this comes from a different podcast we're borrowing it from, correct?
• 4:48
  SPEAKER_00: Yeah, I definitely have to give shout-outs um in recognition, right, from a psychation perspective, that Wildcard uh hosted on the NPR um podcast network is where this really sparked the idea from.
• 5:00
  SPEAKER_00: Um and so having the kind of the three-card layout, right?
• 5:04
  SPEAKER_00: And again, order of we're using A, B, and C to distribute those three piles, um, and then just make a choice at random, right?
• 5:12
  SPEAKER_00: Um doesn't have to be in order, and it kind of flips a card and allows for a talking point, right?
• 5:17
  SPEAKER_00: Whether it's statistic, uh a quilt, um a theme within uh cybersecurity or adjacent industries to really just help to spark conversation and open up how people think about things um that are vastly different from ourselves.
• 5:31
  SPEAKER_00: So that's kind of the gist of it.
• 5:32
  SPEAKER_00: Um and we're gonna kind of see how this plays out.
• 5:35
  SPEAKER_01: I know, I know.
• 5:35
  SPEAKER_01: And and look, I gotta say, I love this because for me, this is about shared vulnerability, right?
• 5:41
  SPEAKER_01: You, me, we don't know what the what the actual statistic is gonna be.
• 5:46
  SPEAKER_01: The guest isn't gonna know when they join.
• 5:48
  SPEAKER_01: We're truly coming at this from a shared vulnerable space.
• 5:51
  SPEAKER_01: And the guest is gonna be allowed to pick whichever card they want to pick.
• 5:55
  SPEAKER_01: They'll we'll hit them with that statistic, and then we get to talk about what does that mean for you?
• 5:59
  SPEAKER_01: What does that mean for your business?
• 6:00
  SPEAKER_01: What does that mean for your industry?
• 6:02
  SPEAKER_01: And like to get these different perspectives from people across like the different industries that we don't typically interact with, with companies we don't typically interact with, like it's kind of exciting to get out of our bubble, right?
• 6:14
  SPEAKER_01: To be to get away from kind of the enterprise financial services network that we've we've built up and used forever, right?
• 6:20
  SPEAKER_01: But like to be able to see like what does this mean for someone in a different, uh, in a different county or a different state or a different part of the world.
• 6:27
  SPEAKER_01: Um, so in honor of this, Owen, because this was your idea, I would like you to pick the very first card.
• 6:34
  SPEAKER_01: So we have three cards laid out.
• 6:35
  SPEAKER_01: We have card A, card B, card C.
• 6:38
  SPEAKER_01: Don't necessarily know what's going to be on these cards, but why don't you go ahead and select and uh and let's let's go for it.
• 6:44
  SPEAKER_01: Just like my default in the SAT exam.
• 6:46
  SPEAKER_01: See.
• 6:46
  SPEAKER_01: C.
• 6:47
  SPEAKER_01: All right.
• 6:47
  SPEAKER_01: We're going for the last one.
• 6:49
  SPEAKER_01: Interesting.
• 6:49
  SPEAKER_01: You know, before we pick, I was a little worried about that.
• 6:52
  SPEAKER_01: I was a little worried about using ABC.
• 6:54
  SPEAKER_01: Because like, I don't know, like, is there a psychological thing where people will typically pick A or or or like the first card?
• 7:00
  SPEAKER_01: I was wondering if we need to change this to like circle square triangle.
• 7:04
  SPEAKER_00: I think there's always gonna be an inherent move towards something, and it's always gonna trigger someone's mind in some fashion when you use any form of icon or order system.
• 7:13
  SPEAKER_00: Um, so I would say irrelevant.
• 7:15
  SPEAKER_01: Irrelevant.
• 7:16
  SPEAKER_01: Awesome.
• 7:17
  SPEAKER_01: All right.
• 7:17
  SPEAKER_01: Well, let's go ahead and go for it.
• 7:18
  SPEAKER_01: We're gonna go ahead and pick card C.
• 7:21
  SPEAKER_01: And the card that you chose on is a statistic that comes from 2025.
• 7:26
  SPEAKER_01: So in 2025, the vulnerability data came out that there were roughly 130 vulnerabilities discovered per day and disclosed.
• 7:35
  SPEAKER_01: So now we're talking about things like volume.
• 7:37
  SPEAKER_01: We're talking about things like, you know, uh, you know, the actual speed at which things were being disclosed and what that meant for people's attack surface in 2025 as they're trying to keep up with all of this information coming at them and keeping their and keeping their organization safe.
• 7:52
  SPEAKER_01: So let's start with it.
• 7:54
  SPEAKER_01: Well, you read this card initially, what does that mean to you?
• 7:57
  SPEAKER_00: Yeah, again, um, I think 130 attacks per day um reported, right?
• 8:04
  SPEAKER_00: So there's a couple of different things that are interesting there.
• 8:06
  SPEAKER_00: One is the reported nature that doesn't speak to all the other ones that are out there that aren't actually being recorded, right?
• 8:12
  SPEAKER_00: So it's a disability play.
