Interview with Casey Ellis
Our focus for this interview with Casey Ellis are the massive changes in:
- Vulnerability Discovery
- Vulnerability Disclosure
- Exploitation and Remediation
The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?
Vibe Check
This week's vibe check explores the question, which security project always takes twice as long as planned?
- 55% - Enforcing data classification
- 18% - SOAR automation buildout
- 9% - Rolling out SSO
- 9% - Moving to passwordless auth
- 9% - AI agent discovery
- 0% - Other
News Segment
Finally, in the enterprise security news,
- funding and M&A
- PHP2Shell update
- floods of bugs
- silent train
- breaches
- the script kiddy bar has been lowered
- the basics continue to be important
- an AI lab pulls a PR stunt
- an old squirrel story was a scam!
All that and more, on this episode of Enterprise Security Weekly.
Casey Ellis is a cybersecurity entrepreneur, founder and advisor to Bugcrowd, co-founder of The disclose.io Project, and Principal at Tall Poppy Group. He started in cybersecurity as a penetration tester in the early 2000s, formed Tall Poppy Group in 2008, and in 2012 pioneered the crowdsourced security-as-a-service model by founding and launching the first bug bounty programs on Bugcrowd. He co-founded disclose.io in 2014, ahead of its public launch in 2018, as an open-source project promoting vulnerability disclosure and safe harbor adoption; it has since grown into the infrastructure behind the disclosure directory, the CC0 “dioterms” safe harbor language, and lookup.disclose.io. He serves on the board of the Security Research Legal Defense Fund and the advisory committee of the Hacking Policy Council, sits on review boards for Black Hat USA, DEF CON Policy, Offensive AI Con, UnpromptedCon, Unprompted.au, and DistrictCon, and is a regular interviewer on the Risky Business podcast. His current focus sits at the intersection of security, AI, and policy. A native of Sydney, Australia, he is based in the San Francisco Bay Area.
The hardest part of defending an enterprise today isn't finding security gaps. It's managing complexity.
Hybrid infrastructure. Legacy systems. Cloud. AI. Third-party risk. Regulatory requirements. Nation-state threats. And somehow you're expected to make all of it work together.
If you're responsible for securing government or critical infrastructure environments, join us for the Government Security Virtual Summit on November 18. Hear how security leaders are modernizing defenses, reducing complexity, and building resilient security programs that stand up to today's threat landscape.
Security Weekly listeners can register for free at https://securityweekly.com/govsec using the discount code CSS26-SW
Adrian Sanabria
- FUNDING/M&A, courtesy of the Security, Funded newsletter #267 – Shell Happens
FUNDING
- BlackWall (formerly BotGuard) (EE) · $100.0M Series C | anti-bot and DDoS mitigation platform, led by AVP (new unicorn)
- Mave (IL) · $28.0M Series A and $6.0M Seed | AI threat investigation and response, led by Red Dot Capital Partners, Dell Technologies Capital, and Emerge Ventures
ACQUISITIONS
- Nothing worth talking about, mostly services
LAYOFFS
- Fireblocks, a security platform for transferring digital assets, confirmed it plans to reduce its global workforce as part of a restructuring.
- VULNS: Censys PHP2Shell Exposure Tracker
52% of the sites being tracked have no upgrade path
- VULNS: Silicon Valley Is Grappling With a Flood of Bugs Found by A.I.
- BREACHES: Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed
- BREACHES: Cyberattack forces University of New Mexico Health to divert ambulances, cancel appointments – DataBreaches.Net
- BREACHES: Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat – DataBreaches.Net
- ESSAYS: The Script Kiddy Bar Has Been Lowered
A window into the Internet's dumbest criminals and perhaps the most troubling attack trend.
- BASICS: Crest CEO: ‘Basics shouldn’t be abandoned in the race to deploy AI’
A trio of stories emphasizing that, in the age of AI, the basics matter more than ever!
AI can find IT problems faster, but fixing them is another matter
Your Basics Still Matter, No Matter How Much AI You Slap On Top
- PR STUNTS: Concerning behavior from a popular open-weight AI model
Canadian Cohere's marketing is pushing "sovereign" and "enterprise-safe" AI hard to capitalize on political division, but in this example, they pushed a bit too hard.
By taking hallucination out of context, they made it seem like a Qwen model somehow had the power to 'phone home'.
An excellent run-down of what actually happened is here.
- SQUIRREL: Mighty Mike Plays Dad Clarifies He Owns ‘Like 12 Companies,’ Promises Refunds After YouTube Ad Drama
Ayman Elsawah
- ESSAY: This was the worst week in Cybersecurity history
Ayman's latest.
I want to try offering a counterpoint:
The week seemed crazy with so many disclosed vulnerabilities and incidents, but nothing really bad seemed to happen as a result? Which is to say that everything was handled correctly, communicated well, and I can't find anyone that has been breached due to eMudhra or PHP yet. Let's chat about it on the podcast!
Sean Metcalf
Tyler Shields
- The Tyranny of the Decidable
The Cyber Why returns!
