Advertise on podcast: The Start and Scale Podcast

Trust, but verify. Vlad Ionescu spent seven years at Meta paid to break into systems everyone else assumed were secure. Vlad ran the experiments that decided whether Meta was comfortable launching Llama 3. Two years ago the agents were terrible at hacking. Then one of them got root and did not stop. That was enough to leave Meta and start RunSybil. Most of this conversation is about what happens now that the models have caught up. What to expect in this episode: • Why offence gets AI first, and why the real reason has nothing to do with technology • The Llama 3 experiments. What happened when experienced hackers were handed AI, and what the agents did once they got root • The red team op that chained zero days across air-gapped systems and moved real money out of one of the largest US banks • Why Mythos was not a surprise, and the one thing about it that was • The bug the whole team assumed was a hallucination, and what it proved • The vendor claim that should make every buyer nervous • Why the cyber talent gap was never going to close the way everyone assumed • Why a funded early-stage company might now be the safer job, and the one trait Vlad hires for • Why 95% of hacking sucks, and what that means for anyone choosing a career in it About Vlad: • Led all of offensive security at Meta. That included the bug bounty programme, the second largest in the world after Microsoft's • Ran the hacking studies that decided whether Meta shipped Llama 3. Co-author of CyberSecEval 3 • Founded Red Team X, Meta's vulnerability research and exploit development team. Grew the red team from three people to around 15 • Co-founder and CTO of RunSybil. $40M raised. Series A led by Khosla Ventures, with Conviction, S32, Elad Gil and Anthology Fund

🎯 Building a product has never been cheaper. Seth Spergel thinks that changes what decides who wins. He has sold most of his first fund’s portfolio, and two of those companies went to Palo Alto in the same week. His view is that agentic coding has brought the cost of building down so far that the product on its own rarely settles anything anymore. What tends to settle it is who gets out in front of the market first, raises the money, and buys enough runway to build the rest. He points to the CSPM market as the clearest recent example, and most of this conversation comes back to that idea in one way or another. 🎙️ What to expect in this episode: • Why Israel keeps producing cyber startups and most countries don’t. It comes down to people leaving service as a cohort, older founders mentoring the next intake, and a handful of seed funds set up for exactly that stage • Money is cheap for the best companies, so the question to ask before you sign a term sheet should go to the VC’s portfolio founders rather than the VC • The traction slide that worries him. When every early customer turns out to be the founder’s neighbour, uncle or dad’s old roommate, he wants to see whether they can sell somewhere nobody knows them • Why the seed round in Neo Security was really a bet on Nick Warner, who took SentinelOne from around $5M to a $500M IPO and Cylance from nothing to $200M and a billion-plus sale • Nobody running a security team is going to buy ten separate AI security products. His take on where consolidation lands, and why every startup still needs to win one entry point first • When to make the first go-to-market hire. His answer is months in, not at Series A, even if you have to pay them a draw because there is nothing to sell yet • Government being ten years behind industry is a myth in cyber. The intelligence agencies adopt security tech earlier than most companies, and what he calls the Sunday Monday problem is what actually costs them people • The Dig Security story. A quarter of a room of CISOs asked to meet the founder, he tracked competitors’ hiring by role, and when he was nudged towards AI security, Palo Alto later cited it as a reason for buying the company • The Mom Test. Why asking “Do you like it?” gets you polite lies, and what to ask instead 👤 About Seth: • Managing Partner at Merlin Ventures, a seed-stage cybersecurity fund he started in 2018. He is based in Washington, D.C., and his partner Shay Michel runs a team of seven in Tel Aviv. The fund backs early-stage Israeli cyber companies and helps them break into the US • The first fund made around 15 or 16 investments between 2018 and 2024 and has sold most of them, including Dig Security and Talon, which Palo Alto Networks bought in the same week. Merlin also led Torq’s Series D. In late 2024, he raised an $85M seed fund with outside LPs and has backed eight companies from it so far, including Neo Security alongside Andreessen Horowitz and Craft • Before Merlin, he was at In-Q-Tel, the venture arm the CIA set up to work with the intelligence agencies. Before that, he was VP of Engineering at ThinkGeek and took it through its IPO, after more than ten years at IBM in development and sales management Merlin runs a community of several hundred CISOs and an annual event in Denver, Merlin Safari, which had 150 people and around 70 CISOs this year. 🔗 Seth Spergel: https://www.linkedin.com/in/sethspergel/ 🏢 Merlin Ventures: https://www.linkedin.com/company/merlinvc/ 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎧 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