• 8:14
  SPEAKER_00: Um, the other element for me is just the unsurmountable tasks that vulnerability teams kind of are faced with, right?
• 8:21
  SPEAKER_00: Um, and how to basically I don't want to say it's easy to identify vulnerabilities, but that's always the biggest problem is it's one thing to identify, but then how do we actually ingest that and actually prioritize and remediate that?
• 8:34
  SPEAKER_00: Every single vulnerability isn't gonna have the exact same impact for every single organization.
• 8:38
  SPEAKER_00: Um, so it's the notion of kind of slowing down with some of these things and really understanding what is the impact um for your organization specifically.
• 8:47
  SPEAKER_00: Um, but yeah, these numbers are daunting, right?
• 8:50
  SPEAKER_00: If you look at the global numbers versus just your individual organization, this is where that notion of feeling overwhelmed and drained and not really having an opportunity for a solution.
• 9:00
  SPEAKER_00: Um but these are one of the numbers too, as I got more in developed with cybersecurity, is it's less of a scare when you start to see these things.
• 9:07
  SPEAKER_00: Um, but it is honestly really important to understand, like you're saying before, how does this cover across our entire environment, right?
• 9:15
  SPEAKER_00: Um, because they're usually going to be or never located in just one specific spot, right?
• 9:19
  SPEAKER_00: It's gonna be throughout your network.
• 9:20
  SPEAKER_01: You're spot on.
• 9:21
  SPEAKER_01: Like this is one of those things where it's definitely shock and awe.
• 9:24
  SPEAKER_01: Like you see that, and immediately your brain goes to like, oh my God, what's the math?
• 9:28
  SPEAKER_01: Right.
• 9:28
  SPEAKER_01: So like while you were talking, I did some math.
• 9:30
  SPEAKER_01: This works out to a total number of vulnerabilities disclosed, right?
• 9:34
  SPEAKER_01: Actually released in via, you know, the the you know, the the CVS scores, via vendor releases, whatever they were, to 47,450 in 2025 based on this average.
• 9:47
  SPEAKER_01: Might be a little higher, might be a little less, right?
• 9:49
  SPEAKER_01: But this was the statistic we came across.
• 9:51
  SPEAKER_01: Now, what's interesting is like, yes, immediately that's terrifying, but I think you're actually right, right?
• 9:55
  SPEAKER_01: Like the thing is, not all vulnerabilities one are created equal.
• 9:59
  SPEAKER_01: That's number one.
• 10:00
  SPEAKER_01: Two, not all vulnerabilities are gonna apply to every organization, right?
• 10:03
  SPEAKER_01: Depends on your tech stack, depends on your exposures, depends on what applications people are using.
• 10:09
  SPEAKER_01: So, like the example I love to give is, you know, where we use Microsoft, right?
• 10:13
  SPEAKER_01: So that means email is gonna fall to the Microsoft product exchange.
• 10:17
  SPEAKER_01: So if there's a disclosure for something like IBM Lotus Notes, well, all right, so what?
• 10:22
  SPEAKER_01: Doesn't matter, right?
• 10:23
  SPEAKER_01: They can be the worst vulnerability on the planet.
• 10:24
  SPEAKER_01: It doesn't apply to us.
• 10:26
  SPEAKER_01: The other thing that comes to mind here is like a couple of years ago, there was a very, very cool project that came out where it wasn't just C VSS.
• 10:33
  SPEAKER_01: And C VSS talked about like how bad the app, the vulnerability was, like what it allowed an attacker to do and how that attacker could utilize that for whatever the end game was gain access, bypass, you know, cross-stage scripting, whatever.
• 10:46
  SPEAKER_01: Like the the number of attacks that could be tied to these vulnerabilities is almost limitless.
• 10:51
  SPEAKER_01: But what's cool is a couple of years ago, this new project came out that was basically ties to EPSS, right?
• 10:57
  SPEAKER_01: So where C VSS talks about criticality, EPSS talks about how easy or hard it is to use a vulnerability in order to actually enact the exploit.
• 11:08
  SPEAKER_01: Is it trivial?
• 11:09
  SPEAKER_01: Is the exploit as simple as like pushing a button and running a single line command that automatically gives you remote code execution?
• 11:17
  SPEAKER_01: Or does it require multiple steps, including capturing packets on the wire, modifying the packet, sending it to the target, and then you know taking 17 or 18 different steps after that?
• 11:27
  SPEAKER_01: So I think I think what I'm thinking here is like you think about this statistic, 130 a day, 47,000 over the course of the year in 2025, immediately it's shock and awe, immediately it's fear, immediately it's like how do we keep up with these things?
• 11:41
  SPEAKER_01: But then as we start to break it down to your point, what applies to us?
• 11:44
  SPEAKER_01: And then for the ones that actually apply, how easy or hard is it for them to actually exploit us?
• 11:49
  SPEAKER_01: I mean, I feel like that's really what makes this a little bit more manageable, as long as we can gain that visibility for our organizations individually.
