Noise2Signal

Mehul Revankar

A cybersecurity podcast. Cyber conversations with more signal, less Noise. Noise2Signal is the antidote to the cybersecurity echo chamber: unfiltered conversations with the people who actually built the field — no buzzword bingo, no vendor pitches.

  1. Sep 29

    Ep. 21 Seven Samurai's of VulnOps & Dead Men (SaaS?) Walking w/ Nico Popp

    Nico Popp, operating partner at Crosspoint Capital Partners and former Chief Product Officer at Tenable, joins Mehul to explain why he came back from Black Hat saying there were "dead men walking everywhere." He argues that putting AI on top of a legacy product doesn't make it AI-native. The real shift is a new architecture: sensors feed a context graph, the graph feeds a reasoning layer, and agents sit on top where the console used to be. They cover what makes a durable moat now ("the three musketeers": agentic architecture, captured agent trajectories, and your own reinforcement-learned models), why wiring in frontier models is a strategic blunder, and Nico's "Seven Samurai" framework for VulnOps. That framework describes how vulnerability management has to change when attackers are agentic, and why it ends up absorbed into the agentic SOC. Along the way they discuss the Cisco–Kenna and ServiceNow–Armis deals, the future of the console UI and what happens to entry-level security jobs. Chapters 00:00 Welcome and introductions 01:17 Black Hat, "dead men walking," and why every company is now legacy 03:24 What AI-native really means: sensors → context → reasoning → agents 07:20 SaaSpocalypse or SaaS renaissance? The case against building on frontier models 12:54 Building moats in the age of AI: the three musketeers 19:09 "Agentic" everything, platformization, and where CTEM goes 23:46 VulnOps and the Seven Samurai: shift left, appliances and continuous scanning 38:21 Validation, prioritization, and the Kenna and Armis acquisitions 50:36 Agentic patching, virtual patching and the federated agentic SOC 1:00:02 Hot takes: the death of the console, AI labs vs. cyber vendors, and CTEM's future

  2. Sep 22

    Ep. 20 The Economics of Cyber Offense & Defense w/ Fernando Montenegro

    Fernando Montenegro argued his way into the analyst world on Twitter. After thirty years in security, including fifteen as a sales engineer, a nudge from Adrian Sanabria landed him at 451 Research, then Omdia, and now The Futurum Group, where he leads cybersecurity. His one condition for coming on the show came from The West Wing: raise the level of debate. What follows is closer to an economics seminar. Fernando explains why the cost of verifiability tilts AI toward attackers, and why defenders don't have to be right every time. He also covers security as a latent construct, the market for lemons, signaling and screening, and the principal-agent problem in the age of AI agents. When Mehul presents $3 exploits, Fernando reaches for the theory of constraints: fix one bottleneck and it moves. He closes with Moneyball advice: stop buying players, start buying runs.

  3. Sep 15

    Ep. 19 Building A Vulnerability Discovery Harness w/ Dan Jones

    Dan Jones didn't set out to build a vulnerability factory—he set out to hack Cloudflare more effectively. Late last year, sitting on the red team, he and a few colleagues clocked what was coming: They were about to be receive hundreds of thousands of LLM-generated bug reports, and the only sane response was to get there first. They started building six months before Mythos existed, with no best practice to copy and everyone quietly trying a different approach. Then Cloudflare became one of the first enterprises inside Project Glasswing, the classifiers came down, and the harness went to scale. In this episode, Dan tells Mehul the full arc: the 450-line security skill he open sourced, why you tell a model what to do and never what not to do, how a hunting model will happily stand up a fake web server to earn a green check mark, and why his validators never get to see the hunter's exploit code. He also gets specific about the machinery—four models hunting in parallel, mini-Cloudflare’s built on demand, every turn and emission written to a database so nothing is ever lost to a dead SSH session, 21,000 harness emissions boiled down to roughly 7,000 real bugs with over half already fixed—and closes on the uncomfortable half of the problem that most enterprises haven't thought about yet: finding bugs is the easy part. "It's not worth finding the bugs unless you can fix them."

  4. Sep 9

    Ep 18. The CISO before CISO's w/ Scott Crawford

    Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone. 00:00:00 Cold open 00:02:40 Pilot, physicist, analyst 00:06:57 Security before the CISO 00:12:49 Platformization and the data puddles 00:23:25 Confidently incomplete 00:34:19 Offense in the age of AI 00:40:06 The price of poor hygiene 00:44:27 Placing bets, and the token bill 00:47:48 Open weights, and who vets the vetters 00:56:28 Retirement, and the human on the loop

