runZero, Inc

AI vulnerability discovery is here. From DARPA’s AIxCC finding 54 vulnerabilities in hours to APT28 reportedly folding LLMs into malware, the exploitation gap is closing.

During their #RSAC 2026 session, runZero’s CEO HD Moore, Google’s Heather Adkins, and Knostic’s Gadi Evron will examine the evidence of this shift and discuss how to prepare.

Preparing for AI Vulnerability Exploitation: Preventing Cataclysm
🗓️ Mon, Mar 23 | 10:50 AM PT | Moscone West 3011
https://path.rsaconference.com/flow/rsac/us26/FullAgenda/page/catalog/session/1756084038274001H91n

⚡ Starting in 1 hour: runZero Hour!

Join @todb@infosec.exchange, @rk@mastodon.well.com, & Ulises Fuentes Venado from GuidePoint Security for an in-depth discussion on the evolving security challenges facing OT environments.

🗓️ March 18 | 1 PM ET / 10 AM PT
Register now: https://www.runzero.com/research/runzero-hour/

On Tuesday, March 24 between 11AM-12 PM PT join author Caroline Wong for the release of "The AI Cybersecurity Handbook" at #RSAC!

runZero and Mallory are thrilled to be co-hosting a private book signing with AI cybersecurity strategist Caroline Wong during #RSAC 2026.

This is your opportunity to meet the expert Fortune 500 organizations are turning to for AI guidance on governance, risk, and resilience.

Get your signed copy at #RSAC. Space is limited—register now!

https://www.runzero.com/caroline-wong-book-signing/

Tomorrow on the runZero Hour: Deep dive into OT retroencabulation

Join @todb@infosec.exchange, @rk@mastodon.well.com, & Ulises Fuentes Venado from GuidePoint Security for an in-depth discussion on the evolving security challenges facing OT environments.

📅 March 18 | 1 PM ET / 10 AM PT
Register: https://www.runzero.com/research/runzero-hour/

Meet renowned author and investigative journalist @JosephMenn@infosec.exchange!

Join runZero and Mallory on Tuesday, March 24 from 3:30 PM-4:30 PM PT for a private book signing with Joseph Menn, investigative journalist and author of "Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World."

Don’t miss this opportunity to meet the author and get a signed copy of the book.

Limited space—register now! https://www.runzero.com/joseph-menn-book-signing/

Ready to see and secure your total attack surface? Don’t miss this opportunity to book a 1:1 meeting with our experts at #BSidesSF or #RSAC!

🗓️ Book a 1:1 meeting: https://www.runzero.com/rsac-2026/

Can’t make it to #RSAC?

Join us for runZero Day, our first day-long livestream at #RSAC 2026. Hear from industry experts on CVE program dynamics, the state of modern cybersecurity journalism, OT security, the startup ecosystem, and much more!

Register at: https://www.runzero.com/rsac-live-2026/

Are you going ✈️ to San Francisco for @bsidessf@infosec.exchange and #RSAC? Come connect with us!

We’ll be around all week (Mar 21-26) and cannot wait to meet with you.

Don’t miss any of the great adventures we have in store – join us for one or all!

Learn more & register at: 👉 https://www.runzero.com/rsac-bsides-2026/

Next week on the runZero Hour: Deep dive into OT retroencabulation

Join @todb@infosec.exchange, @rk@mastodon.well.com, & Ulises Fuentes Venado from GuidePoint Security for an in-depth discussion on the evolving security challenges facing OT environments.

📅 March 18 | 1 PM ET / 10 AM PT
Register: https://www.runzero.com/research/runzero-hour/

🔎 Tracking unsupported edge devices just got easier.

CISA’s BOD 26-02 requires federal civilian agencies to identify unsupported edge devices like firewalls, VPNs, routers, and proxies exposed to the internet. The first milestone hits May 5, 2026.

To make this easier, we’ve added a new Findings tab in runZero that surfaces internet-exposed devices in an EOL Extended state.

👉 @todb@infosec.exchange and Matthew Kienow reveal how it works: https://www.runzero.com/blog/finding-cisa-bod-26-02/

Tomorrow: @SecurityWeek@infosec.exchange OT security webinar 💻

Move past the doom and gloom. @todb@infosec.exchange and @rk@mastodon.well.com dig into the mechanics of modern OT exposure and how security teams can get visibility into these fragile environments and defend them.