• 11:57
  SPEAKER_00: Yeah, I think that's the hardest, it's easy to say here to do, um, but I think that's the hardest thing to establish through your organizational teams.
• 12:03
  SPEAKER_00: Um, to getting the knowledge of having the span of all vulnerabilities, but then getting someone that actually knows not only your network from a systems perspective, but can actually dive down deep into the actual coding languages that your systems require.
• 12:17
  SPEAKER_00: Right.
• 12:18
  SPEAKER_00: So to your point, is if it requires an insider threat that actually has credentials that has to be on-prem, it makes it vastly more difficult for someone to exploit that, right?
• 12:27
  SPEAKER_00: Um, but being able to get these this information and having internal knowledge of how likely things are, and then what's the expectation of that to occur.
• 12:35
  SPEAKER_00: Like we're talking about multiple teams within a cybersecurity organization that have to do that, right?
• 12:39
  SPEAKER_00: Your threat team, your volume team, your remediation team, probably your technology team from the perspective of if you really need to dive into that code to understand how that actually function works, right?
• 12:48
  SPEAKER_00: So this is cutting across multiple organizations.
• 12:51
  SPEAKER_00: And that's why I think it becomes extremely difficult for organizations to manage this at scale.
• 12:57
  SPEAKER_00: Um, right.
• 12:58
  SPEAKER_00: Different application owners are going to say that they're the most important thing in the world and their vulnerabilities need to be addressed.
• 13:03
  SPEAKER_00: But then they say you can't do code changes and patches and updates.
• 13:06
  SPEAKER_00: Right.
• 13:07
  SPEAKER_00: So that's why I'm saying that this space is one of the, I think, most difficult spaces to execute at a high level to decrease what are quote unquote just volume numbers because that's what management looks at, rather than, hey, this is the highest risk in our environment.
• 13:22
  SPEAKER_00: And we're really addressing those for our most critical applications.
• 13:26
  SPEAKER_00: Right.
• 13:26
  SPEAKER_00: That's where the conversation doesn't really flow back and forth between the business and cyber.
• 13:30
  SPEAKER_00: Um, but the more that those two organizations can kind of come together to understand and prioritize how do we really focus on how it needs the focal, then again, you're going to be ahead of the game, not chasing the numbers, but truly reducing the risk where it's needed.
• 13:43
  SPEAKER_01: Oh, it's, you know what, you know, that reminds me of it, reminds me of like the nomenclature, like the cut, the phrases we used to use in enterprise, right?
• 13:50
  SPEAKER_01: Those enterprisesms, right?
• 13:52
  SPEAKER_01: And then what would everyone say?
• 13:53
  SPEAKER_01: We take a risk-based approach on X, Y, or Z.
• 13:56
  SPEAKER_01: And in this case, that does make a ton of sense for vulnerability management, right?
• 13:59
  SPEAKER_01: And again, look, nothing we're saying here is like groundbreaking, but like again, it's interesting to look at the statistic and then like try to put this into context because like I remember I was working with an organization and we're trying to get vulnerabilities under control.
• 14:12
  SPEAKER_01: And when I first stepped into the org and tried to get an understanding of like what we're looking at, their vulnerability count was at something like 2.4 million.
• 14:22
  SPEAKER_01: 2.4 million open vulnerabilities across the entire organization.
• 14:26
  SPEAKER_01: They had great visibility, right?
• 14:28
  SPEAKER_01: So from a technology perspective, they had the system fiber scanning, they were doing authenticated scans, they were doing unauthenticated scans, they were scanning regularly, daily, weekly, differentials, like they had everything right.
• 14:38
  SPEAKER_01: So they knew what was there, but they were lacking process, right?
• 14:42
  SPEAKER_01: They didn't have process to be able to say, all right, here's that, here's how we're gonna go through and identify what needs to be done and how we're gonna do it, and what change windows we're gonna use, and when we're gonna do our patching, and how we're gonna test those patches.
• 14:54
  SPEAKER_01: None of that existed.
• 14:56
  SPEAKER_01: So even though they solved the technology problem from a visibility perspective, I can see all the vulnerabilities I have.
• 15:02
  SPEAKER_01: They didn't solve the problem from a process perspective.
• 15:05
  SPEAKER_01: And more importantly, it didn't solve the problem from a people perspective.
• 15:08
  SPEAKER_01: Because what they didn't have is they didn't have assigned accountability back to the various platforms to say, you're responsible for this platform, you're responsible for its health.
• 15:16
  SPEAKER_01: Right.
• 15:16
  SPEAKER_01: So if we're breaking this down across control elements, right?
• 15:19
  SPEAKER_01: If we're looking at things like the Taus Control Stack, like this is how we would dissect that issue.
• 15:23
  SPEAKER_01: And one of the most amazing things that happened is once we sorted accountability and process, like we were able to patch, I think it was something like 12 or 14 applications, and it knocked off a million vulnerabilities.
• 15:35
  SPEAKER_01: It cut them in half, right?
