Fernando Montenegro argued his way into the analyst world on Twitter. After thirty years in security, including fifteen as a sales engineer, a nudge from Adrian Sanabria landed him at 451 Research, then Omdia, and now The Futurum Group, where he leads cybersecurity. His one condition for coming on the show came from The West Wing: raise the level of debate. What follows is closer to an economics seminar. Fernando explains why the cost of verifiability tilts AI toward attackers, and why defenders don't have to be right every time. He also covers security as a latent construct, the market for lemons, signaling and screening, and the principal-agent problem in the age of AI agents. When Mehul presents $3 exploits, Fernando reaches for the theory of constraints: fix one bottleneck and it moves. He closes with Moneyball advice: stop buying players, start buying runs.

Dan Jones didn't set out to build a vulnerability factory—he set out to hack Cloudflare more effectively. Late last year, sitting on the red team, he and a few colleagues clocked what was coming: They were about to be receive hundreds of thousands of LLM-generated bug reports, and the only sane response was to get there first. They started building six months before Mythos existed, with no best practice to copy and everyone quietly trying a different approach. Then Cloudflare became one of the first enterprises inside Project Glasswing, the classifiers came down, and the harness went to scale. In this episode, Dan tells Mehul the full arc: the 450-line security skill he open sourced, why you tell a model what to do and never what not to do, how a hunting model will happily stand up a fake web server to earn a green check mark, and why his validators never get to see the hunter's exploit code. He also gets specific about the machinery—four models hunting in parallel, mini-Cloudflare’s built on demand, every turn and emission written to a database so nothing is ever lost to a dead SSH session, 21,000 harness emissions boiled down to roughly 7,000 real bugs with over half already fixed—and closes on the uncomfortable half of the problem that most enterprises haven't thought about yet: finding bugs is the easy part. "It's not worth finding the bugs unless you can fix them."

Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone.

00:00:00 Cold open
00:02:40 Pilot, physicist, analyst
00:06:57 Security before the CISO
00:12:49 Platformization and the data puddles
00:23:25 Confidently incomplete
00:34:19 Offense in the age of AI
00:40:06 The price of poor hygiene
00:44:27 Placing bets, and the token bill
00:47:48 Open weights, and who vets the vetters
00:56:28 Retirement, and the human on the loop

Jay Jacobs didn't set out to rewrite vulnerability prioritization—he set out to keep working on data he loved. After helping build Verizon's DBIR alongside Wade Baker, the two spun up Cyentia Institute to do the same kind of research without Verizon attached to it. Two of Cyentia's earliest customers happened to be holding opposite halves of the same puzzle: Kenna had scan data and vulnerability sightings across hundreds of companies, and Fortinet had detections of what attackers were actually exploiting. "What if we bring this together?" turned into a side experiment, then a Black Hat paper, then EPSS—and eventually into Empirical Security, where Jay is Chief Data Scientist to give the score a permanent home. In this episode, Jay tells Mehul the full arc: why only two to five percent of vulnerabilities ever get exploited and what broke his "food supply" theory of attacker behavior, why CVSS is really measuring a practitioner's perception of how bad a vector string looks, the delicate conversations at Kenna about giving away a proprietary score, and the naming theory behind making "EPSS" rhyme with the thing it was replacing. He also gets specific about the machinery—why Metasploit is a strong signal and Exploit-DB is a weak one, why nobody hand-assigns weights, where the "23% more accurate" stat in v5 actually comes from—and closes with the gun-to-the-head threshold answer that surprises almost everyone who hears it: not 0.9, but 0.03.

In our in-depth discussion, Jay shares:

00:03:19 — Jay Jacobs, Cyentia, and the Side Project That Became EPSS
00:06:53 — The 2–5% Number and What CVSS Actually Measures
00:13:11 — Why EPSS Had to Be Given Away
00:18:01 — Building the Model
00:24:07 — Grading the Model in Public
00:29:45 — EPSS v5 and Where "23% More Accurate" Comes From
00:35:27 — Who Funds It and Who's Using It
00:41:13 — AI-Written Exploits
00:46:37 — The Number for the Frustrated CISO

Alan Shimel didn't plan on becoming cybersecurity media's kingmaker—he planned on being a lawyer. He passed the bar at 23, and the only thing that made him "tech savvy" in a New York law office was knowing WordPerfect better than anyone else in the building. But a home lab, a pair of 386 machines that needed to talk to each other, and a front-row seat to the birth of the web pulled him sideways into hosting, then into StillSecure as a founding executive going head-to-head with the people who would build Qualys and Tenable, and eventually into building the media empire behind DevOps.com, Security Boulevard, and TechStrong TV. In this episode, Alan—founder and CEO of TechStrong Group—tells Mehul the unfiltered version of that path: the $49.95-a-month hosting hustle that grew to 5,000 sites in 18 months, the dinner where Gene Kim first pitched him The Phoenix Project, the FeedBurner sale that accidentally handed him the Security Bloggers Network, and why he thinks the entire "open source vs. closed source AI" fight is really an argument about open weights. He also gets refreshingly blunt about Google's zero-click AI Overviews breaking the deal that funded the open web, and why the future of IT and journalism alike comes down to imagination—the one thing he doesn't think AI has.

