Hosted by Patrick Garrity and Kimber Duke from VulnCheck, the discussion explores how modern threat actors operate, why most organizations still struggle with cybersecurity fundamentals, and how defenders can build stronger, intelligence-driven security programs.

ABOUT OUR GUEST:

Before joining Dataminr, Joe held cybersecurity and threat intelligence roles across government and industry, including work with Dragos, Gigamon, Huntress, and MITRE. His background spans Navy cyber warfare operations, incident response, threat hunting, intrusion analysis, and large-scale detection engineering.

In this episode, the conversation covers:

• How cyber threat intelligence actually supports real security outcomes
• Why detection engineering is becoming essential for modern security teams
• The mindset defenders need to think like attackers
• Lessons from the Black Basta ransomware chat leaks
• Threat hunting methodologies and operational security practices
• VPN abuse, proxy infrastructure, and telecom compromise risks
• Why healthcare and manufacturing continue to be high-risk targets
• How attackers prioritize targets using sales and marketing-style tactics
• The future of cybersecurity talent, hacker culture, and defensive operations
• Why strong cybersecurity still comes down to fundamentals and operational discipline

Whether you work in a SOC, lead a security team, build detection content, hunt threats, or simply want to better understand how modern cyber adversaries operate, this episode delivers practical insights from leaders working on the front lines of cybersecurity.

Dataminr uses AI and real-time event discovery to help organizations detect emerging risks, cyber threats, geopolitical events, and breaking incidents faster — enabling security teams to respond before threats escalate.

VulnCheck provides exploit and vulnerability intelligence designed to help organizations prioritize real-world threats, understand exploitation activity, and stay ahead of emerging vulnerabilities before attackers weaponize them.

Joined by Patrick Garrity (Security Researcher) and Kimber Duke (Director of Product at VulnCheck), the conversation explores how the industry is changing—and why many of the core problems remain the same.

From the rise of AI-powered capabilities to the growing importance of vulnerability disclosure programs, this episode unpacks the tension between speed, innovation, and security.

🔍 What You’ll Learn

- Why cybersecurity today feels “faster, louder, and more chaotic”

- How AI is expanding both opportunity and risk in hacking

- The evolution of bug bounty programs and ethical hacking

- Why most software is built without security as a priority

- The reality of vulnerability disclosure—and why it’s still broken

- The importance of empathy between researchers and organizations

- How community plays a critical role in modern security

- The legal risks hackers face—and how initiatives like the Security Research Legal Defense Fund are changing that

⚡ Key Insights

- “We’re solving the same problems—just faster and louder.”

- Security often comes second to shipping products quickly

- Ethical hackers are now gaining a seat at the leadership table

- Clear vulnerability disclosure processes can prevent real-world damage

- The future of cybersecurity depends on collaboration, not silos

👤 About the Guest

Casey Ellis is the Founder of Bugcrowd, a pioneer in crowdsourced cybersecurity and bug bounty programs. With over a decade of experience shaping how organizations work with ethical hackers, Casey has played a key role in advancing vulnerability disclosure practices globally.

🔗 Resources & Projects Mentioned

Disclose.io — Improving vulnerability disclosure standards https://disclose.io

Security Research Legal Defense Fund — Supporting ethical hackers facing legal challenges https://srldf.org

🎙️ About THREATCON1

THREATCON1 brings together leading voices in cybersecurity to explore the biggest challenges, ideas, and innovations shaping the industry today. https://threatcon1.org

Joe shares his unique journey from military intelligence and government service, through roles at iSight Partners, Symantec, TransUnion, and JLL as CISO, to now building a cybersecurity startup focused on redefining how organizations understand and manage exploitability.

At the core of the conversation is a shift away from traditional vulnerability management and CVE-driven thinking toward runtime, behavior-based visibility. Joe explains how modern environments are increasingly filled with custom-built tools, AI-generated code, and rapidly evolving software that often falls outside traditional security models.

Key topics covered include:

- Why CVE-based vulnerability management is no longer enough

- How runtime telemetry reveals true exploitability in real time

- The growing problem of alert fatigue and the move toward “non-alerting” security models

- Why most enterprise environments contain far more custom and unknown software than teams realize

- The rise of AI-generated code and its impact on secure development practices

- The shift from patching toward mitigation as a primary security strategy

- How supply chain attacks are evolving in an AI-accelerated development world

- Why memory-based vulnerabilities remain one of the most under-addressed systemic risks

The discussion also explores a forward-looking reality: security teams must increasingly operate at machine speed, focusing less on perfect prevention and more on fast detection, prioritisation, and mitigation of real exploitable conditions.

A candid, practical, and forward-thinking conversation on what it truly takes to secure modern software ecosystems.

From firewalls and VPN gateways to home routers, edge devices sit at the intersection of the internet and corporate networks — making them prime targets for attackers.

