Automated penetration testing

Heroic figure lifting flaming sword to cut through mass of gibberish.

cutting-through-noise-socialsightai

Vulnerability Management

Risk Identification/Classification/Mitigation

Resource

Horizon3.ai

Redefining risk-based vulnerability management: Cutting through the noise to what matters most

<body>Interview with Snehal Antani - Rethinking Risk-Based Vulnerability Management</body>

<body><h3>Interview with Snehal Antani - Rethinking Risk-Based Vulnerability Management</h3></body>

<body>Vulnerability management is broken. Organizations basically use math to turn a crappy list into a slightly less crappy list, and the hardest part of the job as a CIO is deciding what NOT to fix. There has to be a better way, and there is...</body>

<body>Vulnerability management is broken. Organizations basically use math to turn a crappy list into a slightly less crappy list, and the hardest part of the job as a CIO is deciding what NOT to fix. There has to be a better way, and there is...</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://horizon3.ai/intelligence/blogs/vulnerability-management-is-broken-there-is-a-better-way/">https://horizon3.ai/intelligence/blogs/vulnerability-management-is-broken-there-is-a-better-way/</a></li></ul></body>

<body>This segment is sponsored by Horizon3.ai. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/horizon3">https://securityweekly.com/horizon3</a> to learn more about them!</body>

<body>This segment is sponsored by Horizon3.ai. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/horizon3">https://securityweekly.com/horizon3</a> to learn more about them!</body>

<body>Topic - Andy Ellis's Black Hat Expo Experience</body>

<body><h3>Topic - Andy Ellis's Black Hat Expo Experience</h3></body>

<body>Andy Ellis visited every booth at Black Hat. Every. Single. One. He wrote up what he learned and we discuss his findings!</body>

<body>Andy Ellis visited every booth at Black Hat. Every. Single. One. He wrote up what he learned and we discuss his findings!</body>

<body><a rel="noreferrer noopener" target="_blank" href="https://www.duha.co/state-of-security-vendors-blackhat-2025/">https://www.duha.co/state-of-security-vendors-blackhat-2025/</a></body>

<body><a rel="noreferrer noopener" target="_blank" href="https://www.duha.co/state-of-security-vendors-blackhat-2025/">https://www.duha.co/state-of-security-vendors-blackhat-2025/</a></body>

<body>Finally, in the enterprise security news,</body>

<body>Finally, in the enterprise security news, </body>

<body><ol><li>Tons of handy new and free tools!</li><li>is cybersecurity really at the latter stages of consolidation?</li><li>new books</li><li>is our obsession with risk quantification hurting our credibility?</li><li>AI trends</li><li>is there an impending AI layoff-pocalypse?</li><li>we explain the kids’ favorite new term: Clanker</li></ol></body>

<body>All that and more, on this episode of Enterprise Security Weekly.</body>

<body>All that and more, on this episode of Enterprise Security Weekly.</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14162″} podcast from PPWorks

AI/ML

Rethinking risk based vulnerability management, Black Hat expo insights, and the news – Snehal Antani – ESW #420

Robotic spiders invade circuit board; digital attack background

Penetration Testing

Risk Assessments/Management

Security tools aren’t enough: Why you don’t know if your defenses actually work (and what to do about it)

<body>Penetration tests are probably the most common and recognized cybersecurity consulting services. Nearly every business above a certain size has had at least one pentest by an external firm.</body>

<body>Penetration tests are probably the most common and recognized cybersecurity consulting services. Nearly every business above a certain size has had at least one pentest by an external firm.</body>

<body>Here's the thing, though - the average ransomware attack looks an awful lot like the bog standard pentest we've all been purchasing or delivering for years. Yet thousands of orgs every year fall victim to these attacks. What's going on here? Why are we so bad at stopping the very thing we've been training against for so long?</body>

<body>Here's the thing, though - the average ransomware attack looks an awful lot like the bog standard pentest we've all been purchasing or delivering for years. Yet thousands of orgs every year fall victim to these attacks. What's going on here? Why are we so bad at stopping the very thing we've been training against for so long?</body>

<body>This Interview with Phillip Wylie will provide some insight into this! Spoiler: a lot of the issues we had 10, even 15 years ago remain today.</body>

<body>This Interview with Phillip Wylie will provide some insight into this! Spoiler: a lot of the issues we had 10, even 15 years ago remain today.</body>

<body><ul><li>Phillip's talk, <a rel="noreferrer noopener" target="_blank" href="https://www.youtube.com/watch?v=dyWl8CTOChQ">Optimal Offensive Security Programs</a> from Dia de los Hackers last fall</li></ul></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”13646″} podcast from PPWorks

Penetration Tests: useful, pointless, harmful, required, ineffective? – Phillip Wylie – ESW #398

Brief

Critical Rockwell PowerMonitor flaws addressed

<body>Our latest in a series of interviews discussing cybersecurity career paths, today we talk to Jayson Grace his path into cybersecurity and his experience building red teams at national labs and purple teams at Meta. We also talk about his community impact, giving talks and building open source tools. Jayson just left Meta for an AI safety startup named <a rel="noreferrer noopener" target="_blank" href="https://www.dreadnode.io">Dreadnode</a>, which we'll discuss as well.</body>

<body>Our latest in a series of interviews discussing cybersecurity career paths, today we talk to Jayson Grace his path into cybersecurity and his experience building red teams at national labs and purple teams at Meta. We also talk about his community impact, giving talks and building open source tools. Jayson just left Meta for an AI safety startup named <a rel="noreferrer noopener" target="_blank" href="https://www.dreadnode.io">Dreadnode</a>, which we'll discuss as well.</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://arxiv.org/html/2408.01605v2">CyberSecEval 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models</a></li><li>The [TTPForge] (<a rel="noreferrer noopener" target="_blank" href="https://github.com/facebookincubator/TTPForge">https://github.com/facebookincubator/TTPForge</a>) is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs).</li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/facebookincubator/ForgeArmory">ForgeArmory</a> provides TTPs that can be used with the TTPForge</li><li>Wired, by Lily Hay Newman: <a rel="noreferrer noopener" target="_blank" href="https://www.wired.com/story/facebook-red-team-x-vulnerabilities/">Facebook's ‘Red Team X’ Hunts Bugs Beyond the Social Network's Walls</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/master-of-servers/mose">MOSE</a> (Master Of SErvers) is a post exploitation tool for configuration management servers.</li><li>BSides SF 2024 - <a rel="noreferrer noopener" target="_blank" href="https://www.youtube.com/watch?v=SnEG7LA0aPc">Beyond Quick Cash: Rethinking Bug Bounties for Greater Impact</a></li><li>BSides LV 2023 - [GF - Enemy Within: Leveraging Purple Teams for Advanced Threat Detection &amp; Prevention - <a rel="noreferrer noopener" target="_blank" href="https://www.youtube.com/watch?v=-MT0tNi2vvc">https://www.youtube.com/watch?v=-MT0tNi2vvc</a></li></ul></body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”13171″} podcast from PPWorks

Cybersecurity Career Paths: from touring musician to purple teaming at Meta – Jayson Grace – ESW #378

Perspective

Why we need to automate web application security testing

<body>This may be controversial, however, we've been privately discussing how organizations benefit from penetration testing and vulnerability scanning. Do you still need these services as a critical part of your security program? Can't you just patch stuff that is missing patches? Tune in for a lively debate!</body>