Podcast Transcript

You're listening to the RSA conference podcast where the world talks security.

Hello, listeners. Welcome to this edition of our RSAC podcast series. Thank you for tuning in. I'm Tatyana Sanchez.

And I'm Kacy Zurkus.

And we are your RSAC podcast hosts. Kacy, what are we going to discuss today?

Well, Tatyana, I don't know... Well, I do know that you you pay very close attention to cybersecurity news as do I. And, you know, according to many news articles and even industry reports that came out in 2025, we're seeing that more than half of newly disclosed vulnerabilities saw exploit code weaponized within forty eight hours.

So organizations clearly are struggling to get ahead of vulnerabilities and move past vulnerability debt.

But even with the help of resources like CISA's known exploited vulnerabilities catalog, there are still challenges. And that's why we're excited to be joined today by Steve Osepek, who will share actionable strategies on how organizations can manage their vulnerability program and start driving significant risk reductions to truly get ahead.

And before we get started, we do wanna remind our listeners that here at RSAC, we host podcast twice a month, and we encourage you to subscribe, rate, and review us on your preferred podcast app so that you can be notified when new tracks are posted.

And now we would like to ask our guest to formally introduce himself before we dive in. Steve?

Hi. Great to talk to you today. I'm Steve Ocepek. I am the managing director at Kroll that's leading our threat exposure management practice.

Thanks, Steve, and thanks for taking the time to join us today.

I wanna first start off by asking, like, how are vulnerabilities weaponized?

And what are the true common exploit techniques being used by threat actors today?

Absolutely. You know, and what's not commonly known is just how much of a market there is behind this weaponization. You know, probably a good way to approach it and if you think about those techniques like it's getting into the shoes of somebody that's that's trying to break into a system. Let's say that we're threat actors.

Right? And and we wanna create an exploit kit and we wanna make money off this. Right? We wanna sell this and and and other folks will use this exploit kit in this fantasy world to actually perform our campaigns and sell this to folks who wanna break into systems.

Right? And so what are the things we're gonna think about in that world? We're talking about weaponization prevalence.

If we're looking at different vulnerabilities that we could potentially or different areas of study where we could create this this exploit code, we're going to look at what's on the Internet, what is exposed, what are folks using. Right? What types of software, what platforms. Another thing we might look at is the obscurity.

Are we gonna get caught? Is it something that maybe hasn't had attention in some time that we could focus on and get a lot of potential targets. Right? Is there something that we can focus on and and and target that that other folks aren't looking at?

And another one is reliability. Is this exploit code going to work? Can we test it? Can we get it to run the same way every time?

Right? So these are all things that we're gonna think about. And from a techniques perspective, a lot of these vulnerabilities, the work is done for us from as...

From a threat actor perspective in the form of things like CVEs, vulnerabilities, you know, things that are published. So our job, you know, one thing we don't care about as threat actors is art or style points. Maybe a little. But but truly, what we're looking for is that place, that intersection of something that's very prevalent, hard to detect, and easily targeted.

And what's we're seeing, you mentioned that forty eight hours number, there are a combination of these things we have access to. As threat actors, we could either target things that are just coming out for which they don't have detection yet. Like you said, the forty eight hour time, that's one way to do it and you get that window of time as a threat actor before the defenses have caught it. We sometimes refer to those as zero days.

Right? But the other side of this that I see as well is on the backlog.

They might target something from five, ten years ago. That's also still prevalent. That's also still out there. So a lot of money changes hands during that period, you know, from the time when a threat actor targets a vulnerability to when they actually cash in on it. And that's what really decides what things could target in the market.

Someone was asking the other day about, can you talk more about new threats and daily breaches? Right? And, you know, to your point, Steve, I don't think that there's always the new zero day that folks are chasing that sometimes it's older vulnerabilities. Right?

But we do see that there is an increase in the number of vulnerabilities. Year over year, there was a 38% increase from '23 to '24, and that number keeps rising. So given this surge, what are some of the biggest internal challenges organizations face when they're dealing with vulnerabilities?

You know, I have a new answer to this, I think, after spending really close to a decade in this space. And I I will say that vulnerability management, CTEM, you know, threat exposure management, these are things that are the same or it share some space at least depending on who you speak to. And what you see is this market moving to this this this CTEM, continuous threats and exposure management. This concept.

And it's in relation to what you asked. The biggest challenges organizations are finding is what do I focus on? And it's a great concept. It's a great framework.

It's just that. It's a framework. Right? We're aligning to this.

This takes into account the fact that CSOs are really struggling to figure out day to day, what do I focus on on loan management to focus on the most important thing in my organization. That's that is the key most difficult thing. You know, so I I've I've taken a more of an approach with my clients to take a step back. You know, the biggest internal challenge you ask, actually, the biggest internal challenge is panic, and it's caused by large numbers.

Frankly, if we really break it down. Because you have teams that are in the auditing capacity and those that are responsible for risk management.

And it's really hard for somebody to back away from a statement saying we need to fix all external critical vulnerabilities within twenty four hours.

