Name: Threat Briefing: AI Hype vs. Reality in Vulnerability Exploitation
Uploaded: 2026-05-27T15:30:39.969Z
Duration: 1 h 30 min
Description: Threat Briefing: AI Hype vs. Reality in Vulnerability Exploitation

Transcript for "Threat Briefing: AI Hype vs. Reality in Vulnerability Exploitation": Alright. Good morning, good afternoon, and good evening, everybody. Thank you for joining us today, for our webinar, AI hype versus reality vulnerability exploitation. This is actually Recorded Future's second webinar on AI hype versus reality. Our first hype versus reality webinar focused on AI malware. But today, we're gonna focus on AI's vulnerability research and discovery capabilities and AI's impact on the challenges security teams are already facing. The session follows Recorded Future Insect Group's blog titled AI hype versus reality, is AI really rewriting the vulnerability equation? If you haven't had a chance to check out the blog, you can find it in the docs tab. Before we get started, there's a few housekeeping items that I'd like to go over. The first is that, yes, this webinar is being recorded. All registrants will receive this recording via email after the session has ended. If you have any questions for our speakers, please input them into the q and a tab, which you can find on the right hand side of your screen. And lastly, you can also find some additional resources that we will reference throughout the webinar under the docs tab. So let's get some start let's get started with some self introductions. My name is Krista Harkovsky, and I'm a senior manager within Recorded Futures in SIG Group. For today's webinar, I'm gonna be leading a panel style interview, and I'm excited to be joined by three of my colleagues, Megan, Adeline, and Lance. Megan and Adeline will be sharing their in-depth insights into the real risks surrounding automated vulnerability discovery and exploitation. And Lance will provide you with a threat hunting demo within the Recorded Future Intelligence Operations platform while also showcasing how Recorded Future can help with assessing vulnerability risk and prioritization. So let's have each of them introduce themselves. I'm gonna pass it over to Megan first. Hey. Thanks, Krista. My name is Megan Keeling. I am a senior strategic threat intelligence analyst with Recorded Futures Insect Group. And within Insect Group, I'm on the risk insights team, which means I specialize in the business risk of cyber threats as well as emerging technologies. Hi. I'm I'm Adeline Shaikhin. I'm a senior vulnerability analyst and detection engineer, Recorded Future. Kind of my my experience and interests, focus on, exploit analysis, vulnerability research, detection engineering, and vulnerability management. And this this includes, developing proofs of concepts and detection rules for, emerging emerging vulnerabilities. And, I am Lance, Lance and Roger Jones. I'm part of the Recruitus Future presales team. So I'm senior presales. I look after both perspective and existing clients sense of understanding how they can operationalize on the day and service use cases, and how we can effectively use it to address some of those intelligence. Awesome. Thank you, Megan, Evelyn, and Lance. During this panel, we're gonna discuss the capabilities of Mythos preview and similar LLMs. We're also gonna talk about the impacts of AI on vulnerability discovery and weaponization, exploitation trends, and prioritization and remediation. And then we'll wrap up with how security teams should move forward from here. Before we get into the actual panel, I'm gonna launch a poll, which you'll see on your screen. So take a few seconds to respond to the poll, and then we'll move on from there. Alright. So looking at the results here, first, the question was, on a scale of one to five, rank your current level of concern regarding the impact of AI on vulnerability management. And it looks like a few responses are still rolling in, but for the most part, we're sitting at about 50% for very concerned. So a four out of four out of five followed by moderately concerned. We hope that the discussions that we'll be having today will help ease some of those concerns. And if you have any questions, like I said, we'll we'll address them during the q and a. So let's go ahead and get started with the panel. So Megan and Adeline, the first question I have for you to get us started is what exactly is Mythos preview, and and what are its capabilities? Yeah. So so Mythos previews, anthropic cyber, focused, frontier model, released under, project last wing to limit set of organizations. Purpose is to help kind of users scan and secure, first party in open source systems. A lot of the discussion has been around its capabilities, around vulnerability research and multistep, cyber tasks, which which kinda naturally includes, you know, identifying vulnerabilities, reasoning through exploitability, and, validating findings as well. So that that is, Mitho's preview in a nutshell. Awesome. Thanks for running through that for us. My next question for you is kind of a follow-up to that is, is Mythos the only tool out there or the only LVM out there of its kind? Well, it's it's sort of sharpened the debate, kind of around it. But, you know, AI assisted vulnerability discovery, you know, predates METOS. Most frontier models already showed some capabilities, in identifying vulnerabilities and assisting with exploit developments. So it's it's sort of part of a broader shift towards, you know, agentic AI systems for code reasoning, vulnerability discovery, penetration testing, and so on. But, ultimately, you know, it's it's sort of the news hook to, a long standing issue, which is, you know, that these workflows around, penetration testing, vulnerability discovery, becoming faster, cheaper, and and kinda quickly scalable. And just to double down on what Adeline said, well, Mythos came out, initially and grabbed a lot of the headlines by being the first out there with this type of capability. We're really going to be discussing LLMs and particularly Frontier LLMs more broadly throughout our conversation today. As Frontier LLMs improved their general reasoning, they're all going to eventually get better at these vulnerability discovery and exploitation writing capabilities that we're primarily talking about with more cybersecurity focused LLMs. Another difference between Meet Mythos and Daybreak and other kind of more cybersecurity focused LLMs is also in the security parameters that are placed on them. So the developers of Mythos had to remove some security parameters that are in place on normal tools that would prevent people from writing exploits as they don't want people to be using their tools to write malware for malicious purposes. But if you're a security researcher, you have legitimate purposes to be exploring vulnerabilities and to be writing exploits. So the difference in security parameters are pretty key difference between them. However, prompt engineering is a feature, not a bug of a lot of LLMs and persistent actors are going to be able to carry out these tasks, getting around the guardrails on AI preventing them to do that. We essentially see that it's not really just about any one of these