Ron Gula retweeted
This is adversary emulation you run by talking to it.
Point Claude at a fresh CISA APT41 advisory, connect it to SCYTHE over MCP, and watch. No UI, no scripts. Just plain English.
In a single conversation, it:
- Mapped 27 APT41 techniques straight from the advisory
- Built a 56-step emulation and staged it
- Ran it live on three Windows hosts
- Read the verdict from CrowdStrike and Elastic: credential dump blocked in 4 seconds, five techniques with no signal
- Prioritized the open, high-severity exposures sitting behind those gaps
- Drafted the detections, flagged its own weak rule as not deployable, and packaged a ServiceNow ticket for the detection engineer
- Caught a Microsoft Defender connector that looked healthy but had ingested nothing for 19 days
That is the full loop, CTI to test to coverage to fix to retest, driven by language, not labor.
This is the new realm of MCP enabled testing. You have to see it to believe it.
SCYTHE. Act Before You Need to React.
#AdversaryEmulation #MCP #ThreatInformedDefense #DetectionEngineering #SCYTHE
Character AI had 12 million monthly users and still went bankrupt: about $5 of compute for every $1 of revenue. vRon on the three ways to build an AI product, and why a purpose-built algorithm beats renting one:
youtube.com/watch?v=g-ECRkMT…
The 2026 CVE forecast said 59,000. We passed 85,000 in October. Does the bug flood ever stop? vRon runs three scenarios to 2035:
youtu.be/ubS8q7zGhnw?t=243
When the "C" in "C2" is a covert channel.
youtu.be/9NVTX1bYUss
You cant vibe-code a customer.
I updated our five slide pitch deck based on a lot of what we've been seeing in start-ups asking for funding this year., which has been A LOT of identical "1.0" products with ZERO customers or proof of concept deployments.
youtu.be/cq8Hkvex4bY
Six months after AI started hunting bugs at scale, vRon keeps score: Microsoft’s patch count is up ~4x, Chrome’s security fixes 15x. Companies still take a median 43 days to fix the critical ones. The AI can find the bug. It can’t make you reboot.
youtu.be/ZJwS35qo0QM
In March, an anonymous site rated 649 RSA Conference exhibitors and called 62% of them "cooked": replaceable by a weekend of vibe coding, or just a GPT wrapper. Six months later, vRon checked on the patients. The ten cooked stocks are up 73% on average, against 19% for the S&P 500. Four of them doubled. One cooked startup bought another for a billion dollars. Code got cheaper. Customers, data, FedRAMP and the analyst who picks up at 3 a.m. did not.
youtu.be/oarJlRJ0C5U
I lot of what Jason Haddix said in his X post about "Cyber being Cooked" resonated with me. The more things change, the more they stay the same. I had vRon do a video on AI's impact to the cyber profession centered around the main points of his "post-DEFCON op-ed". Also did a slight plug for our Cyber Ready Clinic.
Fun video on latest cyber 'letters of marque' bills in congress. Watch the full video at: youtu.be/8xuGrdLJH7c
Pope Leo XIV's Magnifica Humanitas (May 15) is the Catholic Church's first formal doctrine on artificial intelligence. It addresses, by name, the engineers, founders, and regulators building these systems today. vRon breaks it down:
youtu.be/9dgbs7AoCtc
In 2006, an Italian filmmaker quietly made the best cybersecurity movie nobody watched — and predicted the NSA surveillance debate 7 years before Snowden. New vRon: why The Listening still holds up.
youtu.be/OFC_9RtHApY
There Is No Security Meter For AI. That's the title of the new Berryville Institute of Machine Learning paper from Gary McGraw, Harold Figueroa, Katie McMahon, and Richie Bonett. The argument: every "AI security score" you've been shown is theater. In 12 minutes vRon walks the badness-ometer, the Strange Loop, the WHAT pile, and where whitebox interpretability fits.
youtu.be/6hpvMzxNyCM 📄
#AISecurity #MLsec #BIML
I had my AI comedian debate my AI Mentat from Dune about the pros and cons about AI. Lots of fun, a sword fight, a sandworm, a Bene Gesserit and more show up.
youtu.be/N7B4cj2TVDc
You used to need to retrain a six-figure LLM to change one behavior. That's ending.
Last week the Qwen team open-sourced Qwen-Scope — interpretability tools that let you find a specific feature inside a trained model and edit it. No retraining.
Our portfolio company @StarseerAI is doing the same across model families: 3 layers out of 32 catch jailbreaks at 99.2% accuracy in 38ms.
New vRon explainer:
youtu.be/BmO8GBY2ExQ
Ron Gula retweeted
We analyzed the new Copy Fail exploit and have a detection you can use agentlessly with @SandflySecurity to find processes that likely had privilege escalation with this attack. You can read more about it and get a rule to deploy here:
sandflysecurity.com/blog/det…
€5.65 billion in GDPR fines. 2,500+ enforcement actions. All sitting in a free, public database almost nobody outside the privacy bubble actually reads.
It's called the GDPR Enforcement Tracker (EnforcementTracker.com), run by CMS. If you're a CISO, board member, insurer, or founder building in privacy or data governance — bookmark it. Thirty minutes in the data beats a quarter of compliance theater.
vRon walks through why it matters and the seven ways to use it 👇
youtu.be/jLobPuOPRLU