Wrapping Up Season One of "30 Min on: Vulnerability Management"

Maor Sorero, Head of Marketing

October 20, 2024

30 Min on: Vulnerability Management is essential listening for security professionals, IT leaders, developers, and cybersecurity enthusiasts. In just 30 minutes, each episode of 30 Min on: Vulnerability Management explores the challenges and cutting-edge strategies for tackling vulnerabilities in our increasingly cloud-driven world.

Welcome to our season one recap of 30Min on: Vulnerability Management, where host James Berthoty sat down with CISOs, investors and groundbreaking technologists to discuss critical strategies for adapting to the scale of enterprise-grade vulnerability management. We’ll start by getting straight to the key lessons learned this season, and then our favorite moments from each of our esteemed guests.

5 Lessons Learned from Our Experts

James covered a lot of ground with his guests but five themes stood out in particular.

Context Drives Effective Risk Management
It’s not just about spotting vulnerabilities. You need to understand the bigger picture—how applications behave, the business impact, and real threat scenarios—to prioritize risks and act effectively.

Security Needs Everyone’s Input
Managing vulnerabilities takes more than just the security team. Developers, engineers, and leadership must collaborate to maintain a strong security posture.

Automation Fuels Scalability
As businesses grow, manual security processes can’t keep up. Automating key tasks helps teams focus on high-impact work and reduces operational strain.

Security Should Be Part of Development
Embedding security into the development process speeds up vulnerability detection and fixes, making security a natural part of building software.

New Tech = New Challenges
AI, cloud computing, and ADR open doors to both vulnerabilities and solutions. Keeping up means continuous learning and evolving to secure these technologies.

Episode Highlights

Every episode of the podcast gives listeners the opportunity to hear from major cybersecurity decision-makers and solutions providers. Here’s what they discussed and had to say.

Episode 1: Navigating the Vulnerability Overload with Meny Har of Opus Security

"It's a fragmented problem. Over the past three months, the issue has become more visible, and people are actively seeking solutions. It's widely acknowledged that it needs to be solved, and likely in a new way. The approach varies significantly because there are so many different types of companies and security organizations."

— Meny Har

In our inaugural episode, James sat down with Meny Har, Co-founder and CEO of Opus Security to discuss the overwhelming challenges posed by the surge in CVEs and configuration issues in today’s digital landscape. Meny shares his rich background in operations, offering unique perspectives on managing the deluge of vulnerabilities with strategic acumen.

Episode 2: Overhead in Security Remediation – The Path to Efficiency with Andy Ellis

"I think a lot of what security teams do is they're trying to prevent an outcome, but they don't always think about what is the operational cost of their own security controls... Security teams need to be thinking about not just the security benefit, but also the operational overhead that they're imposing on the organization."

— Andy Ellis

James welcomed Andy Ellis, a CISO veteran and now Partner at cybersecurity investor YL Ventures. Together, they unraveled the complexities of vulnerability management and evolving responsibilities within security teams, highlighting the significance of streamlined processes and the advent of Cloud Security Posture Management (CSPM) tools.

Episode 3: Collaborative Pathways in Security Remediation with Shaun Blackburn of Gemini

"Building partnerships with service owners and getting them to care about security problems in their service is more important than any tool... It's really about how do you align security with what the business is trying to do and make sure that you're both moving in the same direction."

— Shaun Blackburn

In this episode, Shaun Blackburn, CISO at Gemini, shared stories from his extensive experience from roles at Airbnb, Netflix, and AWS. The discussion turned to the criticality of transforming vulnerability management through automation and collaborative engineering efforts, and emphasized the importance of building a security culture that partners closely with engineering teams.

Episode 4: Scaling Security Across Company Growth with Justin Somaini

"When you're in a high-growth company, scaling security is a big challenge... You're dealing with a lot of change, and you need to build security programs that can adapt and scale with the organization."

— Justin Somaini

Justin Somaini, a seasoned CISO-turned investor with a career spanning Unity, SAP, and Yahoo, joined James to explore how security practices evolve from startups to large enterprises. They unpacked the questions we all have about today’s strategic security initiatives, the shared accountability model, and the crucial role of automation in scaling security effectively.