🧩 Security tools don’t reduce work. They create it. And nobody has the people to do it. Justin Woody spent six years at Claroty hearing the same feedback on a product that scaled to $100M ARR: great dashboard, no one to act on it. So for his next company, he asked strangers to rip the idea apart. Every one of them said the same word: identity. What to expect in this episode: • Nobody is ever going to hire enough people to clear the security backlog. Why the fix sits between the tool stack and the human, not in another hire • Why a teaching hospital ends up with 20 identity tools, a $3M IGA on top, and people as the glue holding it together • The “don’t be nice” test: why validating with friends is an echo chamber, and how friend-of-a-friend conversations killed the idea he wanted to build • Digital employee versus AI agent: one reports back to one person, the other learns the tribal knowledge, the VIPs and the third-party contractors • What it should take before an AI gets to close a ticket without asking: approval per action, read-only until trusted, a full audit trail • Coming out of stealth with $12M: why being the only one talking about it worked, and why there are now four or five direct competitors and 50 within a degree • Token costs, on-prem LLMs and measuring AI on business outcomes: the three themes he heard across Black Hat and AI4, and why he thinks the token panic is a crescendo effect • The security team of the future: five or six digital employees each, a command role, and a KPI on every one because they cost money to run About Justin: • Spent six years at Claroty as Director of Innovation, then Senior Director of Strategy and Research, joining when the company was around two years old and staying as it grew to $100M ARR • Before that, led the IoT/OT practice at Mandiant Managed Defense and spent over a decade at IBM in security delivery and consulting • Co-founder of Twine Security, building AI digital employees for cyber teams. Came out of stealth with a $12M seed round; the first digital employee, Alex, works on identity 🔗 Justin Woody: https://www.linkedin.com/in/jwoody1/ 🏢 Twine Security: https://www.linkedin.com/company/twinesecurity/home/ 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎧 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

🚨 Most sales leaders forecast their quota. Patrick Dillon calls that a recipe for disaster. He has scaled cyber go-to-market teams from under $50M to $150M, and he's blunt about what breaks along the way: hero CROs, copy and paste playbooks, bloated sales teams, and founders who can't let go. What to expect in this episode: • Why a CRO who has to personally rescue deals is running a hero strategy, and why it fails • 8 reps doing the work of 20: AI deal scoring out of 100 at every stage, and zero early-stage deals in the forecast • Founders: if you're chasing your first 10 to 20 customers, you don't need a CRO. Hire a VP of Sales • Series A money is go-to-market money, and what investors expect to see as a company moves from seed to Series C • Shadow AI is infinitely scarier than shadow IT: your existing tools are switching on AI overnight and nobody approved it • If blocking and alerting worked, cybersecurity would have been solved years ago • What he hires for: grit, humility, three to seven year tenures, and candidates who ask five good questions About Patrick: • Chief Revenue Officer at Nudge Security, brought in to scale go-to-market after its Series A • Previously CRO at Airlock Digital, plus senior go-to-market roles at Saviynt, BeyondTrust and Hewlett Packard Enterprise • SVP for the Americas at Saviynt through COVID, building the team over Zoom while the company went from under $50M to $150M in revenue in three years • Started in recruitment at Robert Half in 1998 and interviewed thousands of people before he ever sold cyber 🔗 Patrick Dillon: https://www.linkedin.com/in/patrickdillon2/ 🏢 Nudge Security: https://www.linkedin.com/company/nudge-security/home/ 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎧 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

