Six months after AI started hunting bugs at scale, vRon keeps score: Microsoft’s patch count is up ~4x, Chrome’s security fixes 15x. Companies still take a median 43 days to fix the critical ones. The AI can find the bug. It can’t make you reboot.
youtu.be/ZJwS35qo0QM
In March, an anonymous site rated 649 RSA Conference exhibitors and called 62% of them "cooked": replaceable by a weekend of vibe coding, or just a GPT wrapper. Six months later, vRon checked on the patients. The ten cooked stocks are up 73% on average, against 19% for the S&P 500. Four of them doubled. One cooked startup bought another for a billion dollars. Code got cheaper. Customers, data, FedRAMP and the analyst who picks up at 3 a.m. did not.
youtu.be/oarJlRJ0C5U
I lot of what Jason Haddix said in his X post about "Cyber being Cooked" resonated with me. The more things change, the more they stay the same. I had vRon do a video on AI's impact to the cyber profession centered around the main points of his "post-DEFCON op-ed". Also did a slight plug for our Cyber Ready Clinic.
Fun video on latest cyber 'letters of marque' bills in congress. Watch the full video at: youtu.be/8xuGrdLJH7c
Pope Leo XIV's Magnifica Humanitas (May 15) is the Catholic Church's first formal doctrine on artificial intelligence. It addresses, by name, the engineers, founders, and regulators building these systems today. vRon breaks it down:
youtu.be/9dgbs7AoCtc
In 2006, an Italian filmmaker quietly made the best cybersecurity movie nobody watched — and predicted the NSA surveillance debate 7 years before Snowden. New vRon: why The Listening still holds up.
youtu.be/OFC_9RtHApY
There Is No Security Meter For AI. That's the title of the new Berryville Institute of Machine Learning paper from Gary McGraw, Harold Figueroa, Katie McMahon, and Richie Bonett. The argument: every "AI security score" you've been shown is theater. In 12 minutes vRon walks the badness-ometer, the Strange Loop, the WHAT pile, and where whitebox interpretability fits.
youtu.be/6hpvMzxNyCM 📄
#AISecurity #MLsec #BIML
I had my AI comedian debate my AI Mentat from Dune about the pros and cons about AI. Lots of fun, a sword fight, a sandworm, a Bene Gesserit and more show up.
youtu.be/N7B4cj2TVDc
You used to need to retrain a six-figure LLM to change one behavior. That's ending.
Last week the Qwen team open-sourced Qwen-Scope — interpretability tools that let you find a specific feature inside a trained model and edit it. No retraining.
Our portfolio company @StarseerAI is doing the same across model families: 3 layers out of 32 catch jailbreaks at 99.2% accuracy in 38ms.
New vRon explainer:
youtu.be/BmO8GBY2ExQ
Ron Gula retweeted
We analyzed the new Copy Fail exploit and have a detection you can use agentlessly with @SandflySecurity to find processes that likely had privilege escalation with this attack. You can read more about it and get a rule to deploy here:
sandflysecurity.com/blog/det…
€5.65 billion in GDPR fines. 2,500+ enforcement actions. All sitting in a free, public database almost nobody outside the privacy bubble actually reads.
It's called the GDPR Enforcement Tracker (EnforcementTracker.com), run by CMS. If you're a CISO, board member, insurer, or founder building in privacy or data governance — bookmark it. Thirty minutes in the data beats a quarter of compliance theater.
vRon walks through why it matters and the seven ways to use it 👇
youtu.be/jLobPuOPRLU
Ron Gula retweeted
I’m speaking about Linux malware at a private telecom security conference at @ericsson HQ in Stockholm. They have all their gear on display. It’s really impressive.
When a nation-state runs an AI through tens of thousands of prompts to copy it, that's not "misuse" — that's the new supply chain attack.
youtu.be/glWnN3OH2LU
Codename: CARR. Sponsor: FSB. Cover: Telegram hacktivists. They opened pumps at US water plants and ordered operators to disable oil-and-gas alarms — "to increase the probability of a real accident."
One indictment that reads like a James Bond evil cyber villain.
youtu.be/3oEgZmaJF24?si=r-GP…
May the 4th, but for the SOC. Our AI comedian, Gary Cynfeld, does a new set that treats Star Wars as what it actually is: the longest-running case study in cyber malpractice ever filmed.
youtube.com/watch?v=u1mI1fN7…
Thank you @Dave_Maynor for pointing out that the CARR Indictment would make a great vRon short:
youtu.be/3oEgZmaJF24
New Gary Cynfeld bit — "NOT SCHEDULED" — the only maintenance window that ever started on time was the one nobody told you about.
youtu.be/Gv4qxnie5EY