Alexander Yampolsky didn't set out to invent a category—he just didn't want to get fired for someone else's mistake. As CISO at Gilt Groupe, he watched a fraud-prevention vendor hand over a gorgeous SOC 2 report and then discovered unencrypted credit card data belonging to other customers sitting in their systems. That moment became SecurityScorecard, the company that now scans every IP address on the planet multiple times a day and quietly underwrites a huge chunk of the cyber insurance market. In this episode, Alex—known around the industry as the Don of the security ratings mafia—walks through the unglamorous version of the origin story: the investors who told him security couldn't be measured, the MongoDB decision that haunted his engineers for eight years, the five hours of a stranger's divorce story it took to buy the .com. He also gets refreshingly blunt about why compliance isn't security, why rating pushback is often legitimate, and what happens to the entire discipline when the time-to-exploit window collapses from two years to seconds.

Alex Pinto leads the team behind the Verizon Data Breach Investigations Report—the one publication the entire security industry stops and reads every single year. What almost nobody realizes is that the DBIR, now nineteen years old and built on data from over a hundred contributing partners, is written by exactly four people. In this episode, Alex pulls back the curtain on how the sausage actually gets made: the Verizon marketing team that fought tooth and nail to kill the very first edition, the Secret Service handshake that unlocked everyone else's data, and why the team flatly refuses to tell you which vendor supplied which number. He also walks us through the 2026 findings—vulnerability exploitation finally claiming the top spot after a four-year climb, a CISA KEV remediation rate that somehow went down, and shadow AI rocketing into the top three ways confidential data walks out of your building. Plus, the hunt for objective proof that attackers are using AI, why he thinks all of this will sound like business as usual by next year, and a genuinely excellent argument for why ransomware is the yoga pants of cybersecurity.

Sasan is a veteran product builder with over 20 years of cybersecurity experience. In this episode, Sasan shares his journey from creating an early container security startup, navigating an acquisition by Tenable, and eventually building CrowdStrike's cloud security module into a $100M ARR business. We explore the early misconceptions surrounding Docker security, the architectural hurdles of moving legacy on-prem software to the cloud, and a harrowing tale of a $100K crypto-mining AWS bill. Sasan also details his recent pivot to the world of AI, explaining why human hype is often worse than AI hallucinations, how AI is fundamentally changing the speed of cyber attacks, and why defenders must rebuild their architectures to survive the next generation of threats.

Thomas Dullien—better known to the cybersecurity world as the legendary Halvar Flake—didn't just participate in the early cracking scene; he helped define it. As a computing mathematician and the mastermind behind BinDiff, Thomas revolutionized how we understand silent patches and reverse engineering. He eventually sold his pioneering company, Zynamics, to Google, but the journey was anything but smooth. In this episode, we get a no-holds-barred look at his origin story, why building a business around reverse engineering is a massive headache, and the excruciating reality of early tech M&As. Plus, Thomas delivers a sobering, provocative take on how agentic AI and infinite compute are about to rewrite the rules of vulnerability research—and why the human element isn't going anywhere anytime soon.

Ron Gula is a cybersecurity pioneer, venture capitalist, and the visionary founder behind Tenable. Having bootstrapped his way to a $50 million Series A and scaled one of the industry's most recognizable brands, Ron has witnessed the highs and lows of company building. In this episode, we explore the authentic culture he established during Tenable's early days, the critical mistakes founders make when pitching venture capital, and the shifting landscape of building startups in the AI era. Ron details the strict rules of his famous "five-slide pitch deck," explains why AI wrappers are simply integrators rather than innovators, and warns that CISOs must take charge of AI operations before they are replaced by automated platforms.

In our in-depth discussion, Ron shares:
[00:04:21] Shaping Tenable's early culture with Cyndi Gula and Renaud Deraison.
[00:08:10] Offering a junior employee a 4-day workweek during the 2008 crisis.
[00:09:55] Talking a customer out of buying unneeded vulnerability scanners.
[00:17:05] Creating "V-Ron," an unfiltered 3D avatar for controversial opinions.
[00:22:44] Secondary sales that enrich employees versus traditional VC rounds.
[00:24:51] Why sub-$1M ARR startups raising $30M rounds is a major red flag.
[00:27:15] The strict "five-slide pitch deck" methodology to secure funding.
[00:35:08] Pitching mistakes: leading with advisor names instead of solutions.
[00:37:51] The danger of AI wrappers: becoming an integrator, not an innovator.
[00:45:56] The impending platformization and consolidation of cybersecurity.
[00:52:34] Predicting the replacement of CISOs by AI operations and MSSPs.
[00:52:58] Why CISOs must aggressively lobby to run internal AI operations.
[00:57:40] Why cyber hygiene fails against nation-states, requiring air gaps.
[00:59:25] The economic realities of rising ransomware costs and falling payouts.
[01:04:23] The future of AI-Native offense and Defense