Great concept. Great idea. Right? But we know if we shift over to even just our partners and our our friends within the managed detection response space, they handle millions of events a day.

And they don't tell themselves they have to run every single one to ground within the spare time. What they do is they get a big funnel and they take in all these events and they crunch them down and they get value out of taking a million events and turning them into five. Right? That's valuable in their world.

In the phone management space, I think we we got off on the wrong foot because we used to have enough vulnerabilities we tackle them in a week or two. Now we're getting to the point where we have so many vulnerabilities. It's become just as large as the detection response. So the biggest internal challenges are the the the ad...

I I would say it's created an adversarial scenario between risk and IT, and I see it a lot. Because risk rightly doesn't wanna see the critical vulnerabilities exposed, but the reality of the scanners producing 100, 200,000, I've seen 10,000,000.

I've seen it. So it's good for everybody to hear that on the call. All your listeners need to hear. You're probably sitting there thinking, have more vulnerabilities than you think.

No. Probably not. Believe it or not, everybody and everybody I've worked with has this problem. I think we need to talk about that, socialize that, and then get ourselves back to a mindset like we do in managed detection responsive.

Okay. We know all of this. What should we tackle first? Right? That's the key.

And Steve, you emphasize that sometimes, you know, the market is moving to threat exposure management, but oftentimes organizations don't know where to start, on vulnerability management. And sometimes, you know, small to medium sized businesses, don't have the limited resources to respond to such vulnerabilities, which can often lead to vulnerability death. Steve, can you clarify what this term means?

And can you also explain what are the most effective strategies for organizations to move past it?

Absolutely. It's a great point too to bring up vulnerability debt. And I I apologize to anybody that heard that term and got a pit in their stomach because those of us who do deal with it, right, we're very familiar with this term. For those who don't, it's a phenomenon.

You imagine you're starting a job, but a lot of times it happens as a CISO. Even in a small organization, a credit union or a, you know, a a small...

Maybe even a local car dealership. And, you know, you start the job, the honeymoon period, and then you get hit with the first scan results. And there are 200,000 or 250,000 vulnerabilities and half of them are critical. That's that debt.

Right? Somebody was here before. You're here now. Somebody will maybe be here next, and you're looking at this large amount of debt...

A vulnerability backlog, and you're saying, where do I start?

A lot of times the board also is very keen on driving down the number of vulnerabilities. The amount of vulnerabilities can get very large. So that is a space where we really bring in some wisdom. Right?

It's not...

The technology that exists in the market is very good nowadays. There are many good CPM capabilities and and technologies. We don't even need to, you know...

It's an easily searched field. Right? A lot of folks are getting in on this, and it's it's needed because there's a gap between when you get the results from the vulnerability scanners and the and the technologies, and when you go to figure out, like I said before, what do I work on this week? What do we start on?

And then how do I take that process, make sanity within an insane system. Right? Too many vulnerabilities, and then show an auditor that this is working the way they want it to. And a lot of that, believe it or not, the huge backlog can be an opportunity.

You can flip that on its head and you can start looking at it as intel. That's how we...

You know, I've I've spent some time in the threat intel space. In the threat intel space, we look at data as power. We look at data as as enabling. Right?

And empowering and allows us to get to the base of something. In this space, we look at data as maybe sometimes it's it's malicious to us. Here's a great real real quick anecdote. A client who is getting ready to turn on agent based or authenticated scanning, which means the scanner is going to have the ability to more completely ascertain the vulnerability status of the system because it's gonna be able to log in.

Right? Imagine one world where we look at that as more data, and that's good. Right? More data is always good in the intel world that's gonna give us more information about where the vulnerabilities are and what to focus on.

But if we're in an SLA, service level agreement driven environment, which all of us are. All of us are. So if we're in that environment, then if I move over to every critical and high has to be fixed within twenty four hours or fifteen days or thirty, thirty by the way is the average, thirty days, then I have just added maybe half a million more vulnerabilities depending on the size or even half doubled tripled them. A lot of times, authenticated scanning can 10 x your vulnerability count.

So it it really has to do with how the organization looks at it and how we approach it from the perspective of threat management.

It's so interesting because I'm listening to you and I'm thinking, jeez, you can get that, you know, down to even five vulnerabilities, but it... Really, the only one that matters is the one that's being exploited. Right? And you and you don't know what that is.

Yes. That's a great point. It's almost like being a roofer, and you you you ask me to come over and say, where is the water going to get in?

Right. Can tell you tricky.

Can... And then so are threat actors and they Right. They are like water when they're really good and they can be very good. So, you know, when when I'm... When we're standing on the roof, of course, hopefully, we're not standing on a roof, but it like we're... If we had the drone, right? And I could show you the cracks.

Yeah. I could show you where water might come in. But that's where I stop. Right?

At the end of the day, if there's a tiny little hair fracture and yet it goes straight into the house, that's where it's gonna come in. And it's it's very difficult to predict that. So the best thing you can do is take a continuous...