  5. Sep 1

    Ep 17. 0 to 1 on EPSS w/ Jay Jacobs. Chief Data Scientist at Empirical Security

    Jay Jacobs didn't set out to rewrite vulnerability prioritization—he set out to keep working on data he loved. After helping build Verizon's DBIR alongside Wade Baker, the two spun up Cyentia Institute to do the same kind of research without Verizon attached to it. Two of Cyentia's earliest customers happened to be holding opposite halves of the same puzzle: Kenna had scan data and vulnerability sightings across hundreds of companies, and Fortinet had detections of what attackers were actually exploiting. "What if we bring this together?" turned into a side experiment, then a Black Hat paper, then EPSS—and eventually into Empirical Security, where Jay is Chief Data Scientist to give the score a permanent home. In this episode, Jay tells Mehul the full arc: why only two to five percent of vulnerabilities ever get exploited and what broke his "food supply" theory of attacker behavior, why CVSS is really measuring a practitioner's perception of how bad a vector string looks, the delicate conversations at Kenna about giving away a proprietary score, and the naming theory behind making "EPSS" rhyme with the thing it was replacing. He also gets specific about the machinery—why Metasploit is a strong signal and Exploit-DB is a weak one, why nobody hand-assigns weights, where the "23% more accurate" stat in v5 actually comes from—and closes with the gun-to-the-head threshold answer that surprises almost everyone who hears it: not 0.9, but 0.03. In our in-depth discussion, Jay shares: 00:03:19 — Jay Jacobs, Cyentia, and the Side Project That Became EPSS 00:06:53 — The 2–5% Number and What CVSS Actually Measures 00:13:11 — Why EPSS Had to Be Given Away 00:18:01 — Building the Model 00:24:07 — Grading the Model in Public 00:29:45 — EPSS v5 and Where "23% More Accurate" Comes From 00:35:27 — Who Funds It and Who's Using It 00:41:13 — AI-Written Exploits 00:46:37 — The Number for the Frustrated CISO

  6. Aug 25

    Ep 16. The Accidental Entreprenuer w/ Alan Shimel. CEO Techstrong Group

    Alan Shimel didn't plan on becoming cybersecurity media's kingmaker—he planned on being a lawyer. He passed the bar at 23, and the only thing that made him "tech savvy" in a New York law office was knowing WordPerfect better than anyone else in the building. But a home lab, a pair of 386 machines that needed to talk to each other, and a front-row seat to the birth of the web pulled him sideways into hosting, then into StillSecure as a founding executive going head-to-head with the people who would build Qualys and Tenable, and eventually into building the media empire behind DevOps.com, Security Boulevard, and TechStrong TV. In this episode, Alan—founder and CEO of TechStrong Group—tells Mehul the unfiltered version of that path: the $49.95-a-month hosting hustle that grew to 5,000 sites in 18 months, the dinner where Gene Kim first pitched him The Phoenix Project, the FeedBurner sale that accidentally handed him the Security Bloggers Network, and why he thinks the entire "open source vs. closed source AI" fight is really an argument about open weights. He also gets refreshingly blunt about Google's zero-click AI Overviews breaking the deal that funded the open web, and why the future of IT and journalism alike comes down to imagination—the one thing he doesn't think AI has.

  7. Aug 18

    Ep 15. The Don of Security Ratings Mafia w/ Aleksandr Yampolskiy

    Alexander Yampolsky didn't set out to invent a category—he just didn't want to get fired for someone else's mistake. As CISO at Gilt Groupe, he watched a fraud-prevention vendor hand over a gorgeous SOC 2 report and then discovered unencrypted credit card data belonging to other customers sitting in their systems. That moment became SecurityScorecard, the company that now scans every IP address on the planet multiple times a day and quietly underwrites a huge chunk of the cyber insurance market. In this episode, Alex—known around the industry as the Don of the security ratings mafia—walks through the unglamorous version of the origin story: the investors who told him security couldn't be measured, the MongoDB decision that haunted his engineers for eight years, the five hours of a stranger's divorce story it took to buy the .com. He also gets refreshingly blunt about why compliance isn't security, why rating pushback is often legitimate, and what happens to the entire discipline when the time-to-exploit window collapses from two years to seconds.

  8. Aug 11

    EP 14. Inside the Verizon DBIR w/ Alex Pinto

    Alex Pinto leads the team behind the Verizon Data Breach Investigations Report—the one publication the entire security industry stops and reads every single year. What almost nobody realizes is that the DBIR, now nineteen years old and built on data from over a hundred contributing partners, is written by exactly four people. In this episode, Alex pulls back the curtain on how the sausage actually gets made: the Verizon marketing team that fought tooth and nail to kill the very first edition, the Secret Service handshake that unlocked everyone else's data, and why the team flatly refuses to tell you which vendor supplied which number. He also walks us through the 2026 findings—vulnerability exploitation finally claiming the top spot after a four-year climb, a CISA KEV remediation rate that somehow went down, and shadow AI rocketing into the top three ways confidential data walks out of your building. Plus, the hunt for objective proof that attackers are using AI, why he thinks all of this will sound like business as usual by next year, and a genuinely excellent argument for why ransomware is the yoga pants of cybersecurity.

See All (21)

Ratings & Reviews

5
out of 5
2 Ratings

About

A cybersecurity podcast. Cyber conversations with more signal, less Noise. Noise2Signal is the antidote to the cybersecurity echo chamber: unfiltered conversations with the people who actually built the field — no buzzword bingo, no vendor pitches.

Information

  • Creator
    Mehul Revankar
  • Years Active
    2026
  • Episodes
    21
  • Rating
    Explicit
  • Copyright
    © 2026 Mehul Revankar
  • Show Website
    Noise2Signal