Noise2Signal

Mehul Revankar
  • 5.0 (2)
  • Business

A cybersecurity podcast. Cyber conversations with more signal, less Noise. Noise2Signal is the antidote to the cybersecurity echo chamber: unfiltered conversations with the people who actually built the field — no buzzword bingo, no vendor pitches.

  1. 4d ago

    Ep. 19 Building A Vulnerability Discovery Harness w/ Dan Jones

    Dan Jones didn't set out to build a vulnerability factory—he set out to hack Cloudflare more effectively. Late last year, sitting on the red team, he and a few colleagues clocked what was coming: They were about to be receive hundreds of thousands of LLM-generated bug reports, and the only sane response was to get there first. They started building six months before Mythos existed, with no best practice to copy and everyone quietly trying a different approach. Then Cloudflare became one of the first enterprises inside Project Glasswing, the classifiers came down, and the harness went to scale. In this episode, Dan tells Mehul the full arc: the 450-line security skill he open sourced, why you tell a model what to do and never what not to do, how a hunting model will happily stand up a fake web server to earn a green check mark, and why his validators never get to see the hunter's exploit code. He also gets specific about the machinery—four models hunting in parallel, mini-Cloudflare’s built on demand, every turn and emission written to a database so nothing is ever lost to a dead SSH session, 21,000 harness emissions boiled down to roughly 7,000 real bugs with over half already fixed—and closes on the uncomfortable half of the problem that most enterprises haven't thought about yet: finding bugs is the easy part. "It's not worth finding the bugs unless you can fix them."

  2. Sep 9

    Ep 18. The CISO before CISO's w/ Scott Crawford

    Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone. 00:00:00 Cold open 00:02:40 Pilot, physicist, analyst 00:06:57 Security before the CISO 00:12:49 Platformization and the data puddles 00:23:25 Confidently incomplete 00:34:19 Offense in the age of AI 00:40:06 The price of poor hygiene 00:44:27 Placing bets, and the token bill 00:47:48 Open weights, and who vets the vetters 00:56:28 Retirement, and the human on the loop

  3. Sep 1

    Ep 17. 0 to 1 on EPSS w/ Jay Jacobs. Chief Data Scientist at Empirical Security

    Jay Jacobs didn't set out to rewrite vulnerability prioritization—he set out to keep working on data he loved. After helping build Verizon's DBIR alongside Wade Baker, the two spun up Cyentia Institute to do the same kind of research without Verizon attached to it. Two of Cyentia's earliest customers happened to be holding opposite halves of the same puzzle: Kenna had scan data and vulnerability sightings across hundreds of companies, and Fortinet had detections of what attackers were actually exploiting. "What if we bring this together?" turned into a side experiment, then a Black Hat paper, then EPSS—and eventually into Empirical Security, where Jay is Chief Data Scientist to give the score a permanent home. In this episode, Jay tells Mehul the full arc: why only two to five percent of vulnerabilities ever get exploited and what broke his "food supply" theory of attacker behavior, why CVSS is really measuring a practitioner's perception of how bad a vector string looks, the delicate conversations at Kenna about giving away a proprietary score, and the naming theory behind making "EPSS" rhyme with the thing it was replacing. He also gets specific about the machinery—why Metasploit is a strong signal and Exploit-DB is a weak one, why nobody hand-assigns weights, where the "23% more accurate" stat in v5 actually comes from—and closes with the gun-to-the-head threshold answer that surprises almost everyone who hears it: not 0.9, but 0.03. In our in-depth discussion, Jay shares: 00:03:19 — Jay Jacobs, Cyentia, and the Side Project That Became EPSS 00:06:53 — The 2–5% Number and What CVSS Actually Measures 00:13:11 — Why EPSS Had to Be Given Away 00:18:01 — Building the Model 00:24:07 — Grading the Model in Public 00:29:45 — EPSS v5 and Where "23% More Accurate" Comes From 00:35:27 — Who Funds It and Who's Using It 00:41:13 — AI-Written Exploits 00:46:37 — The Number for the Frustrated CISO

  4. Aug 25

    Ep 16. The Accidental Entreprenuer w/ Alan Shimel. CEO Techstrong Group

    Alan Shimel didn't plan on becoming cybersecurity media's kingmaker—he planned on being a lawyer. He passed the bar at 23, and the only thing that made him "tech savvy" in a New York law office was knowing WordPerfect better than anyone else in the building. But a home lab, a pair of 386 machines that needed to talk to each other, and a front-row seat to the birth of the web pulled him sideways into hosting, then into StillSecure as a founding executive going head-to-head with the people who would build Qualys and Tenable, and eventually into building the media empire behind DevOps.com, Security Boulevard, and TechStrong TV. In this episode, Alan—founder and CEO of TechStrong Group—tells Mehul the unfiltered version of that path: the $49.95-a-month hosting hustle that grew to 5,000 sites in 18 months, the dinner where Gene Kim first pitched him The Phoenix Project, the FeedBurner sale that accidentally handed him the Security Bloggers Network, and why he thinks the entire "open source vs. closed source AI" fight is really an argument about open weights. He also gets refreshingly blunt about Google's zero-click AI Overviews breaking the deal that funded the open web, and why the future of IT and journalism alike comes down to imagination—the one thing he doesn't think AI has.