• 15:36
  SPEAKER_01: Because the other issue with vulnerabilities, you know, we we're talking about like size and scale.
• 15:40
  SPEAKER_01: I feel like volume becomes a really big conversation when we talk about vulnerabilities, is that you have these vulnerabilities that come out, right?
• 15:48
  SPEAKER_01: But one vulnerability that's released might result in a thousand vulnerabilities on your network if you have that application installed across a thousand endpoints, or you know, 500 people are using it, or 250 individuals have that app, whatever the whatever the actual volume and sprawl is, like this is where the numbers start to get out of control.
• 16:07
  SPEAKER_01: But the inverse is also true.
• 16:09
  SPEAKER_01: So if you can solve for process, if you can solve for people on an accountability perspective, then you can come back and you can say, look, these are our highest levels, going back to our risk-based approach.
• 16:20
  SPEAKER_01: These are the ones that are most critical, they're forward-facing, they're accessible externally.
• 16:24
  SPEAKER_01: Whatever the criteria is, if we patch these, we can start to take out entire swaths of vulnerability, data of vulnerability count to actually get this to a manageable level where you truly are mitigating risk.
• 16:38
  SPEAKER_01: Is that it?
• 16:39
  SPEAKER_00: Did we kill vulnerability?
• 16:41
  SPEAKER_00: Is that the stat going underground being buried?
• 16:45
  SPEAKER_01: I guess so.
• 16:46
  SPEAKER_01: All right.
• 16:47
  SPEAKER_01: Well, I think I think we're good at vulnerability.
• 16:49
  SPEAKER_01: Any more comments on that one?
• 16:50
  SPEAKER_00: Or do we want to pick another truck?
• 16:51
  SPEAKER_00: No, again, I think, you know, again coming out of Black Hat, um, this problem isn't going anywhere.
• 16:56
  SPEAKER_00: It's going to again be expedited, right?
• 16:58
  SPEAKER_00: Um, with the capability of AI to uh unleash and identify.
• 17:02
  SPEAKER_00: Um and this also goes back to we certainly understand that there's a lot of legacy systems out there, right?
• 17:07
  SPEAKER_01: Um I didn't even think of that.
• 17:09
  SPEAKER_00: And those are the things that are not going to be coming out of the picture of the purview, right?
• 17:12
  SPEAKER_00: You can't hide any longer by being a 2008 shop or anything like that.
• 17:16
  SPEAKER_00: Um so again, it's just as you talked about and highlighted, it's it's not to be overwhelmed or scared by the numbers, but to understand that this is a legitimate tactic that would be taken advantage of.
• 17:27
  SPEAKER_00: And organizations need to build a strategy around for defending it, right?
• 17:30
  SPEAKER_01: So no, you're you're absolutely you're absolutely spot on.
• 17:33
  SPEAKER_01: I actually didn't I didn't even think about that, right?
• 17:35
  SPEAKER_01: So like we we we started this by thinking about the 130 vulnerabilities that existed that were, that were disclosed per day on average in 2025.
• 17:43
  SPEAKER_01: But those are new, right?
• 17:45
  SPEAKER_01: Like let's not forget that these things are compounding over the last 15 years or however long CBSS has been like recording, you know, recording these these vulnerabilities.
• 17:56
  SPEAKER_01: So like the thing that's interesting is you talk about out-of-support software.
• 18:01
  SPEAKER_01: And I've actually I've actually interacted with a couple clients who have had this issue where like they have software where the company may have gone out of business.
• 18:08
  SPEAKER_01: This is a real thing.
• 18:09
  SPEAKER_01: Like they were using something and the company just went belly up.
• 18:12
  SPEAKER_01: They still had this dependency on this application.
• 18:14
  SPEAKER_01: Well, guess what?
• 18:15
  SPEAKER_01: There's no more patching, there's no more support.
• 18:18
  SPEAKER_01: Like, what do you do in that scenario?
• 18:21
  SPEAKER_01: I think roll the dice, right?
• 18:22
  SPEAKER_01: At that point, like security by obscurity.
• 18:26
  SPEAKER_01: I love it, right?
• 18:27
  SPEAKER_01: Just don't tell anybody.
• 18:28
  SPEAKER_01: Take it off of your inventory, just you know, leave it under the desk.
• 18:31
  SPEAKER_01: Don't like, don't bring it up.
• 18:32
  SPEAKER_01: That is definitely one way to address it.
• 18:34
  SPEAKER_01: Yeah.
• 18:34
  SPEAKER_01: No, I mean, look, there's there's a couple of interesting things people have done.
• 18:37
  SPEAKER_01: And again, nothing crazy novel, but like some of the things that they've done have been like, all right, well, you know what?
• 18:42
  SPEAKER_01: We're gonna surround it with additional controls.
• 18:44
  SPEAKER_01: We're gonna compartmentalize the system because we can't patch it.
• 18:47
  SPEAKER_01: We can't fit it.
• 18:48
  SPEAKER_01: It's out of support.
• 18:48
  SPEAKER_01: There's no more new patching that's coming out.