📅 Mar 10 | ⏰ 1 PM ET / 10 AM PT
Register now 👉 https://event.on24.com/wcc/r/5250079/32BBE7073E6B004D806BE6486AB81B5C?partnerref=runzero

⚙️ The OT air gap is gone. Now what?

IT and OT networks are converging, exposing fragile legacy systems to modern threats.

Join @todb@infosec.exchange and Rob King for a SecurityWeek webinar on gaining visibility into OT environments without disruption.

📅 Mar 10
👉 https://event.on24.com/wcc/r/5250079/32BBE7073E6B004D806BE6486AB81B5C?partnerref=runzero

Big News: Our CEO @hdm@infosec.exchange is a 2026 SC Awards Innovator of the Year finalist!

HD spent decades disrupting the status quo to move the needle for defenders. That same spirit drives @runZeroInc@infosec.exchange to deliver unrivaled attack surface visibility & real-time exposure insights. Congrats to all finalists – see you at #RSAC!
https://www.scworld.com/news/2026-excellence-awards-finalists-announced-winners-revealed-at-rsa-conference

The air gap is dead, and the illusion of segmentation is very much alive.

In our latest post, we break down four key failure modes for OT and what you can do about them.

Read it here 🔗 https://www.runzero.com/blog/segmentation-illusion/

AirSnitch just broke Wi-Fi client isolation across Netgear, Ubiquiti, Cisco, and more.

Our CEO @hdm@infosec.exchange weighed in for ArsTechnica on why this one matters.

👉 https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

Most enterprises don't fail at asset discovery because of scale. They fail because their tools weren't built for it.

Our own Ali Cheikh breaks down how to achieve full visibility with runZero across even the messiest global networks 👇

https://www.runzero.com/blog/scanning-global-networks/

Missed this month's runZero Hour? It's on-demand!

@todb@infosec.exchange, Rob King, and special guest Wade Sparks III from VulnCheck go deep on CISA KEV: what it is, what gets on it, and why not everything deserves the same urgency.

🎥 Watch here: https://www.runzero.com/resources/runzero-hour-27/

If everything is a priority, nothing is.

@todb@infosec.exchange helped build CISA KEV and his new runZero research finally makes it actionable.

He sat down with Casey Ellis on @riskybusiness@infosec.exchange to talk about what KEV actually is and how to use it right.

🎧 https://www.runzero.com/resources/risky-biz-sponsor-115/

Treating every CISA KEV entry equally is how security teams burn out.

@todb@infosec.exchange sat down with Sean Martin to talk smarter prioritization (and discuss our new KEVology report & KEV Collider tool!).

📺 Watch the full interview: https://www.runzero.com/resources/kev-vulnerabilities-itsp-magazine/

End-of-service (EOS) edge devices exposed to the internet are basically a 'please hack me' sign taped to your front door. CISA agrees. BOD 26-02 is their way of saying so.

@todb@infosec.exchange, Matthew Kienow, and Colin Dupreay just dropped a blog breaking down what BOD 26-02 means for you, why CISA keeping their EOS device list private is a bummer, and how runZero customers can get ahead of it today.

👉 Give it a read: https://www.runzero.com/blog/cisa-bod-26-02-eos-and-runzero/

⚡ Starting in 1 hour: runZero Hour!

Stop drowning in KEV data. Start treating it like intelligence.

Wade Sparks III join @todb@infosec.exchange and @rk@mastodon.well.com show you how to make evidence-based patching decisions for your environment.

⏰ 1pm ET • 10am PT
🔗 https://www.runzero.com/research/runzero-hour/

Tomorrow: How to prioritize the KEV catalog instead of treating it like an endless to-do list.

Join CISA veteran Wade Sparks III, @todb@infosec.exchange, and @rk@mastodon.well.com as they show you how to read KEV as data, not doctrine.

📅 Feb 18 | 1pm ET • 10am PT
🔗 https://www.runzero.com/research/runzero-hour/

The first rule of the Austin hacker scene? You have to talk 🤐

@hdm@infosec.exchange sits down with Elliot Fielding to talk about the culture of participation, early days of Metasploit, and his journey from Whataburger rejection to joining the Air Force at age 16.

