Noise2Signal

Thinkst Canary has thousands of paying customers. It has taken no VC money and has no outbound sales team, and it\'s HQ\'d in South Africa 🤯. In the Season 2 finale of Noise2Signal, Haroon Meer explains how they did it, and why he passed on Tier 1 VC. He covers the RSA playbook that sells companies instead of products, and a fake CMO who picked up industry awards. He also describes the day an analyst told him why big-name vendors land in the leader quadrant. If you\'ve wondered whether a good product can still win in a market full of noise, this episode is your answer. No wonder the episode airs on the Noise2Signal podcast

Jason Haddix came home from DEF CON frustrated by all the talk that security is finished. He answered with an article asking whether DEF CON is dead and security is cooked, and he says the title was sarcastic. He tells Mehul that AI agents now let his team at Arcanum test every JavaScript file and every parameter. They keep turning up old bugs buried deep in applications, including an unauthenticated SSRF that gave them control of a company's entire Kubernetes fleet. They also talk about the 10-year-old who beat all five levels of his team's prompt-injection CTF at DEF CON in about 15 minutes, and why Jason calls "machine-speed defense" BS. Jason expects offense to keep the edge for the next year or two. He explains why AI triage works only for companies with good SOPs, and why defenders should get rid of whole classes of bugs instead of playing whack-a-mole.

Nico Popp, operating partner at Crosspoint Capital Partners and former Chief Product Officer at Tenable, joins Mehul to explain why he came back from Black Hat saying there were "dead men walking everywhere." He argues that putting AI on top of a legacy product doesn't make it AI-native. The real shift is a new architecture: sensors feed a context graph, the graph feeds a reasoning layer, and agents sit on top where the console used to be. They cover what makes a durable moat now ("the three musketeers": agentic architecture, captured agent trajectories, and your own reinforcement-learned models), why wiring in frontier models is a strategic blunder, and Nico's "Seven Samurai" framework for VulnOps. That framework describes how vulnerability management has to change when attackers are agentic, and why it ends up absorbed into the agentic SOC. Along the way they discuss the Cisco–Kenna and ServiceNow–Armis deals, the future of the console UI and what happens to entry-level security jobs.

Chapters

00:00 Welcome and introductions
01:17 Black Hat, "dead men walking," and why every company is now legacy
03:24 What AI-native really means: sensors → context → reasoning → agents
07:20 SaaSpocalypse or SaaS renaissance? The case against building on frontier models
12:54 Building moats in the age of AI: the three musketeers
19:09 "Agentic" everything, platformization, and where CTEM goes
23:46 VulnOps and the Seven Samurai: shift left, appliances and continuous scanning
38:21 Validation, prioritization, and the Kenna and Armis acquisitions
50:36 Agentic patching, virtual patching and the federated agentic SOC
1:00:02 Hot takes: the death of the console, AI labs vs. cyber vendors, and CTEM's future

Fernando Montenegro argued his way into the analyst world on Twitter. After thirty years in security, including fifteen as a sales engineer, a nudge from Adrian Sanabria landed him at 451 Research, then Omdia, and now The Futurum Group, where he leads cybersecurity. His one condition for coming on the show came from The West Wing: raise the level of debate. What follows is closer to an economics seminar. Fernando explains why the cost of verifiability tilts AI toward attackers, and why defenders don't have to be right every time. He also covers security as a latent construct, the market for lemons, signaling and screening, and the principal-agent problem in the age of AI agents. When Mehul presents $3 exploits, Fernando reaches for the theory of constraints: fix one bottleneck and it moves. He closes with Moneyball advice: stop buying players, start buying runs.

Dan Jones didn't set out to build a vulnerability factory—he set out to hack Cloudflare more effectively. Late last year, sitting on the red team, he and a few colleagues clocked what was coming: They were about to be receive hundreds of thousands of LLM-generated bug reports, and the only sane response was to get there first. They started building six months before Mythos existed, with no best practice to copy and everyone quietly trying a different approach. Then Cloudflare became one of the first enterprises inside Project Glasswing, the classifiers came down, and the harness went to scale. In this episode, Dan tells Mehul the full arc: the 450-line security skill he open sourced, why you tell a model what to do and never what not to do, how a hunting model will happily stand up a fake web server to earn a green check mark, and why his validators never get to see the hunter's exploit code. He also gets specific about the machinery—four models hunting in parallel, mini-Cloudflare’s built on demand, every turn and emission written to a database so nothing is ever lost to a dead SSH session, 21,000 harness emissions boiled down to roughly 7,000 real bugs with over half already fixed—and closes on the uncomfortable half of the problem that most enterprises haven't thought about yet: finding bugs is the easy part. "It's not worth finding the bugs unless you can fix them."

Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone.

