Jeremiah Grossman, founder of Root Evidence, on why the vulnpocalypse hasn't shown up in the exploitation data, and why the security industry still has no efficacy data for nearly anything it sells.

I sit down with Jeremiah Grossman, who has spent almost 30 years in cybersecurity. He started at Yahoo, built WhiteHat Security, which helped give birth to the AppSec industry, worked at SentinelOne, and sold an attack surface management company to Tenable. His latest company, Root Evidence, goes after vulnerability management because that is where the attackers have moved.

We dig into his research showing CVE volume climbing while exploitation stays flat. He makes the case for building security around CVE data from cyber insurance claims tied to actual financial loss, and argues that the industry runs on consensus rather than evidence.

In this episode:

● Why only about 1.48% of roughly 250,000 CVEs published since 2018 have been exploited
● Why attackers only needing 1 to 2% of CVEs to stay the number one vector is a giant fail for vulnerability management
● The roughly 600 CVEs tied to financial loss in insurance claims, and why those should be fixed first
● The defender window: a median of 116 days from patch to exploitation in 2026, up from 24 days in 2018
● What cyber insurers know about which controls work, and why they won't tell customers where they're wasting money
● Product warranties, and how a $5 million loss guarantee changes the patching conversation with the business
● Why "identity theft" shifts victimhood to the wrong party, and why there is still no catastrophe database for cyber
● What data would change his mind about AI-driven exploitation

Chapters:

0:00 Intro
1:45 Jeremiah's background
2:05 Why vulnerability management, and why now
5:53 Attackers only need 1 to 2% of CVEs
9:48 The defender window and why attackers are slowing down
13:09 Cyber insurers and the missing efficacy data
22:35 What will it take to wake the industry up?
24:26 What would change his mind on the Vulnpocalypse
26:22 Unprompted, SANS AI Security Summit, and what's next

Connect with Jeremiah:

LinkedIn: https://www.linkedin.com/in/grossmanjeremiah

Root Evidence: https://rootevidence.com

Resilient Cyber: https://www.resilientcyber.io

Subscribe for more conversations with security practitioners and leaders.

#vulnerabilitymanagement #cyberinsurance #aisecurity #riskmanagement #ciso #cybersecurity

Ciaran Martin built the UK's National Cyber Security Centre from the ground up, led it for its first four years, and now teaches at the University of Oxford. Lately he's become one of the sharpest critics of the panic around frontier AI and cybersecurity. On this episode of the Resilient Cyber Show, I put his argument to the test.

His case is that two things are true at once. Frontier AI is a real shift for attackers, and the reaction to it is the biggest FUD outbreak in over a decade.

Look at the timeline. When the delayed release of Mythos was announced on April 7th, the warning was that defenses would be overrun within six months. Six months later, there has been no discernible rise in disruptive attacks, and disruptive attacks can't hide. Britain's worst damage still came from traditional attacks in 2025 on Jaguar Land Rover, Marks & Spencer, and the Co-op.

Meanwhile, the hype is drowning out real incidents. The same week AI agents reading a few Australian websites made global headlines, the FBI appeared to have been breached by ShinyHunters, exposing case assignments, spousal addresses, and psychiatric evaluations. It barely registered.

We get into why the famous 27-year-old bug wasn't worth $20,000 in tokens to any real attacker, and what OpenAI's engineers admitted about Hugging Face at Black Hat. We also cover the "cult of the machine god," alignment with whose values, and why software makers have dodged liability for decades. Ciaran also asks the question the AI debate keeps skipping: who would actually launch the catastrophe?

Then he takes on the hardest question himself. What if he's wrong? His answer draws on running the NCSC through WannaCry and NotPetya in 2017. He closes with the one question every CISO should ask the board before discussing any "AI hacked X" headline.

