12 Oct 2026
Farzan Karimi: We Cut Security Reviews From 3 Days to 10 Minutes With AI | S3 | E2
If you have a hundred findings rated 9.2, which one do you fix first? The score can't tell you. Proof that an attacker can actually exploit it can.Meanwhile AI is flooding security with new tools. Some are real. Some are snake oil. How do you tell the difference, and what should you measure to understand your real exposure?Hi, I'm Eva Benn. Every Monday morning I bring you the best global security leaders with practical AI security guidance you can turn into action this week. If you have ever found value in this show, please do me a huge favor, drop me a comment, hit the thumbs up on this video and make sure you are subscribed. This tiny action costs you nothing, but it has a huge impact the entire security community, because it helps bring the voices of some of the most incredible leaders in our industry to more people. Every episode is designed to give you practical things you can go and implement in your organization this week.Today we unpack how to tell whether a security problem is a good fit for AI, what makes an AI product snake oil, how to put exploit proof at the center of prioritization, why chained bugs matter more than counted bugs, how silos turn into security risk, and the one thing to ask your teams to verify this week.Share this one with your security, AppSec, engineering, and vulnerability management teams.I'm doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and resources you can go use this week.This week, I sat down with Farzan Karimi, Deputy CISO at Moderna.We talked about separating real AI value from snake oil, prioritizing what is actually exploitable, and measuring real exposure instead of counting findings.If AI can now find more vulnerabilities than your team will ever fix, is your program still counting findings, or is it tracking attack paths? Tell me in the comments.If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show.Resources we mention in the video:Farzan's research and talks:- How I Accessed 1,800 Company Livestreams and Uncovered a New Web Exploit Class: RRE: https://jumpycastle.dev/how-i-accessed-1-800-company-livestreams-and-uncovered-a-new-web-exploit-class-rre-f74b7ef996e7- RRE Burp Suite extension: https://github.com/jumpycastle/rre-burp- I scanned 1 million domains for Firebase misconfigurations: https://jumpycastle.dev/i-scanned-1-million-domains-for-firebase-misconfigurations-f18c2e0c3f1e- The 20-second Firebase demo (LinkedIn): https://www.linkedin.com/feed/update/urn:li:activity:7472317351636385792/- Collaboration for battling security incidents, LWN.net report on his SunSecCon 2026 keynote: https://lwn.net/Articles/1063459/Other resources:- PortSwigger Top 10 Web Hacking Techniques of 2025, nominations list: https://portswigger.net/research/top-10-web-hacking-techniques-of-2025-nominations-open- Inside the race to adapt to an AI-powered security world, CyberScoop: https://cyberscoop.com/ai-powered-cybersecurity-mythos-xbow-agentic-pen-testing/- XBOW's published Moderna customer story (vendor case study): https://xbow.com/customer-stories/modernaFollow along for more free cybersecurity education.LinkedIn: https://www.linkedin.com/in/evabenn/Instagram: https://instagram.com/evabennofficialTikTok: https://www.tiktok.com/@evabennofficialWebsite: https://www.evabenn.com/