Episode 5: Convergence of Scanning Tools with Aviv Moosinger of Kodem

"There's a tool for everything, but integrating them and making sense of all the data is a major challenge... Security teams are overwhelmed with alerts and information, but lack the context to prioritize effectively."

— Aviv Moosinger

James interviewed Aviv Moosinger, CEO and Co-founder of Kodem, whose background includes Israeli intelligence and cybersecurity roles at NSO Group. Aviv discussed his holistic approach to security, the importance of integrating operational security directly with code development, and the necessity of adaptive strategies in a rapidly evolving tech landscape.

Episode 6: The CISO Perspective on the Market with Frank Kim

"Security professionals need to understand development processes to effectively integrate security... The biggest challenge is changing the mindset from being gatekeepers to becoming enablers who work alongside development teams."

— Frank Kim

In this insightful episode, Frank Kim shared his journey from software engineering to cybersecurity leadership. He and James explored the challenges of integrating robust security practices within development workflows, emphasizing the need for security professionals to actively participate in development processes to manage risks effectively.

Episode 7: Vulnerability Management in the Age of ADR with Daniel Shechter of Miggo Security

"In modern application environments, everything is distributed across services, platforms, and clouds... The biggest challenge is gaining the visibility needed to understand what's happening in real-time and detecting threats effectively."

— Daniel Shechter

Daniel Shechter, CEO and Co-founder of Miggo Security, introduced the innovative concept of Application Detection and Response (ADR). He discussed how ADR enhances alignment between security practices and application development, utilizing observability to improve threat detection and fostering collaboration between security teams and developers.

Episode 8: Mastering AI Vulnerabilities with Adir of AIM Security

"When talking about agents, it's even more complex... We don't yet have the controls to make sure that we're not shooting ourselves in the foot because of the unpredictability of LLMs... There's a lot of trust and risk component to this."

— Adir

James was joined by Adir, CTO of AIM Security, to explore the intersection of AI and vulnerability management. Adir shared how generative AI is transforming vulnerability research, making complex tasks more accessible, and discusses the ethical implications and dual-edged influence of AI on both attackers and defenders.

Episode 9: Building Seamless Security Ecosystems with Yuval Shchory of AWS

^"We need to identify where your strengths lie and where building certain capabilities will take too much time. The cloud environment is complex, and security products must evolve and interconnect to address these challenges."

— Yuval Shchory

In this episode, Yuval Shchory from AWS shared his extensive experience in product development and partnerships. He and James discussed the importance of building effective security ecosystems, the role of strategic partnerships, and the integration of advanced technologies like AI and machine learning in enhancing cloud security.

Episode 10: Scaling Vulnerability Management – A Founders' Insight with Meny Har and Or Gabay

"It's pretty clear to me now that this is a foundation we need to build. As we continue to explore new surfaces, it's becoming obvious that without establishing a solid base, we'll face even greater challenges in the future."

— Meny Har

For our season finale, James reunitesdwith Meny Har and welcomes Or Gabay, both founders of Opus Security. They reflected on the rapid changes in vulnerability management, the integration across different sectors within companies, and the technical complexities of managing vulnerabilities in diverse environments.

Conclusion

As we close out the first season of "30 Min on: Vulnerability Management," we want to extend our thanks to the guests who shared their expertise and insights. The cybersecurity landscape is ever-changing, and navigating it requires constant learning and adaptation.

We’re excited to announce that future seasons will dive deeper into critical areas such as threat intelligence, incident response, and the evolving role of automation in security. We'll also bring in new voices from diverse sectors to provide fresh perspectives on the cybersecurity landscape.

We hope you found these discussions not only informative but also practical, equipping you to tackle the challenges within your organizations. Your feedback is invaluable, so feel free to share topics you’d like us to cover or guests you want to hear from. Together, let's keep pushing the boundaries of vulnerability management.

Keep an eye out for our return, where we’ll continue to explore these pressing issues and more!