  5. Aug 18

    Ep 15. The Don of Security Ratings Mafia w/ Aleksandr Yampolskiy

    Alexander Yampolsky didn't set out to invent a category—he just didn't want to get fired for someone else's mistake. As CISO at Gilt Groupe, he watched a fraud-prevention vendor hand over a gorgeous SOC 2 report and then discovered unencrypted credit card data belonging to other customers sitting in their systems. That moment became SecurityScorecard, the company that now scans every IP address on the planet multiple times a day and quietly underwrites a huge chunk of the cyber insurance market. In this episode, Alex—known around the industry as the Don of the security ratings mafia—walks through the unglamorous version of the origin story: the investors who told him security couldn't be measured, the MongoDB decision that haunted his engineers for eight years, the five hours of a stranger's divorce story it took to buy the .com. He also gets refreshingly blunt about why compliance isn't security, why rating pushback is often legitimate, and what happens to the entire discipline when the time-to-exploit window collapses from two years to seconds.

  6. Aug 11

    EP 14. Inside the Verizon DBIR w/ Alex Pinto

    Alex Pinto leads the team behind the Verizon Data Breach Investigations Report—the one publication the entire security industry stops and reads every single year. What almost nobody realizes is that the DBIR, now nineteen years old and built on data from over a hundred contributing partners, is written by exactly four people. In this episode, Alex pulls back the curtain on how the sausage actually gets made: the Verizon marketing team that fought tooth and nail to kill the very first edition, the Secret Service handshake that unlocked everyone else's data, and why the team flatly refuses to tell you which vendor supplied which number. He also walks us through the 2026 findings—vulnerability exploitation finally claiming the top spot after a four-year climb, a CISA KEV remediation rate that somehow went down, and shadow AI rocketing into the top three ways confidential data walks out of your building. Plus, the hunt for objective proof that attackers are using AI, why he thinks all of this will sound like business as usual by next year, and a genuinely excellent argument for why ransomware is the yoga pants of cybersecurity.

  7. Aug 11

    EP 11. Building Future of AI-Native Cyber Defense w/ Sasan Padidar

    Sasan is a veteran product builder with over 20 years of cybersecurity experience. In this episode, Sasan shares his journey from creating an early container security startup, navigating an acquisition by Tenable, and eventually building CrowdStrike's cloud security module into a $100M ARR business. We explore the early misconceptions surrounding Docker security, the architectural hurdles of moving legacy on-prem software to the cloud, and a harrowing tale of a $100K crypto-mining AWS bill. Sasan also details his recent pivot to the world of AI, explaining why human hype is often worse than AI hallucinations, how AI is fundamentally changing the speed of cyber attacks, and why defenders must rebuild their architectures to survive the next generation of threats.

  8. Aug 5

    EP 13. Vulnerability Research is Not Cooked w/ Thomas Dullien (Halvar Flake)

    Thomas Dullien—better known to the cybersecurity world as the legendary Halvar Flake—didn't just participate in the early cracking scene; he helped define it. As a computing mathematician and the mastermind behind BinDiff, Thomas revolutionized how we understand silent patches and reverse engineering. He eventually sold his pioneering company, Zynamics, to Google, but the journey was anything but smooth. In this episode, we get a no-holds-barred look at his origin story, why building a business around reverse engineering is a massive headache, and the excruciating reality of early tech M&As. Plus, Thomas delivers a sobering, provocative take on how agentic AI and infinite compute are about to rewrite the rules of vulnerability research—and why the human element isn't going anywhere anytime soon.

See All (19)

Ratings & Reviews

5
out of 5
2 Ratings

About

A cybersecurity podcast. Cyber conversations with more signal, less Noise. Noise2Signal is the antidote to the cybersecurity echo chamber: unfiltered conversations with the people who actually built the field — no buzzword bingo, no vendor pitches.

Information

  • Creator
    Mehul Revankar
  • Years Active
    2026
  • Episodes
    19
  • Rating
    Explicit
  • Copyright
    © 2026 Mehul Revankar
  • Show Website
    Noise2Signal