tools. These capabilities are going to be more widely available, though with varying degrees of accessibility depending on your persistence in getting around some of the safety barriers. Thank you for the additional context, Megan. And I like what y'all had mentioned around, you know, you know, there's some definitely big headlines out there that is causing causing some panic. But we'll provide some more information as to why, why there might be a little bit of, not discrepancy, but hype as we as we're calling it. So moving on, the next question that I have for our panel is what has changed since the publication of our AI hype versus reality blog post? We talked about is AI really rewriting that vulnerability equation? So I I I can start with that one. So I think since since our, kind of blog post on on the topic, we've seen more evidence that, you know, the core argument is directionally, right. You know, we see Microsoft, Mozilla, and, Palo Alto Networks both kind of provided examples of, you know, AI assisted one bit see discovery, you know, increasing findings, patches kind of creating triage pressure. Let's kinda give few of those examples. Mozilla said that, you know, Firefox the latest Firefox had about fixes for about 271 vulnerabilities that were discovered, during their initial initial, Mythos, preview evaluation. Kind of Palo Alto's, patch Wednesday, I think, went from an average of four or five CDs in a month to about 75 issues that they identified. But, so that's that's sort of, you know, kind of things that happened since. But broadly speaking, you know, and we'll touch on this point a bit later maybe, but, you know, the point is that, you know, AI isn't suddenly making every vulnerability exploitable. The the point is that, you know, both discovery, validation, and, you know, reporting, are are speeding up. So what what that means is, you know, the defenders need to, prioritize better, you know, focus on exposure context, you know, which assets are exposed, which critical assets, and kind of having better patch readiness, systems in place. One interesting thing that we've also seen is we're starting to see vulnerability reporting policies start to shift to manage the impact of AI. This is another sign that it's really not just Mythos or Daybreak, but more of a broader range of Frontier LLMs that are giving researchers and hackers alike the ability to better find and write exploits for vulnerabilities. Recently, GitHub changed its policy due to the really high number of what it described as repetitive AI vulnerability reports that it's been seeing, demonstrating that there are a lot of researchers out there who are trying to use these LLMs to find bugs and report them. This also reinforces a trend that we talked about in the blog where we pointed to the influx of vulnerability reporting that's going to increase the noise of these repetitive low impact vulnerability reports even as the likelihood of also finding a critical vulnerability is also going to go up as these reports increase. So you've both touched a little bit on the actual problem that these LOMs are creating or seeming to create. So I wanna talk a little bit about how we expect things to evolve. So I'm gonna pull up a a bar chart here that we've put together. And and as we start to discuss this together, I wanna ask the question because we've mentioned the vulnerability equation a few times now. But what what actually is the vulnerability equation? What we meant by vulnerability equation is the ratio of reported vulnerabilities to actually exploited vulnerabilities. As you can see on this chart, the blue bars which represent CVEs, common vulnerabilities and exposures, are many, many orders of magnitude below the yellow and red, which as you could probably barely see, those are actually exploited vulnerabilities. We don't expect this ratio to really change all that much for a number of reasons, That's because there is a lot of vulnerabilities that are out there, but not all of them are going to be weaponizable, so able to be able to write an exploit, to be able to use that vulnerability. Even if you do have an exploit, it's not going to be useful in a cyber attack. We still expect to see a pretty big gap between reported volumes and actually exploited volumes. The other thing I'd like to point out is that the number of reported CVEs has been going up for the last at least five years, possibly even ten years. This is likely due to a number of factors, but one accelerant is the broader acceptance of bug bounty programs and vulnerability disclosure policies that a lot of technology companies opened up. These encourage external researchers to hunt and report for bugs, not only by providing parameters by which they could report bugs without being sued, but also that they could actually be rewarded in some cases, very high sums of money for reporting an actually exploitable bug. Because of this, you started to see a huge accelerant of vulnerability reports. There are a lot of similarities between the advent of the bug bounty era and the emergence of these bug finding vulnerability discovery LLMs that are coming out and that they are going to be necessarily causing a huge influx of vulnerability reporting, but not all of that reporting is going to be high value exploitable events. However, I should point out that the impact of LLMs is likely going to be on a much bigger scale. So whatever impact we saw from bug bounty programs likely to, be a bit bigger as well with the, spread of l l these LLMs. Thank you, Megan. You talked a little bit about exploitation. And so I I wanted to actually ask you, Adeline. Can you discuss or or walk us through the different stages of vulnerability discovery versus weaponization and exploitation? Yeah. So I I I think it's it's it's worth pointing out kind of from the start that, you know, discovery is only the start of the process. Right? You know, any vulnerability still has to be, validated, has to be made reliable, matched to a target environment, a victim, you know, integrated into attackers' full path, their entire exploit chain. And and and, you know, models like Mythos can can accelerate parts of that process. Right? So things around code reasoning, generating POCs, analyzing exploit paths, and and things and and kind of repeating that across, different, different targets. But the full on kind of end to end exploit, chain still requires, you know, kind of information about targeting infrastructure, evasion, resistance, and and and ultimately a return on investment for, for the attacker. Right? So as as as Megan mentioned earlier, not all vulnerabilities will be exploited because there there just isn't as much value in exploiting many vulnerabilities for from attacker's perspective. There's no kind of, you know, data that can be obtained or or, you know, access to, to systems that can be, provide financial value or or or, kind of, anything else. So that that that's why kind of the the the overall equation, still, you know, highlights why, discovery doesn't automatically finding more flaws doesn't automatically translate into, you know, a proportional, increase in, in exploitation. So yeah. You mentioned acceleration, and that's one thing that I know a lot of