• 18:51
  SPEAKER_01: Like this thing is just now not only vulnerable to certain things, but what's worse is over time those vulnerabilities have become commoditized.
• 18:57
  SPEAKER_01: They're added to all of the different scanners, all the different exploit kits.
• 19:01
  SPEAKER_01: Like they just are automatic, right?
• 19:03
  SPEAKER_01: Attackers are just kidding you immediately and like automatically deploying these vulnerabilities.
• 19:07
  SPEAKER_01: So you have to take this concept of like, all right, I have 130 a day I'm worried about, but I also have the million that's behind that.
• 19:14
  SPEAKER_01: And now I have to deal with software that's actually added out of, you know, out of support.
• 19:19
  SPEAKER_01: All right, I'm back on the scared bubble.
• 19:21
  SPEAKER_01: This is this whole conversation has been an emotional roller coaster.
• 19:24
  SPEAKER_01: It's like really scary.
• 19:25
  SPEAKER_01: We're under control, kind of scary.
• 19:27
  SPEAKER_01: Uh, there's a way out.
• 19:28
  SPEAKER_01: Oh my God, I'm scared again.
• 19:29
  SPEAKER_01: Like, I I'm not sure I can deal with many more of these episodes again.
• 19:34
  SPEAKER_01: I guess the next card, huh?
• 19:36
  SPEAKER_00: I guess.
• 19:36
  SPEAKER_01: Oh, all right.
• 19:37
  SPEAKER_01: Well, you have two cards left to choose from.
• 19:39
  SPEAKER_01: You have A and you have B.
• 19:40
  SPEAKER_01: Well, I can't choose C again.
• 19:42
  SPEAKER_01: I mean, you could, but we'll probably just have to put the episode on repeat.
• 19:45
  SPEAKER_01: It'll save us a bunch of time.
• 19:46
  SPEAKER_01: That'll be good.
• 19:47
  SPEAKER_01: Well, I guess I gotta go the other extreme, right?
• 19:49
  SPEAKER_01: Let's do A.
• 19:50
  SPEAKER_01: A.
• 19:50
  SPEAKER_01: All the way to the left.
• 19:52
  SPEAKER_01: All right.
• 19:52
  SPEAKER_01: Let's go to A.
• 19:53
  SPEAKER_01: Okay.
• 19:54
  SPEAKER_01: So this actually comes from CrowdStrike's 2026 Global Threat Report.
• 19:58
  SPEAKER_01: And what they've reported in that, uh, in that report they released publicly was that the average eat crime breakout in 2025 was down from 40, 48 minutes in 2020, uh, in 2024 to 29 minutes in 2025.
• 20:18
  SPEAKER_00: So can you restate that, please?
• 20:20
  SPEAKER_01: Yeah, I can.
• 20:21
  SPEAKER_01: All right.
• 20:22
  SPEAKER_01: We're I folks, I promise.
• 20:23
  SPEAKER_01: We'll get better at this.
• 20:24
  SPEAKER_01: It's our third episode.
• 20:26
  SPEAKER_01: Like, let us work through this, all right?
• 20:27
  SPEAKER_01: We can't hello.
• 20:28
  SPEAKER_01: We can't.
• 20:28
  SPEAKER_01: We also can't see because I got the I got the years wrong also.
• 20:32
  SPEAKER_01: So I'm gonna restate this completely.
• 20:34
  SPEAKER_01: Thank you for calling this out.
• 20:35
  SPEAKER_01: Okay.
• 20:35
  SPEAKER_01: Here's what we're talking about.
• 20:36
  SPEAKER_01: This is CrowdStrike's global threat report.
• 20:38
  SPEAKER_01: And what they're reporting on here is e-crime.
• 20:40
  SPEAKER_01: And specifically, what they're reporting out is breakout time.
• 20:42
  SPEAKER_01: So let's start with that.
• 20:44
  SPEAKER_01: Breakout time is the time it takes from an attacker to gain access to the very first system and how long it takes them to break out to the next system.
• 20:52
  SPEAKER_01: In 2025, the average breakout time was 48 minutes.
• 20:56
  SPEAKER_01: So an attacker was able to gain a foothold on a very first system, laterally, right?
• 21:01
  SPEAKER_01: And then the time it took them to move laterally from that first entry point was 48 minutes.
• 21:06
  SPEAKER_01: In 2026, their report brought that down to 29 minutes.
• 21:13
  SPEAKER_01: So sub 30 minutes, the ability to break out on average from the first system into the next system.
• 21:20
  SPEAKER_00: What does that feel like for you?
• 21:22
  SPEAKER_00: It's interesting, right?
• 21:23
  SPEAKER_00: I think there's a lot of things that kind of come to mind in the sense of quickness for sure, right?
• 21:28
  SPEAKER_00: I mean, that's the first thing that comes to me is that the attackers are able to move laterally quicker.
• 21:35
  SPEAKER_00: Um the secondary thing is kind of coming to mind is why, right?
• 21:39
  SPEAKER_00: Yeah.