There's that word again, continuous approach. Right? In this way where it's sort of like basement waterproofing if you have a basement or roof. Everybody has a roof.

Right? So it's that sort of you don't care about it until somebody...

Something goes wrong, you know.

Right.

And then you really do care about it. And I think we all need to start. Obviously, some of us are already doing this and I I... And we're making good progress, but it's almost a hygiene thing. We need to get to where we think about vulnerability management every day or exposure management every day.

And it's a it's it's almost like our development life cycle. It continues along parallel to our improvements to our products and our our business.

I love that analogy because it just makes sense. Right? It gives you a visual relate to as a homeowner and a human being, and it makes total sense. And I'm thinking about, okay. We have the drone. We see all the potential places that that water could make its way into my home and create a problem.

I have limited resources, Steve. Right. And I can't possibly afford to fix all of those cracks. So for organizations that may not have a strong vulnerability management program or they have limited resources, what are some actionable steps that they can take today to start? Who's involved? What tools? What teams should be brought into the equation?

And that... I'll take that last one first because you, you know, got me thinking that this is this is something, frankly, I found a... I've I've gotten a lot of value from bringing vulnerability management and CTEM teams into cybersecurity or cyber fusion centers. If you think about it, one of the first things if you get threat intel on a vulnerability that's making the rounds. What's the very first question that the threat intel person will ask? And it is...

I'm so glad you're answering it because I thought you wanted me to answer was sweating over here, Steve.

I promise. No. But it...

But when I say it, you'll know. When I say it, you'll be like, oh, yeah. Of course. If they...

The question they always ask is, do we have this? Do we have this? Oh, there's this big, very scary thing happening with this technology. Do we have that technology?

Immediately.

Right? That's vulnerability management's gonna be able to tell you that. CTIM's gonna be able tell you that. Right?

Because they're gonna be in the asset management database. They're gonna be into the ticketing system system record. They're gonna be able to see, yeah, we do have that. Or no, actually, we have this other version that doesn't apply to that.

Very fast. Right? The other thing that they can tell you very quickly is where somebody could have gotten in. Vulnerability management professionals are closest to the data.

They know where the, I guess, the skeletons are buried if you will. Skeleton in the closet, that's the metaphor. Shouldn't even use that probably. But if they know where the secrets are and the secrets to the organization and where somebody could have gotten in.

So during an incident or during a threat hunt, they will have interesting things to tell you about parts of the environment that you would never think to look. So I would say that small orgs that don't have this, maybe now we're talking about...

In this example, was talking about maybe three or four different people. What if you have one person, like you said, and you're small and you don't really have a lot to, you know, focus on this. Understandable. A lot of people don't.

Think of it the same way you think about software development. It really because just like software developers, we have an infinite backlog. You're not gonna be able to fix them all. It's a marathon.

Even though I use the word sprint, it really is a marathon, not a sprint. It's a marathon made up of a bunch of sprints. Right? Just like software development.

So what I've seen how...

Like like, I think of it this way. We...

We're used to getting software changes in via the normal software development life cycle. Developers are used to pulling tasks out of a system and and and working on those for a sprint. We can do the same thing for vulnerability management. We can rank and stack them according...

All the vulnerabilities according to threat intel, and then we can come up with that list to say this week or this two week period. We are also in addition to the work we're doing in the software development sprint, we're gonna fix some of these vulnerabilities. I think that anybody can start. The good thing about vulnerability management is it's a bit of a jobs opportunity.

And I know that's very near and dear to all of our hearts right now. What I mean by that is it doesn't take a lot to get started. If you have an interest in vulnerability research and and and how something is exploited, there's our tools like Metasploitable three. If you look that up, that's a Rapid7 open source project.

It has a very exploitable Windows system and Linux system on there. We utilize that here in Akron to work with the local STEM school. And essentially, it makes it very easy to start researching vulnerabilities. You could read about one.

You could replicate it in your own little lab. I think these kinds of things...

When you think about how training is at such a premium and everybody says, when we...

Every time RSAC does a survey, it's always, we want more training. Right? Right. And this is a great opportunity to start baking that into your job and starting to get into some of the crunchy parts of it.

You can have a junior analyst learning vulnerability management and becoming potentially a pen tester someday or something like this. Right? I think it's a gap. I think it's a missing piece in our space that that you can utilize to get into it, And anybody at any level of capability or technology can start on this world because there's so much information out there.

I love that.

So Metasploitable three, a Rack of seven open source tool.

Yes.

That's fantastic.

I'm gonna I'm gonna take your advice and go check it out. I might have to call you on the side to figure out what to do next.

Let's do. It's it's a little crunchy. It's... And they've done a great job, but it's a little on the crunchy side. We'd be glad to give you the cheat sheet on that. Yeah. Absolutely.

Fantastic.

Steve, thank you so much for being here today. I also have learned about Continuous Threats and Exposure Management, CTEM, a new acronym to add to our vernacular. So thank you so much. Listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership. And be sure to check 1rsac.com for new content posted year round.

Until next time.