In this episode, Saeed shares insights from years of vulnerability research across organizations like Trend Micro, Palo Alto Networks, and Qualys, including:

• Why network edge devices are frequently targeted by attackers

• The challenges organizations face when patching or replacing vulnerable infrastructure

• How botnets exploit consumer routers while ransomware actors target enterprise edge devices

• Why visibility and asset inventory are critical for security teams

• The growing importance of risk-based vulnerability prioritization

• How attackers exploit vulnerabilities within days — or even before patches are available

The conversation also explores broader trends in vulnerability research, the evolution of exploitation timelines, and what organizations can do today to reduce risk at the edge.

If you're responsible for vulnerability management, threat research, or network security, this episode offers valuable insight into how attackers are evolving — and how defenders can keep up.

Guests

Saeed Abbasi – Senior Manager, Security Research, Qualys Threat Research Unit

Hosts

Patrick Garrity – VulnCheck

Kimber Duke – Director of Product, VulnCheck

Recorded live at RSA Conference.

Ryan shares the story of his journey through cybersecurity — from creating the widely used Damn Vulnerable Web Application (DVWA) and the WPScan vulnerability database, to building projects like KevIntel, and now leading threat intelligence efforts at WatchTowr.

The conversation explores how modern attackers operate, why time-to-exploit is shrinking, and why internet-facing infrastructure like routers, firewalls, VPNs, and edge devices has become a primary target for threat actors.

Patrick and Ryan also discuss the growing scale of the vulnerability landscape, the limitations of traditional scoring systems like CVSS, and why organizations must move toward context-driven vulnerability prioritization instead of simply chasing severity scores.

Along the way, they examine how threat intelligence teams detect exploitation in the wild using honeypot networks, reverse engineering, and vulnerability research — and what defenders should be paying attention to as the cybersecurity landscape continues to accelerate.

If you’re interested in emerging threats, exploited vulnerabilities, and the future of cyber defense, this episode is packed with insights.

Topics covered in this episode

• Ryan Dewhurst’s path from DVWA and WPScan to WatchTowr

• The rise of exploited vulnerability intelligence

• Why attackers are increasingly targeting network edge devices

• The shrinking time-to-exploit window

• Zero-day vs end-day vulnerabilities in real attacks

• Detecting exploitation with honeypots and threat telemetry

• Why CVSS scores alone aren’t enough

• The growing challenge of managing vulnerability volume

• What cybersecurity teams should expect in the years ahead

🎧 Subscribe to the THREATCON1 Podcast for more conversations with cybersecurity researchers, threat intelligence leaders, and industry experts exploring the evolving threat landscape.

Lillian shares her journey from federal intelligence work after 9/11 to protecting critical infrastructure in the private sector, offering a rare inside look at:

• How nation-state actors target the energy industry
• The real impact of supply-chain vulnerabilities and zero-day exploits
• Why third-party risk and business continuity are now core security concerns
• The growing role of AI in cyber defense—and the new risks it introduces
• What cyber threat intelligence teams actually do inside global enterprises

This conversation delivers practical insight for cybersecurity professionals, technology leaders, and anyone interested in how critical infrastructure is defended in an increasingly complex threat landscape.

Subscribe for more conversations with the people shaping the future of cybersecurity.

Drawing on two decades inside the FBI—including briefing the President’s Daily Intelligence Brief—Cynthia shares frontline insight into how cyber threats have changed, why ransomware is moving faster than ever, and what organizations must do now to stay protected.

In this conversation:

• How AI is reshaping ransomware attacks and social engineering
• Why today’s cyber threats blur the line between espionage and warfare
• The growing gap between government capability and private-sector technology
• What “assume breach” really means in modern cybersecurity
• When (if ever) paying a ransom makes sense
• Practical strategies to contain attacks and protect critical infrastructure

This is a must-watch discussion for security leaders, IT professionals, policymakers, and anyone concerned about the future of cyber defense.

About Cynthia Kaiser

Cynthia is an award-winning cyber executive, former FBI leader, and SVP at Halcyon focused on stopping ransomware and advancing threat intelligence. She has been featured in major global media and previously served as a President’s Daily Brief intelligence briefer across two U.S. administrations.

Subscribe for more conversations with the people shaping the future of cybersecurity.

Together, they explore why patching alone can’t keep up with today’s threat landscape — and how security teams can dramatically reduce risk by prioritizing what actually matters.

🔍 Key Topics Covered

Why patching is too slow

The average enterprise takes ~49 days to patch — while attackers weaponize vulnerabilities in days (or minutes).

Mitigating controls vs. patching

How firewalls, EDRs, WAFs, segmentation, and configuration changes can meaningfully reduce exploitability — even when patching isn’t possible.

The “1 in 50,000” insight

Why only a tiny fraction of vulnerabilities are truly critical when you factor in runtime, reachability, exploitability, and existing controls.

Zero-days without CVEs

How agentic workflows can assess exposure, identify impacted assets, and recommend mitigations before scanners, signatures, or CVE IDs exist.

