
Security Research Manager. 10 times @BlackHatEvents speaker. Co-Founder @ZenGo acq by @etoro Advisor @ZeroNetworks. x-VP Research Aorato, acq by @Microsoft.
Israel
Joined April 2014
- Tweets17K
- Following2.1K
- Followers11.3K
- Likes14K
Data point from a call with an infosec expert who talks to multiple cyber-insurers: no increase in losses.
So why does IR feel busier?
Noise created by AI, including orgs' own internal AI, not more actual breaches
IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches.
Vs. a year ago (or whatever makes sense), how many more cases are you seeing?
Are you really "turning away work" as @RGB_Lights says?
אני בא!
בואו גם אתם
בואו לפגוש אותנו במתחם שרונה!
לדבר על התוכניות לעתיד המדינה
לדבר על ההייטק
לדבר על מהפכת המשרתים.
שיחה פתוחה על קפה טוב
יום א׳ בבוקר בשרונה עם נבחרת הביצועיסטים של ביחד. רק ביחד, רק בנט 🇮🇱💪
@KerenTernerEyal @Estiayalonkovo @VladimirBeliak
להרשמה: go.be-yahad.org.il/rsvp25102…
Even OpenSSH, the poster child of security-oriented architecture, benefited from this attack-surface hardening
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Small D Energy
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Tal Be'ery retweeted
Yes. What he said. And, if you look close, all very knowable in advance when you're able to distinguish between what's possible vs what's probable.
1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"
TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.
medium.com/@TalBeerySec/why-…