• 21:39
  SPEAKER_00: What why are someone able to move quicker through our environment?
• 21:42
  SPEAKER_00: And again, a couple of things come to mind.
• 21:44
  SPEAKER_00: Again, what a novel here, right, is potentially more living off the land tools.
• 21:48
  SPEAKER_00: Right.
• 21:48
  SPEAKER_00: So as we know that detections are coming through, attackers know actually how to make amass themselves to go through good traffic.
• 21:55
  SPEAKER_00: Um, right.
• 21:55
  SPEAKER_00: And I think a lot of this also brings up to the fact that the breakout time isn't talking about.
• 22:00
  SPEAKER_00: out the dwell time, right?
• 22:01
  SPEAKER_00: How long is someone on the network?
• 22:03
  SPEAKER_00: It would be a really awesome data point to understand this a little bit more.
• 22:07
  SPEAKER_00: Right.
• 22:07
  SPEAKER_00: The reason why I bring that up is because my assumption is that are we having better, more sophisticated attackers to say, get an understanding of the network first and sick.
• 22:17
  SPEAKER_00: Learned.
• 22:18
  SPEAKER_00: Don't try to go in there and get your objective immediately.
• 22:21
  SPEAKER_00: And then the other element of that for me is that they're getting really good at trying to understand the network in a quiet area.
• 22:30
  SPEAKER_00: They may not be hopping somewhere that is the highest level of admin credentials immediately.
• 22:34
  SPEAKER_00: Sure.
• 22:34
  SPEAKER_00: They may be trying to hop to different areas of the network, slowly working their way towards again, admin credentials or elevated privileges.
• 22:44
  SPEAKER_00: And so again, just a couple of those things that are sparking to me from that perspective of, you know, why, what's the importance, um, how are they doing it?
• 22:53
  SPEAKER_00: But then from the defensive perspective, right?
• 22:54
  SPEAKER_00: That that's definitely scary in the sense that you do want to start to reduce how they are going in your network, right?
• 23:03
  SPEAKER_00: If they're in, it's always about containment, right?
• 23:06
  SPEAKER_00: How quickly can we stop them from moving?
• 23:08
  SPEAKER_00: And this is basically saying it's not happened quick enough, right?
• 23:12
  SPEAKER_00: Sure.
• 23:13
  SPEAKER_01: You break you actually bring up something I never thought about before, right?
• 23:16
  SPEAKER_01: So like immediately when I read this card, the things that came to mind are this concept of, okay, clearly AI is playing into this.
• 23:24
  SPEAKER_01: Clearly they're they're playing you know kind of those red team bots.
• 23:27
  SPEAKER_01: Like, and we can talk a little bit about the difference between red teaming and blue teaming and like how AI agents are are changing those worlds and what they're doing.
• 23:34
  SPEAKER_01: And I have, I have a personal opinion that red teaming and like the exploitation side of these bots is way further ahead than blue teaming because of the nuance that comes with defense.
• 23:44
  SPEAKER_01: We can talk about that later.
• 23:45
  SPEAKER_01: But you bring up something I never thought about before.
• 23:47
  SPEAKER_01: Like so I never thought about this concept of living off the land and utilizing those tools in terms of speed, right?
• 23:55
  SPEAKER_01: But I think it actually makes a tremendous amount of sense.
• 23:58
  SPEAKER_01: So for those of you listening, those of you new in your career, we talk about living off the land, what that means is that means that the attackers are using built-in tools that are that are a part of the operating system.
• 24:09
  SPEAKER_01: They're a part of the the actual network that exists.
• 24:12
  SPEAKER_01: They didn't have to drop in new tooling they didn't have to download malware.
• 24:15
  SPEAKER_01: They didn't have to utilize the tools that they built off of offline.
• 24:19
  SPEAKER_01: They focused on like utilizing the things that were already on the system.
• 24:22
  SPEAKER_01: And the reason why this attack is so effective and so useful is because they're hard to detect.
• 24:28
  SPEAKER_01: These are built in, they're trusted, they're signed by Microsoft or whoever, whatever the operating system is so when they're utilized, it's not like we have we have a signature for them, we do, but they're used all over the world, right?
• 24:39
  SPEAKER_01: So it's kind of buried and that's what Owen was alluding to.
• 24:41
  SPEAKER_01: So like if I think about this, which is a new perspective for me from the perspective of speed, I think that makes a tremendous amount of sense.
• 24:48
  SPEAKER_01: The tool is always consistent across the board, right?
• 24:51
  SPEAKER_01: They've gotten good at looking for those specific tools, what to use.
• 24:54
  SPEAKER_01: The commands are probably you know copied and pasted, right?
• 24:57
  SPEAKER_01: If they're not automated, bringing it back to the AI agent stuff we were talking about a second ago.
• 25:01
  SPEAKER_01: So I actually think that makes a ton of sense, right?
• 25:04
  SPEAKER_01: Because like there is no stopping it.
• 25:06
  SPEAKER_01: Like we have to now rely on behavioral analysis because the actual signatures of the software themselves don't matter.
