Security Weekly Podcast Network (Audio) Security Weekly Podcast Network (Audio)

More Vulns and More Guesswork from Less Data - Jeremiah Grossman - ASW #407

Nov 3, 2026 · 1h 3m

Summary

In this episode of Application Security Weekly, host Mike Shima and guest Jeremiah Grossman analyze the "vuln apocalypse" narrative using data from insurance carriers and breach records. They argue that while CVE volume is high, the actual rate of exploitation and financial loss remains low, suggesting the industry overestimates risk. The discussion covers the PHP-to-Shell incident, the limitations of AI in mass exploitation, and the need to shift from compliance-driven spending to threat-informed risk reduction.

Topics discussed

Intro, Halloween security jokes, and sponsor Defining the 'Vuln Apocalypse' and Mythos Data-driven approach: KEV, breaches, and insurance Likelihood of exploitation vs. vulnerability count Limitations of KEV, DBAR, and breach data Are we having the right conversation about CVEs? Historical context: Heartbleed and Shellshock Lessons from Heartbleed and coordinated patching PHP-to-Shell: Exploit difficulty and codebase size Attacker scale and the exploitation bottleneck AI as a skill amplifier, not a skill creator Historical shifts: Firewalls to Web Apps to Ransomware Future threats: Vibe-coded apps and adversary focus Defense against nation-states and strategic targets Incentives, secure design, and the security bar Resource allocation and the efficiency of patching Active threat data and nimble risk reduction The burden of compliance and best practices Usability, industry soft skills, and AppSec status Guest sign-off and upcoming events Sponsor: GuardSquare mobile app security Deep dive: PHP-to-Shell code changes and quality Shock at the scale of the PHP security fix Software quality vs. security: The malloc fix CISO perspective: Patching strategy and rigor Fixing the underlying problem vs. the exploit Wordfence data and the optionality of micro-patches Open source funding and coordination challenges Alpine Linux GitLab incident: A positive transparency story Continuous improvement and process adoption Wiz blog: Agentic attacks and machine pacing Characteristics of agent-driven offense Human layer in agentic offense and security controls Cost of agentic attacks and resource constraints Future outlook and closing remarks
Listen ad-free on Castria

Episode summaries and topics are generated from the audio by Castria — a free podcast app that skips ads automatically. IP Geolocation by DB-IP