At Black Hat, Matan Bar-Efrat's team took over an AI shopping assistant by talking to it. No zero days, nothing sophisticated. The chatbot handed over its API key, and the guardrails built to protect it fell to the same manipulation they were meant to stop. This episode is about what securing AI agents actually takes once they're running real business processes. Covered in this episode: • The Black Hat "Bye Bye" demo: owning an AI shopping agent through conversation alone, and why the guardrails failed • Why prompt-inspecting "guardian agents" catch the easy attacks and miss anything even slightly sophisticated, and why watching the actions an agent takes is how it should be done • The exploitation window collapsing from months to basically instant, and why signature-based controls and patching cycles were already losing • Enterprise agents moving from copilots to running business processes, why finance and insurance are first, and why that shift is what has to justify the trillion-dollar AI valuations • The founding story: investors calling the idea dumb, why he says that was good, and his advice for founders: talk about what you don't do, because doing everything is doing nothing About Matan: • Co-founder and CEO of Rein Security, the enterprise agent security company, launched with an $8M seed led by Glilot Capital and backed by founders from Aqua Security, Orca Security and Talon • Former Unit 8200 officer, in cybersecurity since he was 18 • Spent seven years at Cyberbit, ending up running its Northern European territory, before it merged into Elbit • Presented the "Bye Bye" AI shopping assistant hack at Black Hat and recently spoke at a JP Morgan fireside on AI agents in front of 1,200 people 🔗 Matan Bar-Efrat: https://lnkd.in/egC5jjwD 🏢 Rein Security: https://lnkd.in/ebnCUi39 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎧 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

The Hugging Face and OpenAI incident put 17,000 alerts through the SOC in a few hours, most of them low severity detections nobody would normally look at. Ely Abramovitch’s read: it felt like a million stupid attackers, and the next one arrives with actual malice, against a company of consequence. This episode is about what security operations has to become before that happens. Covered in this episode: • How Microsoft Sentinel went from zero to $1B in ARR, and why almost everyone inside Microsoft objected to it until the revenue started piling in • Why SOAR failed as a market, and why “alerts automatically closed” and MTTR are the wrong scoreboard for a SOC • Why most AI SOC solutions are going about it the wrong way, and why watching how your team actually works is how it should be done • Why security orgs are collapsing into three layers, sensors, agents, people, and why 40% of Legion’s revenue is already outside the SOC • The founding story: quitting Microsoft before any term sheet, a seed signed two to three weeks later, his take on what made Wiz special, and his advice on founder mental health About Ely: • CEO and co-founder of Legion, the AI SOC company that came out of stealth with $38M from Accel and Coatue • Led product management for Microsoft Sentinel as it went from zero to $1B in ARR • One of the first employees at Indegy, acquired by Tenable • Started out as a jazz pianist in New York, studied maths and philosophy, and served in army intelligence, where his work was awarded the Defense Prize. 🔗 Ely Abramovitch: https://www.linkedin.com/in/ely-abramovitch-a3a912bb/ 🏢 Legion Security: https://www.linkedin.com/company/legion-security-ai/ 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎧 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

Ask any attacker the best way into a company: compromise an identity. 26 years into cybersecurity, Howard Ting says the problems he worked on at RSA in 2000 are still unsolved. This episode is about why, and what AI agents are about to do to the identity stack. Covered in this episode: Why standing permissions are still the easiest way into an organisation, and why nobody revokes access once the need expires Rubber stamping: what actually happens when a manager faces 100 access requests every morning Why agent access decisions will run a million to one against human capacity, and why AI narrowing the funnel is the only way through How Opal's Paladin agent reads tickets and Slack context to cut the review volume going to humans by 95 to 99 percent How Howard picks companies (80 percent of the decision is the market) and his three S's framework for career growth: scale, space, scope About Howard: • CEO of Opal Security, the Greylock-backed access governance company • Started in identity at RSA in 2000, launched Microsoft's identity federation product at Bill Gates' last RSA keynote • Joined Palo Alto Networks at roughly employee 60 and Nutanix at roughly employee 40. Both grew from a couple of million in revenue to a billion, with an IPO at each • Five years as CEO of Cyberhaven, worth $1B when he left • Now back in identity to work on what he calls unfinished business 🔗 Howard Ting: https://www.linkedin.com/in/howardting/ 🏢 Opal Security: https://www.linkedin.com/company/opalsecurity/ 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎵 Spotify: https://lnkd.in/eij7j2m 📲 On Security LinkedIn: https://www.linkedin.com/company/onsecuritypodcast/