us are hearing right now and that these LLMs are are making things faster, whether that's the discovery stage, the weaponization stage, exploitation stage, etcetera. So what are the impacts of these LLMs on time to exploit and time to remediate? I can I can take that one again? So, you know, the from a time to exploit perspective, you know, they they they can compress the amount of time it takes, and they have over time. We've seen kinda compared to, you know, in the last five, six years, you know, drastic increase in speed of, exploitation from, the moment of vulnerability has been disclosed. But again, it comes down to the subset of vulnerabilities that attackers decide are worth pursuing. What ADLMs can do is, you know, I mentioned earlier, help with vulnerability research, POC development, debugging, and so on. And, you know, we've we've also seen Microsoft, you know, say that tractors are already, yeah, using AI across parts of the, attack workflow. But, you know, the quantifying the exact effect on ex on exploitation timelines is is is a bit tricky. But, you know, the the broader, broader trend is clear. Right? The the time to remediate has to increase. You know, defenders already have not enough time to understand, you know, how to, you know, adequately and and quickly, patch things. So, you know, the the time to respond is is is gonna continue shrinking, and and it that is something we've seen pre mythos and pre LLMs as well, that that shrinking time to, time to response to, vulnerabilities. Yeah. And we'll we'll talk about prioritization more in-depth, but I do wanna ask a question, a little upfront here. We talk you you had mentioned, Adeline, that remediation is gonna have to be a little bit quicker. And you even said it yourself. There's already so many things that security teams and defenders are worried about. So how do the LLMs, impact patch prioritization? they they make prioritization more difficult because the the the volume, of credible findings, increases and and and that, you know, the time to evaluate these findings, decrease at the same time. Even the National Vulnerability Database has struggles with, you know, kind of maintaining an up to date record in a timely, in a timely manner. I think what what will also kind of need to be reevaluated with time from a patch perspective is, you know, medium severity and or or kind of vulnerabilities that are deemed noncritical may, you know, need to be reevaluated because they can become part of an exploit chain that's that's, that's more impactful. So, ultimately, it comes it it comes back to, you know, a very common problem, and and and that's moving away from, CVSS scoring and and and looking at vulnerabilities as critical high, medium, so on. And, you know, now more than ever, you know, it's important to consider things like exploitability, right, the asset exposure, you know, the actual impact, right, that lead to kind of code execution, privilege escalation, things like that, you know, the reachability of of of, of an exploit chain, and and whether kind of ultimately, you know, the the whether it has already been weaponized in the past. And, you know, our our sales and the incident group, we we we we kind of try to address the, actively exploited vulnerabilities and and create new care templates, detection rules, to detect them, as, as swiftly as possible. So that's, that's one way where we can sort of, support in helping prioritize based on, based on real world risk and and and kind of, in a threat led and kind of risk based way, as opposed to just relying on on CVSS scoring. Yeah. This is another area of comparison to, bug bounty programs and as companies had started implementing vulnerability disclosure policies. As you are opening up your, your organization to vulnerability disclosure, you need a way to sift through some of all of the submissions to figure out, what's really valuable both, you know, from a monetary payout perspective but also what needs to be urgently patched. And this is exactly the same for this new era of LLM vulnerability discovery. There's going to be a lot of submissions that come in that are not really exploitable or are unlikely to have a major impact even if they are exploited. But as Adeline said, that process of needing to figure that out is going to be moving a lot faster due to the speed at which, LLMs work. So being able to have a, automated rapid prioritization process is going to be very critical. And you touched on this very briefly, Megan. But I think a question that's at the top of everyone's mind is, should we expect more of these high impact vulnerability events? I'm thinking things like Log four j or SharePoint or or Clio. What are your thoughts on that? Yes. I think if we kind of look at that ratio between reported CVEs and the number of actually exploited vulnerabilities, it stands to reason that if the number of reported CVEs doubles, the number of exploited vulnerabilities is probably going to double too. So this is still going to be a significant fraction of actually reported vulnerabilities. And of those actually exploited vulnerabilities, the number of ones that are kind of truly automatable, Internet breaking, really high impact events are still going to be relatively rare, but may by numerical, process happen more often. And What that means is that this is going to put a strain on resources that even if you are dealing with maybe two high impact events per year instead of one, it's still going to take demands on your security teams. What becomes important is being able to increase resilience to exploits overall. How do you structure your not just vulnerability and patch mitigation program, but your broader cybersecurity and network security program to be able to withstand vulnerabilities that are exploited? How do you make yourself, less impacted by a potential exploit? And there's a number of ways that you can do this to make actually impacting a vulnerability have less of an impact on your organization. We'll discuss those more in the next section. Awesome. Thank you, Megan. Let's talk a little bit about trends. So we're talking a little bit here about exploitation trends, and you had mentioned the ratio of vulnerability exploits. Let's let's dig into that a little bit more. So looking at the ratio of vulnerability exploits for open versus closed software, does AI's presence at the discovery and exploit stages mean we will see more vulnerabilities in open source software being exploited? So I think we we we can look at this in two ways. So what what what has already happened and what's likely, to, to change. And and and I think, you know, a lot of the discussion has been around, how easy it's become to just point, point penetration testing tools and and and Frontier models. And I have firsthand experience of of, of this and how, you know, easy it is to discover flaws in open source software that's, has its entire, you know, repository, entire code, on GitHub. So, you know, we're not sure we're necessarily seeing more open source software being exploited yet. And, the reason there's a lot of discussion around, you know, open source versus commercial software is is because the curious you know, evidence we've had of, the effectiveness