Watch the full interview: 🔗 https://www.runzero.com/resources/keep-austin-secure-podcast-5/

The KEV updates constantly, but most vuln workflows treat it like static data.

🛠️ Our new tool, KEV Collider, changes that.

Finally, you can interrogate the KEV by what matters: EPSS trends, ransomware usage, timing patterns.

Here's how to use it 👉 https://www.runzero.com/blog/how-to-use-the-kev-collider/

The CISA KEV is an essential signal, but treating it as a universal "to-do" list is a recipe for operational burnout.

Kevin Townsend (SecurityWeek) recently looked at how we’re helping teams move beyond blind reliance on the catalog. By using the KEVology report and the KEV Collider tool, practitioners can supercharge KEV data with the exploit context needed for a truly strategic strike plan.

🔗 Full article: https://www.securityweek.com/new-paper-and-tool-help-security-teams-move-beyond-blind-reliance-on-cisas-kev-catalog/

Next week on the runZero Hour: How to prioritize KEV instead of treating it like a never-ending to-do list 📋

Wade Sparks III + @todb@infosec.exchange and Rob King show you how to read KEV as data, not doctrine.

📅 Feb 18 | 1pm EST
👉 https://www.runzero.com/research/runzero-hour/

Prioritizing vulnerabilities remains one of the most significant hurdles in cybersecurity. In a recent feature for @darkreading@bird.makeup, Rob Lemos explores how runZero's latest research and tooling aim to solve this "triage fatigue."

The article takes a deep dive into the launch of our KEVology report and the KEV Collider tool, highlighting how data-driven prioritization can transform CISA’s Known Exploited Vulnerabilities (KEV) catalog from a daunting list into an actionable strategy.

We would like to extend a sincere thanks to Robert for his thoughtful analysis and for sharing these new resources with the community!

Read the full article here:

https://www.darkreading.com/threat-intelligence/data-tool-triage-exploited-vulnerabilities-make-kev-catalog-more-useful

As the winter games begin, we're wondering what a CVE Olympics would look like?

They don’t come in bronze, silver, or gold, but you can spot real contenders by EPSS scores that spike like they just nailed a surprise triple‑axel.

Check out EPSS Pulse: https://www.runzero.com/epss-pulse/

Patching KEV in order? You're doing it wrong.

68% of KEV entries need context to prioritize. Our new report by former Section Chief @todb@infosec.exchange + free KEV Collider tool helps you prioritize, not check boxes:

📄 Report: runzero.com/resources/kevology/
🧪Tool: runzero.com/kev-collider/

On the next runZero Hour: KEVology 101 with CISA KEV veteran Wade Sparks.

The CISA KEV tells you what to patch. Not when, how urgently, or why it matters to you. Join @todb@infosec.exchange, Rob & Wade to learn how to treat KEV as data, not doctrine.

📅 Feb 18 ⏰ 1pm ET

🔗 Register here: https://www.runzero.com/research/runzero-hour/

🚨 New report + tool: CISA KEV analysis by former Section Chief @todb@infosec.exchange + KEV Collider to help you prioritize real exploits over noise.

📄 Report: https://www.runzero.com/resources/kevology/
🧪 Tool: https://www.runzero.com/kev-collider/
✍️ Blog: https://www.runzero.com/blog/making-cisa-kev-actionable/

Ready to make KEV actionable?

▶️ Watch on demand: Customer webcast with Marco Strambelli and @todb@infosec.exchange!

When you’re integrating acquisitions, inherited risk and unknown assets aren’t edge cases—they’re the norm.

Hear how TeamSystem accelerated M&A integration by gaining asset visibility in hours, enabling faster onboarding and more confident risk decisions.

▶️ Watch now: https://www.runzero.com/resources/teamsystem-webcast/

🚀 Exciting news for runZero users!

Our new Platform (and Community Edition) feature offers recurring internet speed tests for all deployed Explorers!

Identify remote connectivity issues and smooth your deployment.

Pete Caldecourt provides the details: https://www.runzero.com/blog/internet-speed-tests/