AI has made malware easier, cheaper and faster to develop. 🤖 But is it actually making malware better — or just creating more of it? On the latest Secure & Scale Podcast, Jack Brandwood sits down with Danny Quist, CTO at PolySwarm and a malware reverse engineer with 20 years of experience, to explore how AI is changing the threat landscape. 🎙️ They discuss: • AI and the democratisation of malware• The future of malware detection• How AI could transform analysis• Why human judgement still matters “The human in the loop is always gonna be there.” 🔗 Danny's LinkedIn: https://lnkd.in/edKA-rRk 🏢 PolySwarm: https://lnkd.in/egzPT_xP 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎵 Spotify: https://lnkd.in/eij7j2m ▶️ YouTube: https://lnkd.in/evEFhtb2

AI is getting faster. But faster doesn't always mean better. 🎙️In the latest Secure & Scale Podcast, we sit down with Ian Amit, Founder of Gomboc, to explore where AI delivers in cybersecurity, and where it falls short. 🤖The key issue? Precision.Generative AI is great for creative tasks. But when you're fixing cloud infrastructure, “almost correct” isn't good enough.Inside the conversation:• Why deterministic AI matters for security engineering• How cloud misconfigurations create massive attack surfaces• Where AI agents fit into cloud security• Why policy as code needs to become proactive• How attackers are using AI to move faster ⚡One of the biggest takeaways:“For an engineer like myself, what I hear is it's incorrect.”Attackers only need to be right once. Defenders need to be right every time. 🛡️If you're a cybersecurity or cloud security leader, this is one worth watching.🔗 Ian's LinkedIn: https://www.linkedin.com/in/iamit/🏢 Gomboc: https://www.linkedin.com/company/gomboc-ai/👤 Jack Brandwood: https://lnkd.in/dFMyDUEN🎵 Spotify: https://lnkd.in/eij7j2m▶️ YouTube: https://lnkd.in/evEFhtb2

AI isn't going to replace everyone in cybersecurity. But it is going to change which work humans do. 🤖🔐🎙️ The latest episode of the Secure & Scale Podcast features Michael Brown, who has worked for companies like Trail of Bits, US Army and Georgia Tech Research Institute. Michael has spent years working at the intersection of AI, machine learning and software security. In the conversation, he breaks down where AI genuinely belongs in security, and where we're forcing it into problems it was never designed to solve. 🧠💻 We get into: • Why AI and conventional security techniques work best together• Why AI-generated code becomes riskier as complexity increases• How AI agents should be secured and permissioned • Why shadow AI is becoming a growing security problem • Which cybersecurity roles are likely to remain human • Where AI could create the next major software supply chain risk 💡 One of the biggest takeaways:"AI is not going to outperform writing an algorithm for something." The real skill is knowing when AI is actually the right tool. 🎯 If you're working in cybersecurity, software engineering or AI, this is one worth watching. 🚀 Michael's LinkedIn: https://www.linkedin.com/in/michael-brown-47949515/ Jack Brandwood: https://lnkd.in/dFMyDUEN Spotify: https://lnkd.in/eij7j2m YouTube: https://lnkd.in/evEFhtb2

As AI makes impersonation easier than ever, how do organisations build and maintain trust online? In this episode of the Secure & Scale Podcast, Jack Brandwood sits down with David Promisel, Founding Engineer at Outtake, to explore why digital trust has become one of cybersecurity's biggest challenges. Inside the conversation: • Why automation should always follow trust • The growing threat of AI-powered impersonation • How brands can measure and protect digital trust • Why evidence matters more than assumptions • What the future of identity and trust looks like If you're building, securing, or scaling digital products, this episode offers a practical perspective on one of cybersecurity's fastest-growing challenges. David Promisel's LinkedIn: https://www.linkedin.com/in/david-promisel/ Outtake: https://www.linkedin.com/company/outtakeai/ Jack Brandwood: https://lnkd.in/dFMyDUEN Spotify: https://lnkd.in/eij7j2m YouTube: https://lnkd.in/evEFhtb2