of, you know, models by by, Atropic or OpenAI is is in environments where, you know, where the models can reason directly over the code, once it's provided a code base. And that's and that's a bit different from, you know, compiled binaries and closed source software where, you know, there's less clear evidence of AI vulnerability discovery at the same level. And, you know, as as the chart kinda shows for the past, you know, a couple years, you know, commercial exploits, or rather exploits for closed source software still outweigh, open source exploits. You know, that rate ratio has been relatively consistent, but but even if we look at, you know, q one twenty twenty six, that's, that had the highest, sort of number of open source software being exploited. That changes in as from from q four, of last year isn't, you know, out of the norm. But what what we can say is is that that that that will probably increase, you know, once we have a longer time frame, to look at. So, you know, in a nutshell, you know, that that that ratio will probably increase as these as these tools get better and and kinda more capable and, and and cheaper as well. We're talking about increases. What about public proof of concepts? Do you expect those will increase in volume as well? The the number of POCs will probably increase and and, you know, just because these models are lowering the cost of of of drafts drafting, testing, iterating, exploit code, and we're already seeing more POCs that that explicitly state that they were created with with AI, assistance, and and that's becoming more common. But, you know, kind of for mentioned earlier, but, you know, biggest concern is not just more POCs, but, you know, how impact impactful are they and and, you know, how fastly can be how fast can they be, iterated and and and scaled and and, you know, adapted by by more capable users. Because, you know, ultimately, you know, a lot of these models will have safeguards in place around, malicious use, as it is. So it's, you know, wouldn't be a case of just kind of every everybody with a computer and access to unlimited you know, being able to compromise every large organization in the world. So that that I think we can, we can sort of rule out in the short term. It's a good transition into my next question around access. In your opinion, either either you, Megan, or or Adeline, do you suspect that the barrier to entry for vulnerability exploit development and the execution of those exploits will be lowered if it hasn't already been already? Yeah. And I I think there's some good evidence that the barrier is already being lowered, but it's being lowered unevenly. So certain parts of the vulnerability exploit workflow are definitely getting much, much easier with these LLMs, not just Mythos, but as we've talked about with other LLMs with these code reasoning capabilities. Understanding the code, identifying suspicious path, generating proofs of concept are all getting easier with LLMs. But end to end exploitation still requires, operational knowledge and even knowing where to use LLMs and how, is in itself something that you need to require a lot of skill and practice to do. So the near term effect of these tools is really less that, again, as to paraphrase Adlon, that anybody with a computer is going to be able to carry out these high impact exploits. But really, it's going to be you're seeing the more capable actors, so actors who already are pretty good at this moving faster. And there may be some improvements for the mid tier actors to improve their capabilities. But it'll still be difficult if you're coming here completely cold on any kind of vulnerability or exploitation skills to be able to develop high impact exploits. And there are two major limitations for, particularly lower skilled or less resourced actors from really using these capabilities extensively. The first is maybe the easiest for them to overcome. Again, there are security parameters on a lot of these tools that are trying that are there to prevent, actors from abusing these. As I mentioned before, prompt engineering is an effective tool that threat actors will be able to use to get around some of these safety guardrails, and we've seen evidence of that in some reports of how cyber threat actors have abused LLMs in order to carry out attacks. So this is, not trivial to get around them, but it is a different skill set of sorts to be able to manipulate an LLM into, going against its safety parameters. But the second limitation is actually a bit more structural. Vulnerability research and LLM use in general is not free. These high quality workflows take up significant compute, which costs money. And this matters for attacker return on investment. Even now, we're starting to see some limitations on using LLMs for high impact or high compute coding projects, and we should not assume that every actor is going to be able to run these frontier scale vulnerability discoveries against every target indefinitely. I think it remains to be seen right now whether compute costs are going to fall over time or whether access will actually become more restricted as you know, AI companies are seeking to make a profit on use of their tools. But regardless, it is still a limited resource. No. Definitely good good limitations to keep in mind, and to help help reduce that that panic a bit. Thank you for adding that context, Megan. The next question that I have for you both is, what are LLMs actually good at, and what are they less good at? How does that impact the overall risk when we're here talking about vulnerability exploitation? So so I think it it's interesting that this debate kinda started now with whereas, you know, in my opinion, you know, there were always better designed for security tasks than than for writing code, at least in the beginning, just because, you know, by design, they're very good at pattern matching across, code bases. You know, they're good at, explaining unfamiliar, things in code bases, you know, creating hypotheses, hypotheses, finding bug classes, and, and things like that. So, as well as, you know, you know, provide creating the proof of concept, you know, ways that these flaws can be can be exploited. So, you know, but like like I said earlier, you know, there's there's less evidence that they're as effective at finding flaws and compiled binaries or doing deep binary reverse engineering. But but certainly, you know, the risk is more immediate for, open source source available code, than for proprietary, kind of software. Not not to say that they can't be used, together with penetration testing tools, and and and we can see we've seen a lot of that. These models being combined with, MCPs for, traditional reverse engineering sorry, rather, penetration testing tools, to, you know, to discover vulnerabilities in in in such software. But, yeah, kind of the evidence right now is is is that the media's risk is for, source code. But, well, I kind of alluded to it earlier, but, you know, what what this also means is, you know, lower risk vulnerabilities or those that redeemed lower risk may become higher risk if, if an LMS is kind of used to find novel ways to chain them together. And I think that's an area that's sort of not