ExpedITioners

The episode has pockets of useful operational content - passive traffic sampling for fragile OT/ICS environments, using asset fingerprint data as a proxy for zero-day exposure before vuln scanners update - but large portions are product explanation, career biography, and BSides NYC logistics that deliver zero operator value. The ratio of novel idea to filler is low for a 34-minute runtime.

“we have a passive traffic sampling capability that allows folks to learn about those type of devices without ever touching them”

“you can identify devices that are potentially vulnerable. Right? And essentially using asset details as a proxy for that particular CVE”

Most of the conceptual ground covered - deperimeterization, zero trust, SASE, the 'you can't protect what you don't know' mantra - is well-trodden security discourse. The most original element is the empirically-observed correlation between outlier device ranking and vulnerability risk ranking, but it is mentioned without any real depth or contrarian framing.

“we've done some quantitative analysis on our very large database of devices and what we've found is there's actually a very high degree of correlation, uh, between outlier ranking and risk ranking”

“there's like a battle on social media right now about that mantra that you can't protect what you don't know”

Huxley has genuine practitioner depth - multi-decade background spanning firewall deployment, software engineering, and leading a security automation practice at Cisco - but he is currently in a vendor evangelist role, a GTM function, not an active operator solving these problems at scale. The knowledge base is real but the current vantage point is commercial.

“I was at a, um, Cisco Systems where I led a security practice where we were dedicated to automating security operations and incident response playbooks”

“this security evangelist role is very new to me and I'm trying it out and seeing what it's like”

A handful of concrete data points exist - BSides NYC attendance figures, ticket price, student demographic percentage, passive scanning launch timing - but the product capability claims that matter most for operators (e.g., 'very high degree of correlation,' 'very high degree of confidence' on CVE proxying) are asserted without quantification, timelines, or named customer examples.

“we had close to 800 check ins in 2023. So we're shooting for about a thousand”

“this was only introduced last September”

The host (himself a practitioner as CTO of Fleet and co-creator of osquery) makes one genuinely sharp move by positioning Fleet's agent-based approach as complementary rather than competitive, which briefly elevates the dialogue. However, the interview is largely unchallenged, follows a promotional arc for Run Zero, and the second half dissolves into conference-planning logistics with no substantive follow-up questions.

“we at Fleet take almost the opposite approach. Instead of looking at the network and the control planes, we get on the devices and look right at what's on the devices”

“And am I interpreting correctly that you do a lot of this work from the network and the control planes essentially?”