CTEM as a maturity journey

Moving from noisy vulnerability lists to operationalized, risk-driven exposure management — without creating shelfware.

Threat enablement is the real danger

Why loosely organized groups and even teenagers are now capable of causing enterprise-level disruption.

Edge devices, legacy software, and OT risk

Why internet-facing systems and unpatchable environments (manufacturing, healthcare, critical infrastructure) demand a mitigation-first mindset.

AI vulnerabilities: the next frontier

No CVEs, no standards, rapid adoption — and a growing attack surface most organizations aren’t tracking yet.

AI as a force multiplier for defenders

How agentic AI can shorten exposure windows, automate analysis, and upskill under-resourced security teams.

🎯 Why This Episode Matters

If you’re overwhelmed by vulnerability volume, constrained by patching windows, or struggling to align security priorities with business reality, this episode offers a grounded, experience-driven perspective on how modern teams are adapting — and where the industry is heading next.

THREATCON1 is created by VulnCheck and focuses on emerging threats, real-world security operations, and conversations with practitioners shaping the future of cybersecurity.

🔔 Subscribe for more episodes exploring vulnerabilities, threat intelligence, and exposure management with the people who matter most.

Tyler brings a rare perspective shaped by years spent across research, offensive security, vendor strategy, and analyst work. Together, they unpack how AI is reshaping cybersecurity workflows, why threat and exposure management is emerging as a critical discipline, and how offensive and defensive security must converge to drive real risk reduction.

The discussion dives deep into the realities behind AI hype, the importance of keeping humans in the loop, and why buyers are overwhelmed by security debt rather than lacking data. Tyler also offers a candid take on the CVE ecosystem, vulnerability scoring fragmentation, and why context — not raw severity scores — is the only thing that makes vulnerability data actionable.

The episode closes with a look at the next generation of cybersecurity leaders, startup strategy, and what students entering the field are uniquely positioned to do differently.

Key topics include:

1. Applied AI vs. AI hype in cybersecurity
2. Threat & exposure management as a risk-reduction engine
3. Offensive security’s role in prioritization and validation
4. Why vulnerability scoring breaks down without context
5. CVEs, ecosystem fragmentation, and global vulnerability data
6. Platformization, consolidation, and the future of security tooling
7. Building cybersecurity startups that solve real buyer problems

http://threatcon1.org

https://vulncheck.com

https://omdia.tech.informa.com

1. Insecure software and why vulnerabilities are becoming increasingly dangerous in our hyper-connected world.
2. The human factor in cybersecurity: why people often pose a bigger risk than technology itself.
3. Secure by design principles and the hurdles organizations face when trying to implement them at scale.
4. CVE program insights: understanding the gap between published vulnerabilities and real-world threats.
5. Software Bill of Materials (S-BoM): why tracking third-party components is critical for enterprise security.
6. AI in cybersecurity: from deepfakes to real-time impersonation, Nabil breaks down the risks and practical applications.
7. Career insights: Nabil reflects on his journey through software development, product management, and cybersecurity leadership.

Whether you’re a cybersecurity professional, software engineer, or just interested in the evolving digital threat landscape, this episode is packed with actionable insights and real-world examples from someone on the front lines of security.

Resources & Links Mentioned:

THREATCON1: https://www.threatcon1.org/

NetSPI: https://www.netspi.com

Agent of Influence Podcast: https://www.netspi.com/podcast/logistics-cybersecurity/

Follow THREATCON1 for more expert discussions on emerging threats.

We get into her “Cone of Uncertainty” framework for visualizing how threats form and evolve, discuss hiring fraud, offboarding gaps, nation-state recruitment, and why organizations routinely miss early warning signs. A conversation for anyone looking to better understand, track, and communicate human-centric risk.

🔍 Topics Covered

• How the Federal Reserve approaches insider threat detection
• The “Cone of Uncertainty” model — and why it works for cyber
• Why human stress is one of the strongest predictors of insider risk
• How to watch for early “storm signals” inside your organization
• The rise of nation-state hiring scams (North Korea, China)
• OSINT techniques for tracking behavioral risk
• Why cyber teams must become “English-to-English translators”
• Problems with spreadsheets, CVSS scores, and risk communication
• The hidden dangers in onboarding/offboarding workflows
• Real-world examples: sales data theft, disgruntled employees, access misconfigurations
• Why organizations still fail at protecting sensitive information

🎙️ About Our Guest

Christine Fignar

Cybersecurity Analyst, Federal Reserve Bank of Minneapolis

Specializes in insider threat, incident response, human-behavior-driven risk, and threat intelligence analysis.

Background includes aviation operations, HR, communications, and counterterrorism/anti-corruption studies.

📢 If You’re in Cybersecurity, This Episode Is For You

Perfect for security leaders, threat intel analysts, defenders, SOC teams, and anyone who wants to understand the human side of modern cyber threats — beyond the dashboards and detection tools.