been discussed, enough is, you know, how it can be used to take vulnerability a and vulnerability b and chain them for more impactful, kind of, effects, for organizations. Yeah. That's a good point. So do these LLMs introduce novel risk at all, or do they impact existing vulnerability management practices in a way that we previously haven't considered? So I think the biggest impact is that these tools are intensifying existing problems instead of creating entirely new ones. This goes back to the comparison that I've been making to bug bounties and VDPs. This is not the first time that we've seen an influx of vulnerability reporting. It just might be a different magnitude or a different scale than what we've experienced in the past. But vulnerability teams currently struggle with noisy disclosure volumes, patch prioritization, slow remediation, and legacy exposure. And what these AI tools are doing is increasing the speed and scale of these problems. So it's important that re that organizations improve their overall resilience as I've mentioned earlier. So how do you improve, your organization's ability to not be impacted by a vulnerability exploit, whether it's by limiting your external facing attack surface to prevent kind of opportunistic vulnerability exploitation, whether it's, ensuring network segmentation or limiting the exposure of data or other valuable assets to, devices that are maybe more vulnerable. There's a number of different, organization specific prioritization or methods that companies can do in order to limit their exposure to an exploit. Again, from the defender's perspective, it doesn't really matter whether the vulnerability is discovered by Mythos, by some other model, or from a human researcher. What's important is that is that vulnerability going to impact something in your environment. This is good because as I mentioned earlier, we are gonna talk about what we should do next. So to kind of move us along here, to recap, we talked through LLM capabilities. We talked about the impact of AI on vulnerability discovery and exploitation trends. So to start wrapping up the interview segment of the webinar, I wanna focus on next steps. So my first question for you is, how should security teams reassess prioritization given what we've talked about so far? Right. So as I I mentioned a bit earlier, it's important to go beyond some of the more external intelligence about a vulnerability, such as kind of its state of exploitation, whether or not a, exploit is available for it, can it be automated? Those are all critical parts of the question. But you also really want to put in that internal intelligence as well. Having a really solid understanding of what your assets are, what your technology stack looks like, what your third party tools and capabilities are so that you really understand what might happen in the event of an, when a new exploit comes out and you're able to do that analysis at machine speed. So being able to bring in that internal technical and operational impact is going to be essential for prioritization going forward to know, is this a patch immediately? Is this a patch eventually? How do we mitigate that risk in this potential age where we're going to see, a lot of different reports of vulnerabilities of varying impact? Yeah. So we're talking about varying impact and we're talking about, you know, how to decide what to prioritize over what what can maybe, you know, wait a little longer. But talking to our attendees, if they could only prioritize one action, what should it be? Well, the pan patching is kind of the key one. Right? Kind of accelerating, patching cycles. You know, not every patch can be deployed immediately, and and there's kind of constraints for organizations to, you know, operational downtime and things like that. But beyond patching, you know, kind of having things in place for, come having compensating controls in place for high impact vulnerabilities. Right? So kinda Megan mentioned earlier, segmentation, access restrictions, firewall rules, traffic filtering, disabling vulnerable features that aren't used, you know, and and things like that. So, kind of having a plan b in place when when, you know, patching immediately isn't, isn't possible. Beyond that, you know, kind of, you know, reducing reliance on on on on legacy systems, and, you know, adopting a kind of more threat led, prioritization approach. I know that's not one, action, but but sadly, there, there isn't, you know, one fix for for all of it. Yeah. Exactly. It really is a a comprehensive look not just at your vulnerability program, but also your broader set of security controls and practices. One area that I'd really stress is third party vulnerability management. So understanding the third party software that you're using and how vulnerabilities to those softwares impacts your organization. So what data might be exposed, what processes might be impacted by an exploit, and what can you do to increase your resilience to an event in that at that third party. We talked a lot about the risk of AI and AI doing not so great things and sounding the alarms. We're talking about primarily AI's use and, again, vulnerability discovery and exploitation. But behind AI is a human. Right? So how can we make AI work for us? So I think organizations can use AI defensively to, yeah, accelerate the same workflows that that attackers, could accelerate. Right? So from a both from a discovery perspective, but also triaging validation, detection engineering, patch planning, threat hunting, but at the same time keeping humans, you know, in the loop for high impact systems and and, automated remediation. Ultimately, the goal, you know, isn't to automate blindly and and and, and and patch everything possible. It's sort of reduce the, time to understand and and and time to mitigate in the best possible way. So, yeah, that's, that's saying. Not sure. Yeah. I think, if threat actors can do it, we can do it too. The same vulnerability discovery, the same exploit development that we could use to better understand how this might be exploited and what we can do to patch against it, all of that are ways that we can make AI work for us as well. But I do want to put a cautionary asterisk on this, that AI itself comes with its own security risk. And it's really important that as you're starting to implement AI solutions, especially agentic AI solutions where you're having it operate, more or. less independently, you wanna really understand the vulnerabilities that AI introduces. So having good documentation and logging practices will help increase traceability for what the AI is doing and making sure that you are, accounting for all of the actions that it's taking as well as the criticality of having a human in the loop to ensure accountability for these AI agents. And those are two really big, steps that you can do to mitigate some of the risks of introducing AI agents and AI capabilities for vulnerability management. Awesome. Thank you, Evelyn and and Megan. Solid advice for sure. And that's all the questions that I have for you as of right now. I'm sure our attendees will have some questions for you as well during our q and a session, which speaking of, if you have any questions