• 25:12
  SPEAKER_01: Everyone has them.
• 25:14
  SPEAKER_01: They're approved they're used for day-to-day administration.
• 25:17
  SPEAKER_01: I think that definitely part of this though is absolutely AI and like this concept of these unconstrained models, the agents that have been built that are basically being fed with every piece of information that any pen test has ever uncovered, any tactic built into things like Cali Linux, any any tooling that's been built over time, like all of these things are being produced and provided at machine speed.
• 25:42
  SPEAKER_01: And that's what I think is starting to get this breakout time down do you think?
• 25:47
  SPEAKER_00: Yeah, no, agreed um my math's horrible right um but that's what 19 minutes difference?
• 25:53
  SPEAKER_00: Yeah so so on average back in your SOC days, how long was a very capable tier one analyst able to dispose of an alert?
• 26:02
  SPEAKER_01: Wow, great question man.
• 26:04
  SPEAKER_01: Like so this is so this is back in the day before we had like AI analysis tools, right?
• 26:09
  SPEAKER_01: Which is which has sped things up amazingly so like if we're not if we're talking about true human look at alert, find the logs, triage, like triage alone would take anywhere from 15 to 25 minutes depending on complexity.
• 26:23
  SPEAKER_01: And that's only the first look and that's only like tier one before we got into levels of escalation.
• 26:28
  SPEAKER_01: And that's assuming the queue didn't have them hold those alerts for two to three hours.
• 26:32
  SPEAKER_00: No totally and so that's where my head is going on this perspective is like it's one thing to understand how quickly the attackers are moving.
• 26:37
  SPEAKER_00: But that's exactly where I think on the best average back in the corporate days when I was about in the sock area, I think was 15 minutes.
• 26:44
  SPEAKER_00: And that's someone that knew their shit excuse me.
• 26:47
  SPEAKER_00: They knew where to go, what to look for, what signatures are bad, what are good.
• 26:51
  SPEAKER_00: And so that's 15 minutes.
• 26:52
  SPEAKER_00: We're saying though that this hot took about 19, right?
• 26:56
  SPEAKER_00: Give or take.
• 26:57
  SPEAKER_00: Yeah.
• 26:58
  SPEAKER_00: On average I would assume that a normal human is about 20 to 30 especially a tier one junior level.
• 27:03
  SPEAKER_00: Sure.
• 27:03
  SPEAKER_00: Right?
• 27:04
  SPEAKER_00: AI is helping along the way but again that's where the notion of if you have AI that's doing an end to end without human intervention, can you trust that how often is the testing being done, right?
• 27:14
  SPEAKER_00: How likely are these to pick that up?
• 27:16
  SPEAKER_00: Even if you have a human that's overlooking AI triage response, again, are they capable enough to see sift through that to be able to pivot?
• 27:24
  SPEAKER_00: So in this example, we've got one hit, right?
• 27:29
  SPEAKER_00: 19 minutes quicker, they're already in the next spot of your actual network.
• 27:33
  SPEAKER_00: So is an analyst able to keep up with these speeds and identify as your certain aha right.
• 27:38
  SPEAKER_00: So this just again compounds of definitely want AI automation to be able to know how to take proper action.
• 27:44
  SPEAKER_00: But again going to practice that's extremely difficult because you don't usually want to block certain things on sensitive systems unless you fully know it on 100%.
• 27:53
  SPEAKER_01: And you know what's interesting is like again I'm also terrible in math but like if if if I'm thinking over this if we're going from 48 minutes and reducing by 19 minutes, like we're close to like 35 to 40% reduction in one year.
• 28:06
  SPEAKER_01: I I I can't even imagine what the 2027 number is going to be.
• 28:11
  SPEAKER_01: Right.
• 28:12
  SPEAKER_01: Like we're we're gonna get into like sub 15 from in terms of breakout.
• 28:16
  SPEAKER_01: And the thing is like folks the thing that's scary about this is that it's not necessarily just like oh that's the breakout that's the average right so there are plenty of organizations that have invested in cyber they've they've hardened their systems they've built the right tooling and those breakouts are going to be in the you know whatever hour range but think about all the other organizations where we've seen like we've seen the quickest breakout has been something like 54 seconds.
• 28:40
  SPEAKER_01: Right.
• 28:40
  SPEAKER_01: So like if we're if we're bringing this back down to averages like this doesn't mean you have, you know, whatever it is 29 minutes to get your act together.
• 28:49
  SPEAKER_01: It really depends on your organization, depends on your controls, depends on the staffing you have uh assigned to it.
• 28:54
  SPEAKER_01: Uh, you know, and like these are the things that really start to break out that nuance.
• 28:58
  SPEAKER_00: Yeah.
• 28:59
  SPEAKER_00: And I'm not again I'm not a an AI um evangelist, but I think to your point, right, we've been seeing that over about the last one to three years are that the defenders are understanding that they have to invest in AI.
• 29:11
  SPEAKER_00: So it's now becoming AI is fighting AI is defending AI.
