Shifting Cyber Turtles with Casey Ellis, the Vibe Check, and the News - Casey Ellis - ESW #483
Summary
Casey Ellis joins the show to discuss the "Vaughn-pocalypse" and the surge in AI-driven vulnerability discovery, emphasizing the need for risk-based prioritization over exhaustive bug fixing. The hosts also debate which security projects, particularly data classification, consistently exceed timelines and how AI might eventually solve these inefficiencies. The episode covers enterprise security news, including M&A trends and recent breaches, while highlighting the growing gap between AI capabilities and practical defensive strategies.
Topics discussed
Intro: Vaughn-pocalypse, Breach-pocalypse, and Vibe Check
Debate: Mustard in deviled eggs
Sponsor: Government Security Virtual Summit
Interview Intro: Casey Ellis and personal anecdotes
Vulnerability intake volume and signal-to-noise ratio
Scanner noise: Java/Office updates and awareness shifts
Sponsor: Travelers Cyber Threat Report
CPU performance trade-offs and attention diversion
AI in vulnerability research: harnesses and expert roles
Exploit complexity and commoditized access
SonicWall SSL VPN and AI filling the talent gap
Attacker incentives and expanding adversary pool
VDPs, researcher burnout, and CVE creation
AI committing crimes and critical infrastructure risks
Sponsor: Nudge Security for SaaS and AI risk
Vibe Check: Which security project takes longest?
AI's role in data classification and labeling
Least privilege and revoking stale access
Sponsor: Horizon3.ai for autonomous pentesting
Basketball goal and transition to news
PHP vulnerabilities, AI patches, and abandoned systems
Mainstream media coverage of AI-found bugs
Confluence of events and the 'why now' question
Agentic offense and the limits of defensive AI
Canada/EU moving away from Microsoft to Linux
Cohere AI incident and Mighty Mike Plays update
Listen ad-free on Castria