Microsoft Threat Intelligence Podcast

The episode contains genuine practitioner insights - the fireproof-safe reward-adjustment model, the 2026 triage-trash-fire prediction, AI atrophy for skilled writers, and the bug-bounty-to-ASM origin story - but roughly half the runtime is consumed by personal tangents on party planning, sci-fi movies, eye candy bars, and general mental-health discussion that adds zero operational value.

“I actually kind of went on record predicting that back in Q4 of last year. Just saying, yeah, 2026 is going to be a triage trash fire for basically the entire Internet”

“your fireproof safe is now rated to 2700 Fahrenheit instead of 2200 Fahrenheit. It's time to actually increase that reward”

A handful of fresh framings land - 'vibe crime,' the fireproof-safe bounty-scaling model, and AI-induced skill atrophy - but the episode leans heavily on stock security-community consensus (AI lowers barriers for both sides, community matters, transparency is good) without first-principles argument or genuine contrarianism.

“I think vibe crime is, is definitely...we've seen like a rise in like sloppy but effective, you know, cyber criminal campaigns”

“the thing that was a tell was like, when I went to write on my own, it was hard...what had happened was there was, like, a degree of atrophy that had kicked in”

Casey Ellis is a genuine practitioner - Bugcrowd founder, Disclose.io co-founder, 15 years running coordinated disclosure at scale - not a career podcast guest, and he draws on real operational experience; however the conversational format prevents him from going deep enough to fully showcase that expertise.

“in 15 years of like coordinating hacking the Internet at scale like that is the one thing that works reliably”

“from what I've seen through bug crowds, through working with security researchers, all that other stuff, there's a lot more vulnerabilities out there than I think people care to admit”

The episode offers a respectable cluster of named references - Project Zero's 90+30 standard, Pwn to Own researcher 'Chompy,' implanted cardiac defibrillators as a patching edge case, Japan's hackback legislation, Scattered Spider, the Comm - but is largely devoid of hard numbers, CVEs, actual bounty payout figures, or breach data that would make claims verifiable.

“Google Project Zero have done a lot around this whole kind of 90 plus 30 standardization”

“you can't patch an entire fleet of you know, internal cardiac defibrillators that are implanted inside humans within 90 plus 30 days”

The host lands one genuinely sharp binary framing ('Is AI mostly making the elite great researchers faster, or is it making mediocre researchers more effective?') and surfaces a good listener question on disclosure timelines, but the interview drifts badly into mutual validation, personal AI-tool anecdotes, and a sci-fi movie segment, with zero meaningful pushback on any claim Ellis makes.

“Is AI mostly making the elite great researchers faster, or is it making mediocre researchers more effective?”

“What's your favorite sci fi movie?”