Disruption is Coming for the Vulnerability Management Market – Tod Beardsley – ESW #425
Interview with Tod Beardsley
This interview is sponsored by runZero.
Legacy vulnerability management (VM) hasn't innovated alongside of attackers, and it shows. Let's talk about the state of VM.
Check out https://securityweekly.com/runzero to learn more!
Topic Segment: NPM Incidents
In this week’s topic segment, we’re discussing all the NPM supply chain attacks from the past 3 weeks.
I recently published a roundup of these incidents over on my Substack.
Weekly Enterprise News
Finally, in the enterprise security news,
- funding and acquisitions are going crazy
- an exciting new canarytoken
- banks have a more sedate approach to agentic
- MCP security
- the future Subprime Code crash of 2028
- is security worried about the wrong risks?
- botnets are back in the headlines
- some bs research
- journalists getting duped by AI
- Animal crossing villagers are organizing against Tom Nook
All that and more, on this episode of Enterprise Security Weekly.
Tod Beardsley is VP of Security Research at runZero, where he “kicks assets and fakes frames.” Prior to 2025, he was the Section Chief for the Vulnerability Response section for CSD/VM/VRC at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government. He’s also a founder and CNA point of contact for AHA!. He spends much of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern ICS/OT implementations. He has held IT ops, security, software engineering, and management positions in large organizations such as the Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Tod is a CVE Board member, has authored several research papers, and hosted Rapid7’s Security Nation podcast with Jen Ellis. He is also a former Travis County Election Judge in Texas, and is currently an internationally-tolerated horror fiction expert.
Join us for InfoSec World 2025 — October 27 to 29 in sunny Lake Buena Vista, Florida at Disney’s Coronado Springs Resort! Workshops run October 25–26 and October 29–30. The premier cybersecurity conference is here — save 25% with code ISW25-SW at securityweekly.com/ISW2025!
Adrian Sanabria
- FUNDING/M&A: courtesy of the Security, Funded newsletter, issue #211 – Two AI Models Walk Into a Bar
Vibe Check
Do you think 1-person security teams will become the norm as AI capabilities grow?
No - security complexity keeps growing faster than AI
Funding
- Vega raised $65M across a seed and Series A round led by Accel to "replace SIEM with SAM"?
- Remedio (fka GYTPOL) raises a $65M round, led by Bessemer Venture Partners, after being bootstrapped for 6 years.
- Koi raised a $38.0M Series A from Battery Ventures and Team8 and a $10.0M Seed from NFX and Picture Capital.
- TENEX.AI, a United States-based managed threat detection and response (MDR) platform, raised a $27.0M Series A from Crosspoint Capital Partners.
- FireCompass raises $20M in "strategic funding" from the EC-Council
- Red Access, an Israel-based secure remote browsing platform, raised a $17.0M Series A from Norwest Venture Partners.
- AegisAI, a United States-based email security and incident response platform, raised a $13.0M Seed from Accel and Foundation Capital.
- Adaptive Security, a United States-based security awareness training platform for AI-enabled social engineering and deepfake attacks, raised a $12.0M Series A from OpenAI Startup Fund.
- Hush Security, an Israel-based non-human identity security platform that detects ephemeral and shadow identities, raised a $11.0M Seed from Battery Ventures and YL Ventures.
Acquisitions
- Nozomi Networks, a United States-based operational technology (OT) security platform for industrial control systems (ICS), was acquired by Mitsubishi Electric for $1.0B. Nozomi Networks had previously raised $266.0M in funding.
- CalypsoAI, a United States-based platform for protecting against adversarial machine learning (ML) attacks, was acquired by F5 for $180.0M. CalypsoAI had previously raised $46.5M in funding.
- Observo AI, a United States-based security data observability platform, was acquired by SentinelOne for an undisclosed amount. Observo AI had previously raised $15.0M in funding.
- Check Point acquires Swiss-based AI Security startup Lakera for an undisclosed sum. Remember Gandalf? That's this Lakera.
- Crowdstrike acquires Pangea for an undisclosed sum. Pangea was originally an API-based "security platform as a service", but pivoted to AI some time in the past year or two.
- NEW FEATURES: Introducing the AWS Infrastructure Canarytoken
Quite a complex Canarytoken, but possibly one of the most effective and comprehensive? They're even auto-generating resource names, taking a lot of the guesswork out of deploying deception.
And it's free!
Also, they mention Canarytokens saved Grafana's bacon a while back, and that post mortem is a really good read, diving into the details of how they suggest deploying and using Canarytokens.
- AGENTIC AI: Interview: Using AI agents as judges in GenAI workflows
I think this is a really interesting and useful read on how to think about using agentic, from a vertical that is much more thoughtful and intentional when it comes to deploying new technology (i.e. banks, financial services) than much of the behavior we're seeing in the market right now.
- GUIDES: MCP Security: Risks, Challenges, and How to Mitigate
A good starter guide on understanding and securing MCP
- ESSAYS: “Subprime Code”: How Vibe Coding Could Trigger the Next Great Crash
A fun read from Nick Vigier, exploring how vibe coding could mirror a tech equivalent of the events that led to the 2008 Great Recession.
- ESSAYS: Security is worried about the wrong risks
A must-read on where security's priorities should be.
- BREACHES: Shai-Hulud npm Supply Chain Attack
NPM has not been having an easy time. The 3rd major breach affecting NPM packages in a week (though the first and third seem to be connected by the same actor)
- BREACHES: Cloudflare Blocks Record-Breaking 11.5 Tbps DDoS Attack
Botnets, especially powerful IoT-based ones, are coming back and causing a lot of pain
- RESEARCH: From CVE Entries to Verifiable Exploits: An Automated Multi-Agent Framework for Reproducing CVEs
This makes no sense to me. I need to dig in deeper, but CVE details do NOT have enough information (certainly not consistently, either) to do what the authors are claiming. Not even close.
- DUMPSTER FIRES: Wired, Business Insider Editors Duped By Completely Bogus ‘AI’ Using ‘Journalist’ Who Made Up Towns, People That Don’t Exist
Won't be the last time this happens, either
- SQUIRREL: AI-Powered Animal Crossing Villagers Begin Organizing Against Tom Nook