for for Adeline or Megan or or Lance, please input them into the q and a tab on the right hand side of your screen. Next, I'm gonna be passing it over to Lance for our demo, where he will walk you through how to use the Recorded Future Intelligence Operations platform to for threat hunting, excuse me, as well as how to assess vulnerability risk and approach prioritization. So while I pass the mic over to Lance and as he gets ready for the demo, you're gonna see another poll on your screen. This is our last poll for today's webinar, and this time, it's regarding vulnerability management. So we're gonna give everyone a few seconds to answer this poll. I think a lot of what we've been seeing with some of the discourse around this is it's really kind of accelerating organizations to, take action to be able to prepare for this, kind of new set of capabilities that both researchers and threat actors are going to have. Again, it's not, I would say, maybe not as apocalyptic as some of the headlines may have suggested, but it's certainly introducing a new set of risks and accelerating some old risks that we are already pretty familiar with. So it's good to see that we've got a pretty, good split of in of organizations kind of plan either planning to make changes or in the process of. making changes. Alright. Well, thank you again, Adeline and Megan. We're gonna pass the mic over to Lance here to start the demo. Perfect. Thank you very much, Krista, Adeline, and Megan for that insight. I think what we'll now take a look at is how, in essence, Recorded Future helps, address some of this some of these challenges that were outlined by the panel. So I'm gonna delve into the Recorded Future platform, and what I'm gonna do is I'm gonna show you a couple of different use cases. One is very much around the vulnerability prioritization, which we which we've discussed, and then we'll focus a little bit on threat hunting. So a more proactive way of looking at, prospective threats against the organization. But I think to start off, really, just a very quick preamble about the Recorded Future platform. We are an intelligence organization. We're an intelligence platform, and we're designed to do a number of things. First, provide context, and provide, relevance, to the nature of a threat that's, potentially impacting the organization. And that helps in areas such as prioritization of events, especially when it comes to vulnerabilities, because we are contextualizing the threat behind that vulnerability, but also enables us to kind of proactively look at where prospective threats are coming from. So those are the things that we're gonna touch upon here. So as you see my my, platform here, you'll see that, within the Recorded Future platform, I have a number of dashboards. The one area we're gonna start focusing on is very much around vulnerability. But before I sort of take you into the dashboards, one of the key elements of not just our intelligence, but any intelligence is being able to make it, operational. Right? So it's used by other tools. So within recorded feature, we have this integration center that enables us to create connections to other tools. Now when it comes to the vulnerability use case, as you hear by the panel, one of the biggest challenges we have is the volume of of, scans and the volume of, vulnerabilities that are coming from, the scans that we're running in our organization. Some of the things that we are doing here is we are connecting to a number of vulnerability management scanners. So in my case, I've got a Qualys vulnerability management connector. You can connect to Tenable or you can connect to others. These are just some of the connectors we have. We're also ingesting CVs from, Defender as well. And what that does is within the platform, it'll populate a, watch list. Right? So our watch list here are designed to give any organization an idea of where the potential threat might come from by filling up these lists of assets. So as I scroll down here, you'll see vulnerability is one of those, watch lists. And you'll see here, in my case, auto automation is turned off, but that can be turned on at any time. And within that, you'll see the list of vulnerabilities here that I'm currently ingesting from my scanned tools. So that data is ingested. We also look at the tech stack. So that tech stack can be populated, statically, right, by uploading a list, or it can be uploaded dynamically. So we'll cover those as well. So when I go to my dashboard here, you'll be able to see, a list of all my monitored vulnerabilities. This is where we build that prioritization list. Right? So this is taking data from that tech stack watch list, which is effectively technologies, right, such as Microsoft or tech stack like Cisco or other AI or AI technologies you might be using. I mean, it injects that data, and, it also correlates at the vulnerability watch list, and it pulls the weaponization cycle of that vulnerability. And that helps us from a prioritization perspective because it helps us to look at which of these are exploited. So out of my list of vulnerabilities that I've seen here, maybe I have, you know, 500, 600 vulnerabilities coming through from my scans. It's a 66 that I need to prioritize first because these have an exploited, they have been exploited in the wild in effect. So those are the ones that I'm gonna prioritize. So that addresses the the challenge of going for these first before you move down that scale to look at the other vulnerabilities. So that's one area. The other area that we will look at, and I'll share a different screen here, is being more proactive. And the way we can do this is by understanding what my assets for all in this organization is, effectively, my attack surface. Right? So the scans will look at known assets, scan those assets, and provide us with a list of vulnerabilities against them. But then it doesn't help when it comes to things like understanding signatures of the assets they have and the technologies that they're using. So understanding what my assets sprawl looks like. And this is what we're looking at within attack surface. It's getting a list of recently found assets based on my criteria as an organization and then understanding the top exposures against that when a scan is conducted against those discovered assets. And one of the things that we can do here is is look at the type of exposures that we are getting within the background of that. And within our exposure rules, we will update, as you can see here, signatures. These signatures are constantly updated, some of it through, AgenTek AI. Right? So we're using AgenTek AI as well to update these within thirty minutes of a a new signature being, discovered, And we'll add that into the system so that we can look at the CVE, understand the context behind the kind of ex exploit that's available, to an attacker. And we'll correlate that across other references, not just recorded future, but NVD, GitHub, and others, in some cases, even the vendor themselves. So that gives us a little more proactive view of that information. And you'll see above then, you then take that data and you can start to auto populate things like domain watch list, IP watch list. So that gives us a