⏱️ CHAPTERS

00:00 Introduction
01:37 Introducing Ciaran Martin
02:02 The Early Days of Cybersecurity
03:04 Why Governments Lagged on Cybersecurity
04:55 Public-Private Cybersecurity Partnerships
06:00 Why Leaders Avoid Technical Questions
07:27 AI Hype vs. Cybersecurity Reality
11:22 AI Safety vs. Cybersecurity
19:04 Two ways of reading the AI
25:46 The FBI Breach and AI Hype
27:43 ShinyHunters and Real-World Cyber Threats
29:37 Who Will Use AI to Launch Cyberattacks?
29:58 Who Would Actually Launch the Catastrophe?
35:00 The Devil's Advocate Case: AI-Powered Script Kiddies
43:33 What CISOs Should Tell the Board
45:00 Closure

SOURCES AND FURTHER READING

Ciaran Martin in The Economist — Fears of AI-induced armageddon are overdone: https://www.economist.com/by-invitation/2026/08/23/fears-of-ai-induced-armageddon-are-overdone

📬 SUBSCRIBE TO RESILIENT CYBER
https://www.resilientcyber.io

If this was useful, subscribe. I cover AI security, agentic AI, AppSec, software supply chain, vulnerability management, and cyber policy for practitioners every week.

#AISecurity #Cybersecurity #FrontierAI #CyberPolicy #AISafety #NCSC #ThreatIntelligence #CISO

Itamar Apelblat was called back to reserve duty with Unit 8200 and spent hours waiting on access approvals. Then he remembered a service account his old team had set up seven years earlier. The password was a funny one, which is why he still knew it. He typed it in and became an admin on one of the most secure networks in the world.

Nobody had changed that password. They hadn't forgotten about it. They were scared to touch it, because no one knew what would break.

Now put that same fear in front of AI agents. When Token Security's research team checked its enterprise customers, more than 16 percent already had Muse running locally against corporate email and other resources. Muse launched three weeks before we recorded and is already the most popular productivity app in the App Store. Itamar expects agents to outnumber humans in the enterprise a hundred to one.

His argument is that you can't secure agents by predicting every way they'll go wrong. An agent chases its goal like it's possessed and takes any access path that gets it there. What you can control is how much autonomy it has and what it's allowed to touch. Both come down to identity.

In this episode I sit down with Itamar, co-founder and CEO of Token Security, and we get specific:

→ The three things companies find the first time they look: agents wired straight into production on raw API keys, abandoned experiment agents still holding privileges, and agents still running after their owner left the company
→ What intent-based access management actually means, and why an agent built to send a weekly report should never be able to delete from your database
→ Why IGA and PAM fall apart here: they treat Okta or Active Directory as the source of truth, while agents live on laptops, in SaaS, and in the cloud
→ What happens when a coding agent tries to connect to a production Snowflake environment, and how to decide where a human still has to approve
→ Who should own agent security, and why Itamar puts most of it with the IAM team

I also put the hard question to him. We've had twenty years to get least privilege right for humans and mostly failed, so why would agents go any better? Then, at the end, he gives his advice on where security teams should start. It isn't the usual "get visibility first," and it's the part I'd most want a security leader to hear.

⏱️ CHAPTERS

0:00 Introduction
1:49 Unit 8200 and "Which Product Do You Hate the Most?"
3:58 The Seven-Year-Old Password That Still Worked
6:32 Autonomy and Access: The Two Dimensions of Agent Risk
8:19 Why Agents Act Like They're Possessed
10:14 16% Already Run Muse: What Companies Find
12:46 Intent-Based Access Management, Explained
15:15 Twenty Years of Failed Least Privilege
17:15 Why Your IGA Won't Scale to Agents
19:04 Where the Human Stays in the Loop
21:12 Who Should Own Agent Security
23:33 The Security Teams That Get This Right
26:35 Closing Thoughts

SOURCES AND FURTHER READING

Token Security: https://www.token.security/
Itamar Apelblat on LinkedIn: https://www.linkedin.com/in/itamar-apelblat/

📬 SUBSCRIBE TO RESILIENT CYBER
https://www.resilientcyber.io

If this was useful, subscribe. I cover AI security, agentic AI, AppSec, software supply chain, vulnerability management, and cyber policy for practitioners every week.

#AISecurity #AgenticAI #IdentitySecurity #NonHumanIdentities #IAM #AIAgents #LeastPrivilege #Cybersecurity