AI won't replace pentesters.But it might replace average ones. 🎙️The latest Secure & Scale Podcast features Sonali Shah, CEO of Cobalt, on the future of offensive security.AI will automate more of the work. But human creativity, business context and judgement still matter.Inside the conversation:• Why annual pentesting isn't enough anymore• What continuous pentesting actually means• Where AI could cover 75% of vulnerabilities• Why humans still find complex business logic flaws• How AI agents are expanding the attack surfaceOne of the biggest takeaways:"AI is absolutely getting better, but the human is still very relevant."You don't need more pentesters.You need the best ones.🔗 Sonali Shah's LinkedIn: https://www.linkedin.com/in/sonalinshah/🏢 Cobalt LinkedIn: https://www.linkedin.com/company/cobalt-io/👤 Jack Brandwood: https://lnkd.in/dFMyDUEN🎵 Spotify: https://lnkd.in/eij7j2m▶️ YouTube: https://lnkd.in/e_ZYPusr

From teenage hacker to shaping the future of vulnerability management. 🎙️ In this episode of the Secure & Scale Podcast, Jack Brandwood sits down with Tod Beardsley, Vice President of Security Research at runZero, to explore the evolution of vulnerability management and the challenges facing defenders today. Tod shares his journey from hacking as a teenager to helping shape the systems the industry relies on, including the future of CVE, AI-driven security research, and why vulnerability standards matter. In this episode, we dive into: • Why CVE became the industry's shared language• The risk of vulnerability databases fragmenting• How AI is changing security research• The future of vulnerability disclosure• Why attackers ignore vulnerability identifiers while defenders rely on them One of the biggest takeaways:"Attackers give no spits about which vulnerability identifier it is. As long as they get shells, they're good." If you're a security leader, researcher, or vulnerability management professional, this episode is worth watching. Tod Beardsley's LinkedIn: https://lnkd.in/ei6Db5aAJack Brandwood: https://lnkd.in/dFMyDUENrunZero: https://lnkd.in/ev92cT-bSpotify: https://lnkd.in/eij7j2mYouTube: https://lnkd.in/evEFhtb2

OT systems can be 25 years old and still be running critical infrastructure. ⚙️🔒 In this episode of the Secure & Scale Podcast, Jack Brandwood sits down with Rob King, Director of Applied Security Research at runZero, to explore the challenge of securing the systems that keep the world moving. Rob shares why OT devices often stay in place for decades, the risks of unpatched technology, how IT and OT teams are learning to work together, and why network segmentation is critical for protecting industrial environments. One of the biggest takeaways: "Nobody has a spare factory. If the factory goes down, it's millions of dollars an hour." If you're working in cybersecurity, OT, or critical infrastructure, this is one worth watching. 🎙️ 🔗 Rob King's LinkedIn: https://lnkd.in/evDXV-Cj 🏢 runZero: https://lnkd.in/ev92cT-b 👤 Jack Brandwood: https://lnkd.in/dFMyDUEN 🎵 Spotify: https://lnkd.in/eij7j2m ▶️ YouTube: https://lnkd.in/e_ZYPusr

AI isn't the problem. The foundations are.In the latest Secure & Scale Podcast episode, Jack Brandwood sits down with Jake Bernardes, CISO at Anecdotes, to unpack why the future of security isn't about adding AI everywhere.It's about understanding the problems first.From GRC automation to AI governance, Jake shares why companies need to fix the foundations before they can expect AI to deliver real value.Inside the conversation:• Why AI is becoming the wrong question to ask• How GRC is moving from manual to automated workflows• Why poor inputs create poor AI outputs• How to build trust through verification, not assumptions• Why security professionals need to become orchestrators• How AI agents can be governed safelyOne of the biggest takeaways:"You can't automate something which doesn't work. It's like trying to build a house really fast, but not knowing how to build a house to begin with."If you're a cybersecurity leader navigating the future of AI, this is one worth watching.🔗 Jake Bernardes' LinkedIn: https://lnkd.in/eR9QA2A5🏢 Anecdotes: https://lnkd.in/ei3iFxpA👤 Jack Brandwood: https://lnkd.in/dFMyDUEN🎵 Spotify: https://lnkd.in/eij7j2m▶️ YouTube: https://lnkd.in/e_ZYPusr