list of, if you like, of assets that then I can start to populate across my other watch list, which will help with some of the threat hunting, which we'll talk about in a minute. So those are some of the the the sort of main, key areas. Now I'll use an example of, the, nuclei template that was, discovered through through our own, research in sync group just to show you how a particular CVE here if if I hover over it, you see there that's exploited in the wild by malware. How a particular CVE can what context can build around that. So I'm gonna stop sharing this and just pivot back to my other screen. So let's take this CVE here for instance. That's at the vulnerability disclosure life cycle phase. So you'll see when we go into the CVE, we'll start to get a bit more information around it. We'll get some CVSS vector data. You'll get a CVSS score. We hear it through this conversation that, you know, CVSS is not, you know, the only, can own cannot cannot be the only method that we rely on to determine risk. And then below, you'll see there's a recent references. That's from our own insect group that have validated this TTP using nuclei to detect it. Now you'll get this information, but the way we assess a risk is through a list of risk rules that we run that data against. So currently, we have two major risks associated with it. One is through NVD. One is through our own reference, right, for our own, analysis we have done. So you'll see that, was what I was mentioning in the previous page. Alright? The AI will give us a summary as well. So we do use AI to provide summaries on the data. We're not a generative AI tool in any way, but we are giving helping with summaries of data. And we have used machine learning in the background to be able to pull this information together for the best part of fifteen years. So that's kind of more the, proactive side. There is more information here you can look at, you know, how it will feed into alerts. The affected products. Right? So this is linked with, Moveri. Right? So that is the the product, impacted with this vulnerability, but you can get a lot more data, in the background. So that's, a summary really of how we can look at prioritization then, you know, sprinkle out with a bit more of context, in the background. Now one of the things that we can do is look at the the more proactive side, and this is looking at how we prioritize threats going forward. So we've looked at kind of like the reactive. Right? So this is what our scans are telling us, what our enumeration is telling us. But now let's take a look at how can we, you know, proactively look at, threats coming, further down the line. Now one thing we do within the platform is look at threat prioritization. And the way we look at this is based on those watch list I showed you, we look at an estimated intent of a threat actors versus an opportunity scale. Now if I just focus here on, let's say, my high severity threat actors just to make that a bit smaller a number, These are the guys who have shown the best the highest, let's say, capability. That may be because they are nation state threat actors and maybe because they have, shown significant capability very recently. So that is the, this is my list. And what I wanna do from this is go ahead and create the threat hunt. Right? So if I go in the background, create a threat hunt, I can pull it, I can start pulling against all my threat actors, or I can, slightly limit this to my watch list. And as we were talking in vulnerabilities, I might just say, well, show me the ones that are linked with my tech stack watch list or my vulnerability watch list. So it's looking at those, as those at those three now. Right? So we look at those and we go and create a threat hunt, against those. So what it'll do now, it'll go and look at the different, risks, so the threat based severity. You can pull in both indicators and detection rules, and we'll take that data, from, within within the background. So things like detection rules here, you'll take a signal rule, and we'll look at translating that into different other detection rules that you can use across your estate. Going back to my, integrations, which I showed you earlier. So if I go back here to if I discard that and show you, what I was on my previous page, you can sort of see sorry. Wrong page. You can sort of see here security architecture, how my integrations are lining up together. Right? So on the one side, we've got, Qualys and we've got well, I was having a ability scanner by ingesting data, but then we are sending data out to things like Sentinel, but also Defender to start to get an understanding of what's being hit in our environment. Okay? So now we can go back to our threat operations, and we can start to see some of that some of those, hunts that we have conducted and how what results are they returning. So one of those here has returned a 160 hits across my estate. And out of those, you know, we are looking at one with a very high IOC detection match. And if I look at the details, it'll give me details on the connection itself. Now one of the things we can do as well as it's loading my details, we can then run a, if you like, a report against that. Alright? And now reports here will give us something that we can share with, management. So we can do AI generated reports like this, which, you know, give us a context of what was discovered, an executive summary of the hunt objectives, what detailed threats did I look for, and any malicious indicators. Naturally, you don't wanna see those red dots appearing, so I'm using an example of something that has hit a lot of events. But that's just an example of how you can then use the threat hunt, to effectively, you know, provide information further downstream to to the SOC. So, and that can act completely independently, completely autonomously. So, effectively, you are doing that as alongside your other, security tooling that you are running. So that's that's it for my segment. I will hand back over to Christa. Awesome. Thank you so much, Lance, for the demo. We will now move into our final segment, the q and a. Looking through everyone's questions here, there are definitely some good ones. We won't be able to get to all of them, unfortunately, but we hope that we're able to provide some some helpful information here. So let's get started. The first question I have for our panel from our attendees is, do you think we really need a global AI capability government governance? Excuse me. Right. So I can take that one, Krista. So I think we will probably be moving in that direction possibly eventually. I don't want to opine too much on the politics there. But really whatever system we have in place, whether it is a international accord or whether it is domestically, is going to be helpful, but there's really never going to be a perfect system. AI safety is always going to be improving, but it's never going to be perfect. Prompt engineering, as I've mentioned, is a bit like finding bugs in code. It's something that is likely always going to be a feature of some of these tools and threat actors are going to try to take advantage of it. We also want to look at some of the different actors who are using these tools as