Cloud Security Podcast by Google EP254 Escaping 1990s Vulnerability Management: From Unauthenticated Scans to AI-Driven Mitigation
Dec 1, 2025
Caleb Hoch, a Consulting Manager at Mandiant, specializes in cyber defense and vulnerability management transformation. He discusses the outdated nature of vulnerability management practices that still linger since the 1990s. Caleb explains why many organizations shy away from authenticated scans due to fear and resource issues. He outlines a gold-standard prioritization process for 2025 that incorporates contextual factors. Additionally, he warns of AI's rapid impact on exploit development, emphasizing the urgent need for effective mitigation strategies.
AI Snips
Chapters
Transcript
Episode notes
Scanning-Only Practices Persist
- Many organizations still only scan and report, reflecting decades-old practices.
- Proactive measures like attack-surface and configuration management are slowly emerging.
VM Is Unfashionable Yet Critical
- Vulnerability management feels 'uncool' so it gets deprioritized compared to flashier security domains.
- That neglect, plus misconceptions about compensating controls, keeps VM stuck in old patterns.
Require Validation For Mitigations
- Validate compensating controls before accepting them as remediation alternatives.
- If you cannot prove controls across the estate, treat mitigations cautiously and invest in validation capabilities.