• 29:14
  SPEAKER_00: Right.
• 29:14
  SPEAKER_00: It's AI against AI.
• 29:15
  SPEAKER_00: Yeah it's by vs spy I'm dating myself but the old mad magazine spy versus spy right like and that's where it's again the attackers inherently are going to be ahead of the game because they're able to learn quicker.
• 29:26
  SPEAKER_00: They're able to implement without having to have approvals, right?
• 29:29
  SPEAKER_00: Compliance oversight, governance, none of that stuff.
• 29:32
  SPEAKER_00: But we can't stop to to incorporate the AI capabilities again, as we talked about before defense and depth, right?
• 29:39
  SPEAKER_00: Where are the other controls that we actually can manage to helpfully thwart against that, right?
• 29:44
  SPEAKER_00: I think it was at Black Hat where someone was doing a presentation on the economy of the economics of the economics of malware.
• 29:51
  SPEAKER_01: Yeah.
• 29:51
  SPEAKER_01: That was amazing.
• 29:52
  SPEAKER_00: And kind of shifting from what our big opportunity here is not to fight dollars with dollars, but to kind of rethink how we're implementing our controls.
• 29:59
  SPEAKER_00: And I think what he said is redo the physics of it.
• 30:02
  SPEAKER_00: Yeah.
• 30:03
  SPEAKER_00: Right.
• 30:03
  SPEAKER_00: So I started to think about how do we use tool sets appropriately to keep up with or go past how basically attackers are just leveraging money at the NMS AI tools and capabilities to do things quicker.
• 30:16
  SPEAKER_00: Yeah.
• 30:17
  SPEAKER_00: Right.
• 30:17
  SPEAKER_00: Because we're not going to be able to keep with speed.
• 30:19
  SPEAKER_00: So again moving this to a different area of thought right is sports for me.
• 30:24
  SPEAKER_00: If you're bigger and stronger, I'm gonna be smaller and quicker.
• 30:27
  SPEAKER_00: If you're smaller and quicker, I'm gonna be bigger and stronger.
• 30:29
  SPEAKER_00: Right.
• 30:29
  SPEAKER_00: Right.
• 30:30
  SPEAKER_00: So it's those those notions of how do we stay creative to meet someone at that point of conflict rather than trying to say I'm gonna match you dollar for dollar.
• 30:38
  SPEAKER_01: That is an amazing perspective.
• 30:40
  SPEAKER_01: And that's what this podcast is about.
• 30:43
  SPEAKER_01: So look we're at 30 minutes on this is the fastest 30 minutes this week.
• 30:46
  SPEAKER_01: I'll tell you right now, this conversation just flowed for me.
• 30:48
  SPEAKER_01: Super amazing to take a beat and talk about these things.
• 30:51
  SPEAKER_01: Really appreciate it.
• 30:52
  SPEAKER_01: What are your last thoughts you want the audience to leave with on this one?
• 30:55
  SPEAKER_00: I'm just looking forward to to getting participants, building the community right love Paul.
• 31:00
  SPEAKER_00: No I think we're both you know somewhat intelligent, fun people to talk with, but um we definitely need others, right?
• 31:08
  SPEAKER_01: We definitely want some different perspectives or we're gonna start saying the same thing over and over again.
• 31:13
  SPEAKER_01: Agreed.
• 31:14
  SPEAKER_01: And and look we definitely have a bunch of guests lined up super excited to circum some folks on on the uh on the show here.
• 31:20
  SPEAKER_01: You know what I want to be audio to leave with on this one is for me, like a lot of the theme here is fear today.
• 31:27
  SPEAKER_01: And I hate that.
• 31:28
  SPEAKER_01: I hate that our industry that cybersecurity just drives this concept of fear all the time and it it's very frustrating.
• 31:36
  SPEAKER_01: But like I think what we talked about today are exactly how you get past that fear, right?
• 31:41
  SPEAKER_01: Like the numbers are scary, but you're in control of your network.
• 31:45
  SPEAKER_01: You can pull the levers you need to in order to start to reduce these numbers, reduce your attack surface and make it harder for the attackers to do what they need to do.
• 31:53
  SPEAKER_01: But that's on you, right?
• 31:54
  SPEAKER_01: Like one of the things I love to tell clients when I'm talking them is remember you have home court advantage to bring this back to a sports analogy, right?
• 32:01
  SPEAKER_01: You have control over all the tech.
• 32:03
  SPEAKER_01: You can fix the things in order to make sure things like this don't happen.
• 32:06
  SPEAKER_01: Or when they do happen, because that unfortunately is a reality in our space, you minimize the blast radius, you keep things nice and small and you make them easy to just kind of fix and move on from I think that's it, man.
• 32:19
  SPEAKER_01: That's uh the first full episode in the books and uh it's been a pleasure.
• 32:22
  SPEAKER_01: I can't wait to get it going again.
• 32:24
  SPEAKER_01: Gaveled.
• 32:25
  SPEAKER_01: Gavled.
• 32:25
  SPEAKER_01: Also take care.