well. Obviously, Mythos and Daybreak are intended for researchers, codevelopers, and can have a really big impact on even how many bugs make it out into production, even make it out into the wild for people to discover. So that would be a really good impact. But there are also other really well resourced threat actors who are working, notably state sponsored threat actors, who are working on developing these capabilities for themselves. At the same time, less resource actors or less skilled actors are going to be trying to seek access by other means, whether it's jailbroken LLMs made available on criminal marketplaces or simply abusing these frontier models. So it's always going to be, similar with any cybersecurity question, a bit of a cat and mouse game in terms of trying to make systems more resilient against this type of abuse, but still seeing that threat actors are going to persistently attempt to abuse it. Awesome. Thank you, Megan. The next question I have from our attendees is, is vulnerability management still relevant, or should we make a more sorry. Should we make a move towards something like threat intelligence, led or c Sysak Dev led, exposure management? So I I I can take that one. So I think vulnerability management is still absolutely relevant. But as I alluded to earlier, it can't remain a CVSS based patch everything, equally, approach. The direction of, you know, travel, in general is towards threat led risk based exposure management, you know, vulnerability data enriched with evidence of exploitation, attacker interest, asset exposure, business criticality, which still, you know, is is is quite important in the vulnerability management, life cycle, compensating controls, and so on. So I I wouldn't look at it as, vulnerability management versus Kev versus threat intel. You know, the the the right kind of mature way, I think, is to combine all of these things. Right? You know, using vulnerability management, maintain kind of asset inventories, identifying affected systems, tracking remediation, and and at the same time, kind of threat intelligence and and and and various exploitation signals to understand which vulnerabilities attackers are actually exploiting or likely, to exploit. And, yeah, kind of, how how will this ties into the most critical assets, in in an organization's, environment. And the last lastly, again, it comes down to, having that risk based prioritization to decide, you know, what must be patched now, what can be mitigated, what can be saved later, and so on. So, in in short, the answer is kind of, I think, both things should be combined together. Yeah. And I'm actually gonna use that to go into our last question for today's webinar. You talked about looking at at vulnerability risk, being risk led, looking at the vulnerabilities that threat actors are actually exploiting. We have a question here. As vulnerability exploitation increasingly becomes automated, what indicators or intelligence artifacts would confirm that threat actors are genuinely leveraging AI in the vulnerability discovery and exploitation life cycle rather than relying on traditional scripting and automation techniques. I I I can take that one as well. I think the answer is that it's it's tricky, to find these indicators because there there are some examples of, you know, exploit artifacts like, you know, educational docstrings in the code, CDSS scores being hallucinated, you know, textbook, Python structure in in some of these, some of these exploits. But that's kind of, you know, more of an inference rather than, you know, strong, strong evidence of of, AI being used to to to develop these exploits. But I think from from a defender's perspective, you know, the whether something was written with the help of AI is interesting academically, and useful kind of for threat intelligence, but it shouldn't be the primary, operational question. And whether, you know, an exploit was AI generated or human written, you know, the practical, problem remains and, you know, it's, you know, are we exposed? Is there any exploitation? How reliable is the exploit? How quickly do we need to patch, mitigate, or or threat hunt? So, yeah, it's, ultimately, you know, we we we produce, you know, it's a group produced analysis around exploits, you know, consistently, on the latest proof of concept exploits being developed for CVEs. And we look at those things, you know, whether, whether we're seeing kind of, you know, indicators that could point to AI assisted, AI assisted, you know, POC, generation. So, yeah, our we we we kind of a lot of our analysis does does does look at those things. I think one thing we'll be looking at particularly from insect groups perspective is changes in overall patterns. So are we seeing higher volumes of proof of concept as a whole across the ecosystem? Are we seeing changes in the types of technologies that might be exploited? All of those, again, it's not going to be a smoking gun specific indicator that tells us it's AI generated, but rather this will be conferring that if we are seeing major shifts in patterns alongside the release of certain capabilities, it may be an indicator that threat actors are using these tools to maybe scale up or otherwise change their activity. So, inferred behavior from maybe a more macro perspective than I think a lot of organizations would be looking at for their own internal purposes. Great. Thank you both, Adeline and Megan, for for your responses there. I do believe, unfortunately, that that is all the time we have for the q and a. I do know that there are some additional questions in the q and a tab, and a few of them have been answered directly there. So definitely, check out the answers in that thread. But for now, we'll start wrapping up. I wanna start by saying thank you so much to Adeline, Megan, and Lance for your time today, for walking through not only the interview questions, but also going through the demo, talking through, you know, is this is this really all hype? Is it real is it our new reality? And talking through remediation and prioritization and leaving our attendees with some, with some advice and some recommendations moving forward. Also, thank you to the attendees. Thank you for spending an hour with us today and listening to us go through the vulnerability equation and talking through, again, this hype versus reality and the how LLMs are affecting the vulnerability landscape. To wrap up, the last thing that I will share with you is that if you are looking for more information on vulnerability trends, exploitation activity, or recommendations for remediation and prioritization, If you're an existing customer, the good news is that you can read in sick group CVE monthly, which can be found within the Recorded Future Intelligence Operations platform by either searching the title CVE monthly in the search bar or via the news and research tab. If you are not an existing customer, you can find a public version of this report on Recorded Future's website by searching for CVE landscape. And lastly, keep an eye out for our other upcoming webinars, which will be shared in the chat with you here. Again, thank you everybody for your time today, and we hope you enjoy the rest of your day. Goodbye. Thank you.