Secure Ventures with Kyle McNulty

The episode contains genuine practitioner insights buried in significant verbal filler and repetitive phrasing - the points on CVE exploitation going 'negative' (pre-announcement exploitation), LLMs being structurally poor at business logic vulnerabilities, and AI auto-remediation potentially breaking features are substantive. However, a significant portion of the runtime is autobiography and vague macro statements about the industry.

“attackers are even reverse engineering all the releases of popular repositories to figure out whether they are about to uh, talk about a CVE or advisory of CVE in a week or two. And they are in, I would say in the negative, not even in the, in the hours or days period.”

“LLMs are very good at findings that are non business logic ones...But the moment you take uh account into authorization privilege escalations or like business logical ones, uh they still do a very poor job.”

A few genuinely counterintuitive angles emerge - particularly the pre-announcement CVE exploitation thesis and the AI auto-remediation feature-breaking problem - but the macro framing around expanding attack surfaces, AI noise in bug bounties, and the harness-vs-model debate are well-circulated takes in security circles.

“attackers are even reverse engineering all the releases of popular repositories to figure out whether they are about to uh, talk about a CVE or advisory of CVE in a week or two”

“I don't think I am not saying that teams have figured out how to act on the remediation cycles and like shorten that out. And that's my hope that we uh, like from cybersecurity we all figure that out in the next six to eight months. If you don't then it is going to be a bit wild”

Rishi is a genuine practitioner: started bug bounties at 15, built Nuclei into a major open-source security standard used across the industry, and co-founded a real product company with VC backing. He speaks from firsthand operational experience rather than abstraction, which gives his claims credibility even when the delivery is unpolished.

“when we started in 2021 with nuclear and other projects, we were seeing weeks to months uh, from a given CVE to exploitation period. Now in some cases attackers are even reverse engineering all the releases”

“we have around more than 10,000 detection templates but 80% of them are written by community”

The episode has a useful mix of concrete data points - bounty dollar figures, GitHub star counts, template percentages, token context windows, per-report instance discovery rates - but slides frequently into generality ('a bit of a bottleneck,' 'much more complicated') and several key claims lack supporting evidence or named references.

“we have around more than 10,000 detection templates but 80% of them are written by community”

“for each report they used to find eight or ten net new instances vulnerable from the same vulnerability”

The host occasionally reframes or sharpens the guest's point (e.g., clarifying 'all time high' as 'all time low in time-to-exploit') and asks a few structurally sound follow-ups about bottlenecks and model vs. harness tradeoffs, but never meaningfully challenges a claim, lets vague macro assertions pass unchallenged, and spends notable time on tangential biography.

“when you say all time highs, just to be clear, right, you're talking about record speed. So in some ways it's actually kind of like an all time low in terms of the amount of time to develop uh, some of these exploits”

“What do you think the bottleneck is for doing remediation with these models? Right. Because if I think about the different types of vulnerabilities that need to be um, actually remediated.”