00:00:00 Cold open
00:02:40 Pilot, physicist, analyst
00:06:57 Security before the CISO
00:12:49 Platformization and the data puddles
00:23:25 Confidently incomplete
00:34:19 Offense in the age of AI
00:40:06 The price of poor hygiene
00:44:27 Placing bets, and the token bill
00:47:48 Open weights, and who vets the vetters
00:56:28 Retirement, and the human on the loop

Jay Jacobs didn't set out to rewrite vulnerability prioritization—he set out to keep working on data he loved. After helping build Verizon's DBIR alongside Wade Baker, the two spun up Cyentia Institute to do the same kind of research without Verizon attached to it. Two of Cyentia's earliest customers happened to be holding opposite halves of the same puzzle: Kenna had scan data and vulnerability sightings across hundreds of companies, and Fortinet had detections of what attackers were actually exploiting. "What if we bring this together?" turned into a side experiment, then a Black Hat paper, then EPSS—and eventually into Empirical Security, where Jay is Chief Data Scientist to give the score a permanent home. In this episode, Jay tells Mehul the full arc: why only two to five percent of vulnerabilities ever get exploited and what broke his "food supply" theory of attacker behavior, why CVSS is really measuring a practitioner's perception of how bad a vector string looks, the delicate conversations at Kenna about giving away a proprietary score, and the naming theory behind making "EPSS" rhyme with the thing it was replacing. He also gets specific about the machinery—why Metasploit is a strong signal and Exploit-DB is a weak one, why nobody hand-assigns weights, where the "23% more accurate" stat in v5 actually comes from—and closes with the gun-to-the-head threshold answer that surprises almost everyone who hears it: not 0.9, but 0.03.

In our in-depth discussion, Jay shares:

00:03:19 — Jay Jacobs, Cyentia, and the Side Project That Became EPSS
00:06:53 — The 2–5% Number and What CVSS Actually Measures
00:13:11 — Why EPSS Had to Be Given Away
00:18:01 — Building the Model
00:24:07 — Grading the Model in Public
00:29:45 — EPSS v5 and Where "23% More Accurate" Comes From
00:35:27 — Who Funds It and Who's Using It
00:41:13 — AI-Written Exploits
00:46:37 — The Number for the Frustrated CISO

Alan Shimel didn't plan on becoming cybersecurity media's kingmaker—he planned on being a lawyer. He passed the bar at 23, and the only thing that made him "tech savvy" in a New York law office was knowing WordPerfect better than anyone else in the building. But a home lab, a pair of 386 machines that needed to talk to each other, and a front-row seat to the birth of the web pulled him sideways into hosting, then into StillSecure as a founding executive going head-to-head with the people who would build Qualys and Tenable, and eventually into building the media empire behind DevOps.com, Security Boulevard, and TechStrong TV. In this episode, Alan—founder and CEO of TechStrong Group—tells Mehul the unfiltered version of that path: the $49.95-a-month hosting hustle that grew to 5,000 sites in 18 months, the dinner where Gene Kim first pitched him The Phoenix Project, the FeedBurner sale that accidentally handed him the Security Bloggers Network, and why he thinks the entire "open source vs. closed source AI" fight is really an argument about open weights. He also gets refreshingly blunt about Google's zero-click AI Overviews breaking the deal that funded the open web, and why the future of IT and journalism alike comes down to imagination—the one thing he doesn't think AI has.

Alexander Yampolsky didn't set out to invent a category—he just didn't want to get fired for someone else's mistake. As CISO at Gilt Groupe, he watched a fraud-prevention vendor hand over a gorgeous SOC 2 report and then discovered unencrypted credit card data belonging to other customers sitting in their systems. That moment became SecurityScorecard, the company that now scans every IP address on the planet multiple times a day and quietly underwrites a huge chunk of the cyber insurance market. In this episode, Alex—known around the industry as the Don of the security ratings mafia—walks through the unglamorous version of the origin story: the investors who told him security couldn't be measured, the MongoDB decision that haunted his engineers for eight years, the five hours of a stranger's divorce story it took to buy the .com. He also gets refreshingly blunt about why compliance isn't security, why rating pushback is often legitimate, and what happens to the entire discipline when the time-to-exploit window collapses from two years to seconds.

Alex Pinto leads the team behind the Verizon Data Breach Investigations Report—the one publication the entire security industry stops and reads every single year. What almost nobody realizes is that the DBIR, now nineteen years old and built on data from over a hundred contributing partners, is written by exactly four people. In this episode, Alex pulls back the curtain on how the sausage actually gets made: the Verizon marketing team that fought tooth and nail to kill the very first edition, the Secret Service handshake that unlocked everyone else's data, and why the team flatly refuses to tell you which vendor supplied which number. He also walks us through the 2026 findings—vulnerability exploitation finally claiming the top spot after a four-year climb, a CISA KEV remediation rate that somehow went down, and shadow AI rocketing into the top three ways confidential data walks out of your building. Plus, the hunt for objective proof that attackers are using AI, why he thinks all of this will sound like business as usual by next year, and a genuinely excellent argument for why ransomware is the yoga pants of cybersecurity.